1

I tried the exploit with meterpreter reverse tcp on both SP1/SP3 machines and both returned a statement of exploit completed but no session was created. Both machines have firewall off. I want to have my first meterpreter session opened to experiment with this. BTW, these are virtual machines.

XP SP3 RESULT:

Started reverse TCP handler on [LHOST]:4444
Automatically detecting your target 
Fingerprint: Windows XP SP3 English (AlwaysOn NX)
Selected Target: Windows XP SP3 English (AlwaysOn NX)
Attempting to trigger the vulnerability 
Exploit completed, but no session was created
6
  • 1
    Please provide a list of all of the commands you executed along with a netstat or nmap of the Windows machine. Commented Feb 3, 2016 at 4:22
  • confirm the networking between the attacker and target - can you ping? Can you see the exploit occurring on the target? What do the packet traces say?
    – schroeder
    Commented Feb 3, 2016 at 4:49
  • 1
    Run nmap -p 445 --script smb-check-vulns <IP> and look at the results. The machine should be vulnerable only then the exploit will work.
    – void_in
    Commented Feb 3, 2016 at 11:06
  • I can ping with quite some speed Commented Feb 3, 2016 at 20:29
  • Nmap scan doesn't work and it shows the default list of commands from nmap Commented Feb 3, 2016 at 20:34

2 Answers 2

2

There are many reasons for this exploit to fail, in short:

  • The target is patched.
  • 'Not supported language' error from the target.
  • The payload can't execute correctly.
  • Networking errors 'reverse connection through NAT'.

From experience with the same issue, I recommend to do the following:

  • Try not to use VMs.
  • Try another payloads, away from reverse connections.
  • Try other versions of Windows XP.
  • Change system languages 'sometime it works!'

After all, since it says Exploit completed, but no session was created that means something is preventing the reverse connection, mostly the system is patched.

2
  • Is it possible that kali is blocking the reverse connection port 4444 Commented Feb 3, 2016 at 20:28
  • SP 1 Result shows that it can't detect the language Commented Feb 3, 2016 at 21:10
0

This is old but I had an actual need to get the admin password from my lab xp in order to update a guitar pedal (wouldn't update on windows 10 so I needed xp). It's been a few years since I worked on this XP/exploit but the reverse tcp used to work. I am using an updated version of Kali now and the reverse doesn't work. I used the following to get it to work correctly

set payload windows/meterpreter/bind_tcp

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .