💥Payloads
Overview
Metasploit is an automated attack framework developed by Rapid7 that streamlines the process of exploiting vulnerabilities through the use of pre-built modules. It contains easy-to-use options to exploit vulnerabilities and deliver payloads to gain a shell on a vulnerable system.
Important Considerations
Training vs. Real-World Usage:
Some cybersecurity training vendors limit Metasploit usage on lab exams
Most organizations will not limit tool usage on engagements
Understanding tool effects is crucial to avoid destruction in live tests
Responsibility lies with the tester to understand tools, techniques, and methodologies
Metasploit Editions:
Community Edition: Free version used in this documentation
Metasploit Pro: Paid edition used by established cybersecurity firms
Metasploit Pro includes additional features for penetration tests, security audits, and social engineering campaigns
Starting Metasploit
Launch Metasploit Framework Console
Expected Output:
Key Statistics
2131 exploits: Pre-built vulnerability exploits
592 payloads: Available payload options
1139 auxiliary: Supporting modules for scanning/enumeration
363 post: Post-exploitation modules
45 encoders: Payload encoding options
10 nops: No-operation modules
8 evasion: Evasion techniques
Note: These numbers may change as maintainers add/remove modules
Practical Example: SMB Exploitation
Step 1: Target Enumeration
Nmap Scan:
Sample Output:
Key Findings:
SMB service on port 445 (potential attack vector)
Windows 7-10 system
SMB message signing disabled (security weakness)
Step 2: Module Search
Search for SMB modules:
Sample Output:
Step 3: Understanding Module Structure
Module: exploit/windows/smb/psexec
56
Module number (relative to search results)
exploit/
Module type (exploit module)
windows/
Target platform (Windows)
smb/
Service/protocol (SMB)
psexec
Tool/technique (psexec utility)
Step 4: Module Selection
Expected Response:
Prompt Breakdown:
exploit- Module typewindows/smb/psexec- Specific exploit pathDefault payload:
windows/meterpreter/reverse_tcp
Step 5: Examining Module Options
Module Options:
Payload Options:
Step 6: Configuring the Exploit
Required Settings:
Configuration Breakdown:
RHOSTS: Target IP address(es)
SHARE: Administrative share (ADMIN$, C$, etc.)
SMBPass: Password for authentication
SMBUser: Username for authentication
LHOST: Local host IP for reverse connection
Step 7: Executing the Exploit
Execution Output:
Process Breakdown:
Handler Started: Reverse TCP handler listening on LHOST:LPORT
Connection: Connecting to target SMB service
Authentication: Authenticating with provided credentials
Target Selection: Selecting PowerShell target
Payload Execution: Executing the payload on target
Stage Transfer: Sending Meterpreter stage to target
Session Establishment: Meterpreter session opened
Understanding Meterpreter
What is Meterpreter?
Meterpreter is an advanced payload that:
Uses in-memory DLL injection
Establishes stealthy communication channel
Provides extensive post-exploitation capabilities
Operates entirely in memory (difficult to detect)
Key Capabilities
File Operations:
Upload/download files
File system navigation
File manipulation
System Operations:
Execute system commands
Run keylogger
Create/start/stop services
Manage processes
Network Operations:
Port forwarding
Network pivoting
Route manipulation
Advanced Features:
Screenshot capture
Webcam access
Audio recording
Registry manipulation
Meterpreter Commands
Get Help:
Common Commands:
Dropping to System Shell
Access Full System Commands:
Return to Meterpreter:
Metasploit Module Types
1. Exploit Modules
Purpose: Exploit specific vulnerabilities Example: exploit/windows/smb/psexec Usage: Gain initial access to systems
2. Auxiliary Modules
Purpose: Scanning, enumeration, and verification Example: auxiliary/scanner/smb/smb_version Usage: Information gathering and reconnaissance
3. Post Modules
Purpose: Post-exploitation activities Example: post/windows/gather/credentials/credential_collector Usage: After gaining access, collect information
4. Payload Modules
Purpose: Code executed on target after exploitation Example: windows/meterpreter/reverse_tcp Usage: Establish communication channel
5. Encoder Modules
Purpose: Encode payloads to avoid detection Example: x86/shikata_ga_nai Usage: Bypass antivirus and filters
6. NOP Modules
Purpose: No-operation instructions for buffer alignment Example: x86/opty2 Usage: Ensure payload stability
MSFVenom - Standalone Payload Generator
Basic Usage
Generate Windows Reverse Shell:
Generate Linux Reverse Shell:
Generate PHP Web Shell:
Common Parameters
-p
Payload type
windows/meterpreter/reverse_tcp
-f
Output format
exe, elf, raw, python
-o
Output file
shell.exe
-e
Encoder
x86/shikata_ga_nai
-i
Encoding iterations
3
-b
Bad characters
\x00\x0a\x0d
Advanced MSFVenom Examples
