Whenever I attempt to use an exploit (that I know will work) from Metasploit in Windows on a machine on my LAN, I always get the error

    Exploit exception: An established connection was aborted by the software in your host machine.

I do not know why this is happening as my firewall is off and anitvirus is disabled. How reliable is this message; is it actually caused because a connection is being aborted or is this just a sign of a more generic problem? Thanks.

  • Operating system? I assume Windows? – schroeder Apr 16 '12 at 22:40
  • cli or console? Can you give us the exploit config? – schroeder Apr 16 '12 at 22:41
  • when you say 'local machine' are you trying to exploit yourself? – schroeder Apr 16 '12 at 22:43
  • Operating system is windows; local machine as in a machine on my LAN; and I'm using console, as an exploit example I was trying out the Rhinosoft Serv-u FTP Web Client Buffer Overflow and it gives me this error, as does IIS 5.0 webdav exploit. – Bhubhu Hbuhdbus Apr 16 '12 at 22:49
  • Is something else using your listener port? Have you tried alternate ports? – schroeder Apr 16 '12 at 22:56

At first look, and without more data, I would still say that you have a local firewall/AV issue.

Run wireshark or tcpdump to see how far the connection gets before it gets aborted.


OR, you might have something running on your listener port.

| improve this answer | |
  • Yeah I'll run tcpdump and see what I get. – Bhubhu Hbuhdbus Apr 16 '12 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.