I tried the exploit with meterpreter reverse tcp on both SP1/SP3 machines and both returned a statement of exploit completed but no session was created. Both machines have firewall off. I want to have my first meterpreter session opened to experiment with this. BTW, these are virtual machines.


Started reverse TCP handler on [LHOST]:4444
Automatically detecting your target 
Fingerprint: Windows XP SP3 English (AlwaysOn NX)
Selected Target: Windows XP SP3 English (AlwaysOn NX)
Attempting to trigger the vulnerability 
Exploit completed, but no session was created
  • 1
    Please provide a list of all of the commands you executed along with a netstat or nmap of the Windows machine. – 16b7195abb140a3929bbc322d1c6f1 Feb 3 '16 at 4:22
  • confirm the networking between the attacker and target - can you ping? Can you see the exploit occurring on the target? What do the packet traces say? – schroeder Feb 3 '16 at 4:49
  • 1
    Run nmap -p 445 --script smb-check-vulns <IP> and look at the results. The machine should be vulnerable only then the exploit will work. – void_in Feb 3 '16 at 11:06
  • I can ping with quite some speed – silentcallz Feb 3 '16 at 20:29
  • Nmap scan doesn't work and it shows the default list of commands from nmap – silentcallz Feb 3 '16 at 20:34

There are many reasons for this exploit to fail, in short:

  • The target is patched.
  • 'Not supported language' error from the target.
  • The payload can't execute correctly.
  • Networking errors 'reverse connection through NAT'.

From experience with the same issue, I recommend to do the following:

  • Try not to use VMs.
  • Try another payloads, away from reverse connections.
  • Try other versions of Windows XP.
  • Change system languages 'sometime it works!'

After all, since it says Exploit completed, but no session was created that means something is preventing the reverse connection, mostly the system is patched.

|improve this answer|||||
  • Is it possible that kali is blocking the reverse connection port 4444 – silentcallz Feb 3 '16 at 20:28
  • SP 1 Result shows that it can't detect the language – silentcallz Feb 3 '16 at 21:10

This is old but I had an actual need to get the admin password from my lab xp in order to update a guitar pedal (wouldn't update on windows 10 so I needed xp). It's been a few years since I worked on this XP/exploit but the reverse tcp used to work. I am using an updated version of Kali now and the reverse doesn't work. I used the following to get it to work correctly

set payload windows/meterpreter/bind_tcp

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.