Encoded Payload:
Custom Template:
Best Practices
1. Reconnaissance First
Always perform thorough enumeration
Identify target OS and services
Understand network topology
Gather credentials when possible
2. Module Selection
Choose appropriate exploit for target
Consider payload options
Understand module limitations
Test in lab environment first
3. Payload Considerations
Select appropriate payload type
Consider network restrictions
Plan for persistence needs
Understand detection risks
4. Operational Security
Use common ports when possible
Consider encoding for AV evasion
Clean up artifacts after testing
Document all actions taken
5. Session Management
Migrate to stable processes
Create multiple access points
Use appropriate persistence methods
Monitor for detection
Troubleshooting
Common Issues
1. Module Not Found:
2. Payload Mismatch:
3. Connection Issues:
4. Authentication Failures:
Debugging Commands
Show Module Information:
Check Payload Options:
Session Management:
Security Considerations
Detection Risks
Network Level:
Unusual network connections
Known malicious signatures
Behavioral analysis triggers
Host Level:
Process injection detection
In-memory payload signatures
Behavioral monitoring alerts
Mitigation Strategies
For Penetration Testers:
Use custom payloads
Implement proper encoding
Time attacks appropriately
Clean up after testing
For Defenders:
Monitor for known signatures
Implement behavioral analysis
Use application whitelisting
Regular security updates
Summary
Metasploit provides a powerful framework for:
Automated exploitation of known vulnerabilities
Payload delivery through various attack vectors
Post-exploitation activities and persistence
Comprehensive testing of security controls
Key takeaways:
Understand tools before using them
Proper enumeration guides module selection
Meterpreter provides extensive post-exploitation capabilities
Always consider detection and mitigation strategies
Practice in controlled environments first
The combination of Metasploit's exploit modules and payload delivery system makes it an invaluable tool for security professionals, but it requires proper understanding and responsible use to avoid unintended consequences in production environments.
Crafting Payloads with MSFvenom
Understanding Payload Delivery Challenges
Using automated attacks in Metasploit requires network access to vulnerable target machines. However, there are situations where we lack direct network access to a target. In these cases, we need alternative delivery methods such as:
Email attachments with malicious payloads
Social engineering to drive user execution
Physical access via USB drives during onsite tests
Web downloads from compromised or controlled sites
MSFvenom addresses these challenges by providing:
Flexible delivery options for various scenarios
Encryption & encoding to bypass antivirus detection
Multiple output formats for different platforms
Standalone payload generation without full Metasploit
Exploring Available Payloads
List all available payloads:
Sample Output:
Staged vs. Stageless Payloads
Staged Payloads
Characteristics:
Create a way to send more components of the attack
"Setting the stage" for additional functionality
Send small initial stage, then download remainder over network
Requires multiple network communications
Example: linux/x86/shell/reverse_tcp
Initial stage executed on target
Calls back to attack box for remainder
Downloads and executes shellcode
Establishes reverse shell connection
Advantages:
Smaller initial payload size
Can deliver larger, more complex payloads
Flexibility in payload composition
Disadvantages:
Multiple network communications required
Dependent on network stability
Takes up memory space for stages
More detectable due to network traffic
Stageless Payloads
Characteristics:
Complete payload sent in its entirety
No additional network communications required
Self-contained executable code
Single network transmission
Example: linux/zarch/meterpreter_reverse_tcp
Complete payload in one transmission
No additional downloads required
Executes immediately upon receipt
Advantages:
Better for bandwidth-limited environments
Reduced network traffic (better evasion)
No dependency on network stability
Faster execution
Disadvantages:
Larger payload size
Limited by single transmission constraints
Less flexibility in payload composition
Identifying Staged vs. Stageless Payloads
Naming Convention Rules
Staged Payloads:
Each
/represents a stageExample:
linux/x86/shell/reverse_tcp/shell/= stage to send/reverse_tcp= another stage
Stageless Payloads:
All components in single function name
Example:
linux/zarch/meterpreter_reverse_tcpmeterpreter_reverse_tcp= complete payload
Comparison Examples
windows/meterpreter/reverse_tcp
windows/meterpreter_reverse_tcp
linux/x86/shell/reverse_tcp
linux/x86/shell_reverse_tcp
