Before we get into the defense evasion topics,
we need to ensure that we understand how a Meterpreter
shell actually works under the hood.
This is important because we will have to customize the tool to
get past antivirus, and customizing something we don't fully
understand would be challenging.
We will briefly cover Meterpreter's main components, and I will explain some
of the techniques which are used during its initialization.
Finally,
we will go for a demo, where we will write our own custom shell
code runner and analyze it during execution.
A Meterpreter shell consists of three main components.
First we have the stager. The stager is a piece of code which can
be embedded inside a file and sent to a victim.
It can also be used in memory corruption exploits,
targeting vulnerable software. When the stager executes, its
job is to connect back to the handler,
which, in turn, will send back the payload, which
can be bootstrapped by the stager.
Some stagers do not connect back to the handler and simply
open a network port on the victim's machine,
which we can then connect to.
In this course, however,
we will be focusing on reverse payloads that connect back to the handler.