1

In a meterpreter reverse_https session when I use the detach command it closes my current session and then creates another, what it is the purpose of this?

1

The payload will keep trying to connect back until SessionExpirationTimeout is hit. Default is one week.

Details here.

The payload has a hard-coded expiration date stamped into it during the initial staging process. By default, this is one week from the current date (relative to the target). This prevents a forgotten session from connecting back indefinitely. You can control this setting through the SessionExpirationTimeout advanced option.

To avoid shutting down the payload but still exit the temporary session, use the detach command from the Meterpreter prompt

Setting [SessionExpirationTimeout] option to 0 and detaching the session will instruct the payload to keep reaching out until the SessionCommunicationTimeout is hit or the process is killed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.