0

I am currently learning some basic penetration testing using Metasploit. I have set up a reverse tcp meterpreter payload that I run on an Amazon EC2 Windows instance. Sometimes while moving a new payload the machine, the listener that I have set up in Metasploit will be connected to and successfully send a payload, resulting in an open meterpreter session on somebody's computer. It has happened twice so far with connections from India and Russia. The sessions close automatically after 30-60 seconds (Reason: Died).

I figured that random connections would occur due to port-scans and whatnot, but these connections have actually downloaded and run meterpreter.

  1. Why is this happening?
  2. Is there a way to use Metasploit to prevent this? (I don't want to be slammed for "hacking" some guy in Russia) If not, is iptables the best method?
Improve this question
2
  • Are you absolutely, positively certain that you are getting a real Meterpreter shell on these computers? As in, you typed a shell command and got a real response back?
    – Anorov
    Commented May 7, 2013 at 0:47
  • Metasploit said that a meterpreter session had opened, and when I ran 'sessions -l' I could see operating systems and their administrator account names. I interacted with the first one and tried to close remove meterpreter, but I couldn't remember the command, so I typed 'help', which brought up all of the meterpreter commands.
    – zen
    Commented May 7, 2013 at 10:14

3 Answers 3

Reset to default
1

I ran into this a few years ago while showing a coworker how to use SET.

Basically you have your listener open and they'll see it in port scans. I was seeing shellcode too being sent over in the console as well, which was hilarious. Basically what you have is a ghetto honeypot.

Improve this answer
0

Perhaps you could change the port you're listening on to something more obscure? I think you'll probably be safe legally since you aren't hacking anyone, they're essentially hacking you (and stealing a malicious payload?), but I think that's a pretty funny phenomenon. Good luck, I know I would be tempted to poke around the intruder's computer a bit.

Improve this answer
0

This does not sound like a Metasploit configuration issue, but an inadvertent malicious asset issue. To me, it sounds like you have an asset out there (web site?) that is actively exploiting computers that connect to it, which in turn connect back to your Metasploit listener.

To fix that, you will need to configure the firewall on your asset (web server?) to only allow your computers to connect to it. Otherwise, I'm afraid you are doing something that is considered illegal in many jurisdictions ....

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .