When a user launches Armitage or Cobalt Strike on Windows and presses Start MSF, they’re presented with a curious error. It states: You must connect to a team server hosted on Linux. Connecting to a Metasploit RPC server on Windows is not supported.

This error generates a lot of requests for help in various forums and I occasionally get email about it too.

Armitage and Cobalt Strike are clients designed to connect to a server. There are two options for this server. They may connect to the Metasploit Framework directly via its RPC server. Or, they may connect to a team server.

The Metasploit Framework’s RPC server is a version of the Metasploit Framework that allows third-party tools to interact with and control it. You can read about what it provides in the Metasploit API documentation.

A team server is an Armitage (and Cobalt Strike) construct that wraps the Metasploit Framework RPC server and provides additional services. I originally built the team server  to share a Meterpreter session among multiple users and to provide needed functions to use the Metasploit Remote API from a remote client.

In November 2013, I made the decision to drop Windows support for the server side of Armitage and Cobalt Strike. This means that you can not setup a team server on Windows (this was never supported) and the tools do not allow you to start the Metasploit Framework and connect to it on Windows.

You may still use Cobalt Strike and Armitage from Windows though. Start a team server on Kali Linux or one of the other supported environments. Tell Armitage or Cobalt Strike to connect to this remote team server. Everything will work fine.