windows/shell/bind_tcp
windows/shell_bind_tcp
Building Stageless Payloads
Linux ELF Payload Example
Command:
Output:
Command Breakdown:
msfvenom
Tool used to create the payload
-p
Indicates creating a payload
linux/x64/shell_reverse_tcp
Linux 64-bit stageless reverse shell
LHOST=10.10.14.113
IP address to connect back to
LPORT=443
Port to connect back to
-f elf
Output format (ELF binary)
> createbackup.elf
Output filename
Windows EXE Payload Example
Command:
Output:
Payload Delivery Methods
1. Email Attachments
Advantages:
Direct user interaction
Can target specific individuals
Bypasses network perimeter controls
Considerations:
Email security filters
User awareness training
Antivirus scanning
2. Web Downloads
Advantages:
Wide distribution potential
Can be combined with social engineering
Multiple delivery vectors
Considerations:
Web application firewalls
Browser security features
User download behavior
3. Physical Media
Advantages:
Bypasses network controls
High success rate if executed
Direct access to target environment
Considerations:
Physical security controls
Autorun policies
User education
4. Combined with Exploits
Advantages:
Automated delivery
Leverages existing vulnerabilities
Part of broader attack chain
Considerations:
Requires network access
Depends on vulnerability existence
May be detected by security tools
Executing Payloads
Linux Payload Execution
Setup listener:
When payload executes:
Windows Payload Execution
Setup listener:
When payload executes:
Advanced MSFvenom Techniques
Multiple Format Support
Common formats:
Encoding for Evasion
Basic encoding:
Multiple encoding iterations:
Template Injection
Inject into existing executable:
Bad Character Removal
Remove problematic characters:
Platform-Specific Considerations
Windows Considerations
Antivirus Evasion:
Use encoders and encryption
Template injection techniques
Fileless payload delivery
Process hollowing techniques
Execution Methods:
Double-click execution
Command line execution
Scheduled tasks
Service installation
Linux Considerations
Permission Requirements:
Executable permissions needed
User context considerations
Privilege escalation needs
Execution Methods:
Direct execution
Bash/shell execution
Cron job scheduling
Service daemon installation
Social Engineering Integration
Filename Strategies
Convincing Filenames:
BonusCompensationPlan.pdf.exeSecurityUpdate.exeInstallationWizard.exeDocumentViewer.exe
File Extension Manipulation:
Use double extensions
Hide real extension
Use similar-looking extensions
Leverage file association weaknesses
Delivery Context
Business Context:
Quarterly reports
Security updates
Software installations
Training materials
Personal Context:
Photos/videos
Games/entertainment
Personal documents
Utilities/tools
Detection and Countermeasures
Common Detection Methods
Signature-based Detection:
Known payload signatures
Behavioral pattern matching
Heuristic analysis
Behavioral Analysis:
Network communication patterns
Process execution behavior
File system modifications
Evasion Techniques
Payload Modification:
Custom encoding schemes
Polymorphic payloads
Encrypted communications
Delayed execution
Delivery Modification:
Staged delivery
Legitimate application abuse
Living-off-the-land techniques
Memory-only execution
MSFvenom Best Practices
Payload Selection
Choose appropriate payload type (staged vs stageless)
Consider target platform and architecture
Evaluate network restrictions and firewall rules
Plan for persistence and post-exploitation needs
Delivery Planning
Understand target environment and security controls
Plan social engineering context and delivery method
Prepare backup delivery methods in case of failure
Consider detection timing and operational security
Operational Security
Use common ports for better success rates
Implement proper encoding for AV evasion
Clean up artifacts after successful execution
Monitor for detection and adjust accordingly
Troubleshooting MSFvenom
Common Issues
Payload Size Limitations:
Architecture Mismatches:
Encoding Failures:
Verification Methods
Test payload functionality:
Integration with Other Tools
Combining with Social Engineering
Social Engineering Toolkit (SET):
Automated payload delivery
Credential harvesting
Phishing campaigns
Custom Scripts:
Automated payload generation
Batch processing
Custom encoding schemes
Post-Exploitation Integration
Meterpreter Migration:
Persistence Establishment:
This comprehensive coverage of MSFvenom payload crafting provides the foundation for understanding both the technical aspects and practical applications of standalone payload generation in penetration testing scenarios.
Advanced Meterpreter Techniques
For detailed post-exploitation techniques, advanced commands, and comprehensive Meterpreter usage, see the dedicated Meterpreter Post-Exploitation Guide.
Last updated