Hack Like a Pro: Metasploit for the Aspiring Hacker, Part 3 (Payloads) « Null Byte :: WonderHowTo

Welcome back, my tenderfoot hackers!As you know,Metasploitis an exploitation framework that every hacker should be knowledgeable of and skilled at. It is one of my favorite hacking tools available.Metasploit enables us to use pre-written exploits against known vulnerabilities in operating systems, browsers and other applications and place arootkit/listener/payloadon the target system. These payloads are what enable us to connect to the victim system and use it as our own after we have exploited a vulnerability in its system. In this tutorial, we will look exclusively at the payloads built into Metasploit.Metasploit has many types of payloads we can leave on the target system. We are most familiar with thegeneric/shell/reverse_tcpand thewindows/meterpreter/reverse_tcppayloads, having used those in multiple hacks already. In this guide, we will look at such things as how the payloads work, how Metasploit categorizes the payloads, and what the types of payloads are. I hope this understanding will help you to better choose the appropriate payload for your hack.Let's take a closer look at these payloads in Metasploit.Step 1: Fire Up Kali Linux & Open MetasploitWhen we openthe Metasploit consoleinKali Linux, we immediately see that Metasploit lists the number of exploits, auxiliary modules, post exploitation modules, payload modules, encoders, and nops.In the screenshot below, notice that there are 335 payloads in the current version of Metasploit (yours may be slightly different based upon your version of Metasploit). This is a huge number of payloads that can be used for multiple situations.When we type:msf > show payloadsMetasploit lists all 335 payloads as below.Step 2: Types of PayloadsAmong these 335 payloads in Metasploit, there are 8 types of payloads.InlineThese payloads are a single package of exploit and payload. They are inherently more stable, but because of their size, they can't always be used in small vulnerable memory areas.StagedThese payloads essentially are able to fit into very small spaces and create a foothold on the system and then pull rest of the payload.MeterpreterIs the all powerful payload that we most often want on a victim system. It works by .dll injection and resides entirely in memory, leaving no trace of its existence on the hard drive or file system. It has a number of specificcommandsandscriptsdeveloped for it, enabling us to largely work our will on the victim system.PassiveXThis payload is for use when firewall rules restrict outbound traffic. In essence, it uses ActiveX through Internet Explorer to hide its outbound traffic and evade the firewall by using HTTP requests and responds just as any browser would.NoNXIn some CPUs, there is a built-in security feature called DEP (Data Execution Prevention). In Windows, it is referred to as No eXecute, or NX. The idea behind this security feature is to keep from data making its way to the CPU and being executed. The NoNX payloads are designed to evade this safety feature of modern CPU's.OrdThese type of payloads work on nearly all Windows operating systems. These are extremely small, but somewhat unstable. They are dependent upon loading a .dll (dynamic link library) into the exploited process.IPv6These payloads, as their implies, are designed to work on IPv6 networks.Reflective DLL InjectionThese payload modules are injected directly into the target process while it is running in memory, thereby never writing anything to the hard drive and leaving little or no evidence behind.Step 3: Payload ModulesIf we look in the Metasploit directory theLinuxterminal in Kali, we can see that Metasploit categorizes its payloads into three different types. Obviously, the eight types above are consolidated into these three directories in Metasploit.kali > cd /usr/share/metasploit-framework/modules/payloadskali > ls -lStagedStaged payloads use tiny stagers (see below) to fit into small exploitation spaces. In other words, if the victim's system exploitation buffer or other memory area is very small and only allows a small amount of code to be executed, first a small stager is placed in the memory area. The stager then "pulls" the rest of the payload after this foothold is made on the victim system.These larger staged payloads include such complex payloads as the Meterpreter and VNC Injection, both of which include large and complex code. Generally, a staged payload will split the name of the payload between a "/", such as in the payloadwindows/shell/tcp_bind. The "tcp_bind" is the stager (see below) and "shell" is the staged.Unfortunately, this convention is not used consistently in Metasploit, so one often has to go to the "info" section of the payload or find the directory it is in to determine if it is a staged payload.StagersStagers are the small payloads whose only job is to fit into small memory area and then "pull" the larger staged payload along. They kind of "plant the flag" on the victim and then enable the larger payload to be loaded.SinglesOften referred to as "inline payloads," singles are self-contained units that do not require a stager. They are generally more stable and preferred, but many times the code is too large to for the vulnerable memory area on the victim system.Let's now take a look inside that singles directory.kali > cd singleskali > ls -lAs we can see, the singles are broken down by vulnerable platform. If we want to see the singles available for the Windows platform, we simply type:kali > cd windowskali > ls -lInside this directory we can see all the singles payloads available for Windows. I have highlighted one of these payloads,shell_reverse_tcp, that we have used in many of our hacks.Payloads are key part of the Metasploit infrastructure and provide us with access once the exploit has been completed. The better we understand them, the better we will be as a hackers.That's it for now. Make sure to check back in on myMetasploit Basics seriesfor more tutorials on Metasploit. So, keep coming back, my tenderfoot hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:Metasploit for the Aspiring Hacker, Part 14 (Creating Resource Script Files)News:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 5 (Msfvenom)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 2 (Keywords)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 13 (Web Delivery for Windows)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 4 (Armitage)How to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:Metasploit for the Aspiring Hacker, Part 10 (Finding Deleted Webpages)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)How To:Simplify Payload Creation with MSFPC (MSFvenom Payload Creator)Hack Like a Pro:Exploring the Inner Architecture of MetasploitHack Like a Pro:Metasploit for the Aspiring Hacker, Part 9 (How to Install New Modules)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 11 (Post-Exploitation with Mimikatz)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:How to Save the World from Nuclear AnnihilationHack Like a Pro:How to Bypass Antivirus Software by Disguising an Exploit's SignatureHow To:Use MSFconsole's Generate Command to Obfuscate Payloads & Evade Antivirus DetectionHacking Windows 10:How to Break into Somebody's Computer Without a Password (Setting Up the Payload)Hack Like a Pro:How to Hack Windows Vista, 7, & 8 with the New Media Center ExploitHow To:Hack Your Neighbor with a Post-It Note, Part 2 (Setting Up the Attack)Hack Like a Pro:How to Hack Your School's Server to Download Final Exam AnswersHack Like a Pro:Metasploit for the Aspiring Hacker, Part 6 (Gaining Access to Tokens)Hack Like a Pro:How to Cover Your Tracks So You Aren't DetectedHack Like a Pro:Exploit MS Word to Embed a Listener on Your Roommate's ComputerHack Like a Pro:Metasploit for the Aspiring Hacker, Part 7 (Autopwn)Hack Like a Pro:Hacking Windows XP Through Windows 8 Using Adobe Flash PlayerHack Like a Pro:How to Spear Phish with the Social Engineering Toolkit (SET) in BackTrackHack Like a Pro:Exploring Metasploit Auxiliary Modules (FTP Fuzzing)Hack Like a Pro:How to Change the Signature of Metasploit Payloads to Evade Antivirus DetectionHack Like a Pro:Hacking Samba on Ubuntu and Installing the Meterpreter