Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently learning some basic penetration testing using Metasploit. I have set up a reverse tcp meterpreter payload that I run on an Amazon EC2 Windows instance. Sometimes while moving a new payload the machine, the listener that I have set up in Metasploit will be connected to and successfully send a payload, resulting in an open meterpreter session on somebody's computer. It has happened twice so far with connections from India and Russia. The sessions close automatically after 30-60 seconds (Reason: Died).

I figured that random connections would occur due to port-scans and whatnot, but these connections have actually downloaded and run meterpreter.

1) Why is this happening? 2a) Is there a way to use Metasploit to prevent this? (I don't want to be slammed for "hacking" some guy in Russia) 2b) If not, is iptables the best method?

Sorry if these are basic questions! Thanks!

share|improve this question
Are you absolutely, positively certain that you are getting a real Meterpreter shell on these computers? As in, you typed a shell command and got a real response back? – Anorov May 7 '13 at 0:47
Metasploit said that a meterpreter session had opened, and when I ran 'sessions -l' I could see operating systems and their administrator account names. I interacted with the first one and tried to close remove meterpreter, but I couldn't remember the command, so I typed 'help', which brought up all of the meterpreter commands. – zen May 7 '13 at 10:14

I ran into this a few years ago while showing a coworker how to use SET.

Basically you have your listener open and they'll see it in port scans. I was seeing shellcode too being sent over in the console as well, which was hilarious. Basically what you have is a ghetto honeypot.

share|improve this answer

Perhaps you could change the port you're listening on to something more obscure? I think you'll probably be safe legally since you aren't hacking anyone, they're essentially hacking you (and stealing a malicious payload?), but I think that's a pretty funny phenomenon. Good luck, I know I would be tempted to poke around the intruder's computer a bit.

share|improve this answer

This does not sound like a Metasploit configuration issue, but an inadvertent malicious asset issue. To me, it sounds like you have an asset out there (web site?) that is actively exploiting computers that connect to it, which in turn connect back to your Metasploit listener.

To fix that, you will need to configure the firewall on your asset (web server?) to only allow your computers to connect to it. Otherwise, I'm afraid you are doing something that is considered illegal in many jurisdictions ....

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.