After generating the encoded malicious file, the Metasploit listener starts waiting for back connections. The only limitation to this attack is that the removable media must have autorun enabled; otherwise, manual trigger will be required.
This type of attack vector can be helpful in situations where the target user is behind a firewall. Most antivirus programs nowadays disable autorun, which in turn renders this type of attack useless. The pentester, along with autorun-based attacks, should also ensure that a backdoor, legitimate executable/PDF is provided, along with the media. This will ensure that the victim invariably executes one of the payloads.
