Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am currently learning some basic penetration testing using Metasploit. I have set up a reverse tcp meterpreter payload that I run on an Amazon EC2 Windows instance. Sometimes while moving a new payload the machine, the listener that I have set up in Metasploit will be connected to and successfully send a payload, resulting in an open meterpreter session on somebody's computer. It has happened twice so far with connections from India and Russia. The sessions close automatically after 30-60 seconds (Reason: Died).

I figured that random connections would occur due to port-scans and whatnot, but these connections have actually downloaded and run meterpreter.

1) Why is this happening? 2a) Is there a way to use Metasploit to prevent this? (I don't want to be slammed for "hacking" some guy in Russia) 2b) If not, is iptables the best method?

Sorry if these are basic questions! Thanks!

share|improve this question
    
Are you absolutely, positively certain that you are getting a real Meterpreter shell on these computers? As in, you typed a shell command and got a real response back? –  Anorov May 7 '13 at 0:47
    
Metasploit said that a meterpreter session had opened, and when I ran 'sessions -l' I could see operating systems and their administrator account names. I interacted with the first one and tried to close remove meterpreter, but I couldn't remember the command, so I typed 'help', which brought up all of the meterpreter commands. –  zen May 7 '13 at 10:14
add comment

3 Answers

I ran into this a few years ago while showing a coworker how to use SET.

Basically you have your listener open and they'll see it in port scans. I was seeing shellcode too being sent over in the console as well, which was hilarious. Basically what you have is a ghetto honeypot.

share|improve this answer
add comment

Perhaps you could change the port you're listening on to something more obscure? I think you'll probably be safe legally since you aren't hacking anyone, they're essentially hacking you (and stealing a malicious payload?), but I think that's a pretty funny phenomenon. Good luck, I know I would be tempted to poke around the intruder's computer a bit.

share|improve this answer
add comment

This does not sound like a Metasploit configuration issue, but an inadvertent malicious asset issue. To me, it sounds like you have an asset out there (web site?) that is actively exploiting computers that connect to it, which in turn connect back to your Metasploit listener.

To fix that, you will need to configure the firewall on your asset (web server?) to only allow your computers to connect to it. Otherwise, I'm afraid you are doing something that is considered illegal in many jurisdictions ....

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.