I am using this exploit on msfconsole to exploit a VM with samba and the configuration is as follows:

Module options (exploit/linux/samba/sambacry)
Payload options (linux/x64/meterpreter/reverse_tcp)
2   Linux x86_64 -> target

the rhost, rport, lhost, and lport are also set.

I run the exploit on kali linux on an aws ec2 instance. Each VM is in a different subnetwork, but I can ping one another with their respective private ip addresses.

Both VMs have no firewalls (security groups desabled allowing all inbound and outbound traffic)

The samba version I am using is 4.3.11 for ubuntu 4.4.0-1066-aws

Does anyones know the reason for me still getting "Exploit completed, but no session was created." ?

  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop
    Sep 2, 2018 at 8:27

2 Answers 2


Target might have some sort of antivirus. Also maybe you mistyped some of data like lport,lhost.

  • And outbound firewall rules Aug 28, 2018 at 18:20
  • @Dogeatcatworld the OP said that there are no firewalls
    – schroeder
    Aug 28, 2018 at 18:52
  • 1
    There is no antivirus on the machines. I think the problem might be the fact that I am using virutal machines on amazon web service environment. But I am not sure. Aug 28, 2018 at 18:55
  • @schroeder true. I ran into something similar the other day, where both antivirus and firewall rules were in the way. Could be an idea to test a connection with the same RHOST/RPORT parameters between he VM's. Aug 28, 2018 at 20:58
  • I did test the RHOST/RPORT between VMs with telnet on RPORT 445. The port state is on LISTEN state with smbd process PID 1005. Aug 29, 2018 at 18:05

If you are not sure if your exploit work in that version, the 4.5.9 version is vulnerable for sure.

If you are using the reverse_tcp payload, do a test, in your attacker machine open a port and listen (nc -l -p <the reverse port that you are using>), and in your target machine try to connect to your attacker machine by nc -v <attacker> <port>. It should be verbose enough to determine if you have connectivity or not.

If all that works, here a Docker container if you want to test this exploit against a target that is for sure vulnerable https://github.com/opsxcq/exploit-CVE-2017-7494

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .