I am currently learning some basic penetration testing using Metasploit. I have set up a reverse tcp meterpreter payload that I run on an Amazon EC2 Windows instance. Sometimes while moving a new payload the machine, the listener that I have set up in Metasploit will be connected to and successfully send a payload, resulting in an open meterpreter session on somebody's computer. It has happened twice so far with connections from India and Russia. The sessions close automatically after 30-60 seconds (Reason: Died).

I figured that random connections would occur due to port-scans and whatnot, but these connections have actually downloaded and run meterpreter.

1) Why is this happening? 2a) Is there a way to use Metasploit to prevent this? (I don't want to be slammed for "hacking" some guy in Russia) 2b) If not, is iptables the best method?

Sorry if these are basic questions! Thanks!

  • Are you absolutely, positively certain that you are getting a real Meterpreter shell on these computers? As in, you typed a shell command and got a real response back?
    – Anorov
    May 7, 2013 at 0:47
  • Metasploit said that a meterpreter session had opened, and when I ran 'sessions -l' I could see operating systems and their administrator account names. I interacted with the first one and tried to close remove meterpreter, but I couldn't remember the command, so I typed 'help', which brought up all of the meterpreter commands.
    – zen
    May 7, 2013 at 10:14

4 Answers 4


I ran into this a few years ago while showing a coworker how to use SET.

Basically you have your listener open and they'll see it in port scans. I was seeing shellcode too being sent over in the console as well, which was hilarious. Basically what you have is a ghetto honeypot.


Perhaps you could change the port you're listening on to something more obscure? I think you'll probably be safe legally since you aren't hacking anyone, they're essentially hacking you (and stealing a malicious payload?), but I think that's a pretty funny phenomenon. Good luck, I know I would be tempted to poke around the intruder's computer a bit.


This does not sound like a Metasploit configuration issue, but an inadvertent malicious asset issue. To me, it sounds like you have an asset out there (web site?) that is actively exploiting computers that connect to it, which in turn connect back to your Metasploit listener.

To fix that, you will need to configure the firewall on your asset (web server?) to only allow your computers to connect to it. Otherwise, I'm afraid you are doing something that is considered illegal in many jurisdictions ....


you should have something of this format as your handler on your msfconsole:

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LPORT 8899
set ExitOnSession false
exploit -j
  • can you explain why these commands are related to the question being asked?
    – schroeder
    Oct 27, 2016 at 17:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .