Skip to main content
added 51 characters in body; added 11 characters in body
Source Link
SilverlightFox
  • 34.4k
  • 6
  • 73
  • 192

When I'm setting the options for the reverse_https handler in metasploit why would I set ExitOnSession to false and SessionCommunicationTimeout to 0, and don't [fully] understand the purpose.

If SessionCommunicationTimeout is 0:

setting this to 0 will result in a session that will never timeout, which has some interesting uses

It will keep connecting back using the connection to the HTTPS endpoint.

And why when ExitOnSession is false I can only use exploit -j and not exploit?

Because you need the handler to runcan continue running as a job, otherwise it would have to exit wheneven in the case of a closed, or failed meterpreter session had existed. It only applies to jobs(-j) as these are the only ones that run in normal foreground modethe background.

For more info, see here.

When I'm setting the options for the reverse_https handler in metasploit why would I set ExitOnSession to false and SessionCommunicationTimeout to 0, and don't [fully] understand the purpose.

If SessionCommunicationTimeout is 0:

setting this to 0 will result in a session that will never timeout, which has some interesting uses

It will keep connecting back using the connection to the HTTPS endpoint.

And why when ExitOnSession is false I can only use exploit -j and not exploit?

Because you need the handler to run as a job, otherwise it would have to exit when the session had existed in normal foreground mode.

For more info, see here.

When I'm setting the options for the reverse_https handler in metasploit why would I set ExitOnSession to false and SessionCommunicationTimeout to 0, and don't [fully] understand the purpose.

If SessionCommunicationTimeout is 0:

setting this to 0 will result in a session that will never timeout, which has some interesting uses

It will keep connecting back using the connection to the HTTPS endpoint.

And why when ExitOnSession is false I can only use exploit -j and not exploit?

Because the handler can continue running as a job, even in the case of a closed, or failed meterpreter session. It only applies to jobs(-j) as these are the only ones that run in the background.

For more info, see here.

Source Link
SilverlightFox
  • 34.4k
  • 6
  • 73
  • 192

When I'm setting the options for the reverse_https handler in metasploit why would I set ExitOnSession to false and SessionCommunicationTimeout to 0, and don't [fully] understand the purpose.

If SessionCommunicationTimeout is 0:

setting this to 0 will result in a session that will never timeout, which has some interesting uses

It will keep connecting back using the connection to the HTTPS endpoint.

And why when ExitOnSession is false I can only use exploit -j and not exploit?

Because you need the handler to run as a job, otherwise it would have to exit when the session had existed in normal foreground mode.

For more info, see here.