Payloads are an important part of the exploitation of the target system.
While an exploit can abuse a vulnerability,
it is the payload that is needed for the next step.
Payloads carry functionality for greater access into the target.
The Metaaploit Framework includes many types of payloads with
specific code for a variety of platforms.
Like other components in the framework, payloads are also modules.
There are two types, singles and stagers and stages.
We'll talk about the differences next.
Payloads are organized by platform and
functionality in a similar way to exploits.
They are searchable and have configurable options.
There are two types of payloads.
Payloads that contains all of the code needed and run
independently of other payloads are known as singles.
The's provide one very specific function.
For example,
a simple, single payload might open a connection to a
command shell on the target system.
Stagers, on the other hand,
have more specific functionality in establishing a
network connection with the target system.
They are very small and download larger payload components.
Stages are those larger components which can execute code for
added functionality on that target system.
Why is there a need for different payload types? Singles work
with vulnerabilities that can accept a larger payload size and
a need for less functionality.
Stagers can be used where the size of the payload is limited
and extended functionality is required.
They contain a small amount of code to establish a network connection and
download the stage. Stages can be larger since the stager handles the memory
allocation needed for the stage to be loaded.
Payloads have a naming scheme that is very similar to exploits.
They're organized by platform, architecture, and a unique name.
The platform includes OS, client, command, and programming language options.
The architecture specifies the processor architecture.
Linux runs on multiple processors, so there are several options for it.
The payload has a name based on its function.
The key word bind means that a forward connection will be made
originating from your Metasploit system.
Reverse means that a reverse connection from the target back to
your Metasploit system will be made, generally to get around
firewalls and other network restrictions.
There are other keywords that specify functionality, from running
code in a shell to executing specific commands.
Meterpreter is a special payload, which we'll talk more about shortly.
The payload naming scheme also incorporates the payload types.
Single payloads incorporate the connection and functionality into one name.
Here,
the shell_bind_tcp payload for Windows has a single
name representing its functionality.
Stagers and stages have a separation represented with two names,
which are needed when selecting the payload.
Here's the same functional payload with a different
name. Bind_tcp TCP is the stager, which establishes the network connection.
Shell is the stage, which is loaded through that connection.
Let's look at how you find payloads in Metasploit. The show
command will list all of the payload modules.
Searching is based on search parameters,
which you can find more information about with the ‑h option.
The info command provides all the information about the payload.
When you are in the context of a selected exploit,
you can choose the payload to attach.
Use the set payload command with the full path to the payload.
Show options will list all the options for the exploit, as well as the payload.
For payloads that use a reverse connection,
you'll need to set the localhost, or LHOST option, to your test system's IP.
You may want to make that global as well.