PT0-002 · Question #601
A penetration tester ran the following command: The penetration tester successfully delivered this payload by email, and a few company users have executed it. However, reverse shell sessions are not…
The correct answer is A. A firewall rule is blocking incoming traffic. Reverse shell sessions failing to establish despite payload execution and listener activation most likely indicates a firewall issue preventing the incoming connection to the attacker's machine.
Question
A penetration tester ran the following command:
The penetration tester successfully delivered this payload by email, and a few company users have executed it. However, reverse shell sessions are not being established. The output of the Metasploit console is the following:
Which of the following is most likely causing the issue?
Exhibit
Options
- AA firewall rule is blocking incoming traffic.
- BThe targets' antivirus software is blocking outgoing traffic.
- CThe IP address configured in the payload creation is incorrect.
- DThe payload configured in the listener is incorrect.
How the community answered
(16 responses)- A81% (13)
- C6% (1)
- D13% (2)
Why each option
Reverse shell sessions failing to establish despite payload execution and listener activation most likely indicates a firewall issue preventing the incoming connection to the attacker's machine.
If the Metasploit handler is successfully started but no reverse shell sessions are established after the payload is executed, it strongly suggests that an intermediate or host-based firewall is blocking the connection attempt from the target back to the attacker's listening port.
While antivirus software can block payloads, the problem statement focuses on sessions 'not being established' after execution, pointing more towards network connectivity rather than initial execution prevention.
If the IP address in the payload was incorrect, the target would attempt to connect to the wrong address, and the Metasploit console would not even be aware of the connection attempt, making a firewall at the listener less relevant as the primary issue.
The output 'Started reverse TCP handler' indicates that the listener is correctly configured and active for a reverse TCP payload, so the listener's payload configuration itself is not the source of the failure.
Concept tested: Reverse shell session establishment troubleshooting - firewall
Source: https://docs.metasploit.com/docs/using-metasploit/basic-msf-usage/handling-sessions.html
Topics
Community Discussion
No community discussion yet for this question.