ms08_067_netapi not performing as expected on Windows XP SP1/SP3

Question

I tried the exploit with meterpreter reverse tcp on both SP1/SP3 machines and both returned a statement of exploit completed but no session was created. Both machines have firewall off. I want to have my first meterpreter session opened to experiment with this. BTW, these are virtual machines.

XP SP3 RESULT:

Started reverse TCP handler on [LHOST]:4444
Automatically detecting your target 
Fingerprint: Windows XP SP3 English (AlwaysOn NX)
Selected Target: Windows XP SP3 English (AlwaysOn NX)
Attempting to trigger the vulnerability 
Exploit completed, but no session was created

Please provide a list of all of the commands you executed along with a netstat or nmap of the Windows machine. — 16b7195abb140a3929bbc322d1c6f1, Feb 03 '16 at 04:22
confirm the networking between the attacker and target - can you ping? Can you see the exploit occurring on the target? What do the packet traces say? — schroeder, Feb 03 '16 at 04:49
Run nmap -p 445 --script smb-check-vulns and look at the results. The machine should be vulnerable only then the exploit will work. — void_in, Feb 03 '16 at 11:06
Nmap scan doesn't work and it shows the default list of commands from nmap — silentcallz, Feb 03 '16 at 20:34
I tried nmap with success after disabling the XP firewall, alas the session is still not being created in Metasploit — Hamman Samuel, Mar 23 '16 at 16:55

score 2 · Answer 1 · answered Feb 03 '16 at 07:39

2

There are many reasons for this exploit to fail, in short:

The target is patched.
'Not supported language' error from the target.
The payload can't execute correctly.
Networking errors 'reverse connection through NAT'.

From experience with the same issue, I recommend to do the following:

Try not to use VMs.
Try another payloads, away from reverse connections.
Try other versions of Windows XP.
Change system languages 'sometime it works!'

After all, since it says Exploit completed, but no session was created that means something is preventing the reverse connection, mostly the system is patched.

answered Feb 03 '16 at 07:39

Eibo

2,485
3
19
32

Is it possible that kali is blocking the reverse connection port 4444 – silentcallz Feb 03 '16 at 20:28
SP 1 Result shows that it can't detect the language – silentcallz Feb 03 '16 at 21:10

score 0 · Answer 2 · edited Oct 12 '19 at 14:54

This is old but I had an actual need to get the admin password from my lab xp in order to update a guitar pedal (wouldn't update on windows 10 so I needed xp). It's been a few years since I worked on this XP/exploit but the reverse tcp used to work. I am using an updated version of Kali now and the reverse doesn't work. I used the following to get it to work correctly

set payload windows/meterpreter/bind_tcp

ms08_067_netapi not performing as expected on Windows XP SP1/SP3

2 Answers2

Linked