As explained previously,
the payload is a Dynamic Link Library, also known as a DLL file.
The DLL contains a special reflective DLL injection library,
which makes it reflective.
We will cover reflective DLL injection shortly.
As we saw previously,
the payload is bootstrapped by the stager using a ret instruction,
which jumps into the stub of shell code which was patched by the handler,
which, in turn, calls the reflective loader and DllMain.
The payload contains the code which provides Meterpreter's core functionality.
Although metsrv is shipped precompiled with the Metasploit framework,
if you want to take a look at the source code or
modify and recompile the payload,
the Meterpreter codebase can be cloned from the Rapid7 GitHub
repository using the following commands.
Once the repository has been cloned,
we can go ahead and build the 64‑bit payload by running the following
commands from a Visual Studio developer command prompt.
When the build completes, the payloads will be available in the output folder.
We could then copy these files to our Metasploit handler.
Now that we are able to compile the payload, let's take
a look at the payload source code.
We can open Visual Studio 2019 and open the solution.
Once opened, we can browse the Solution Explorer for the metsrv project.
We can then open the metsrv.c file.
We can see that we are indeed including the reflective DLL injection library.
And if we scroll down, we will find the DllMain function,
which gets called by the shell code stub which was embedded in
the payload's DOS header by the handler.
We can see that there is an Init function which
handles the payload's initialization.
If we view the code for this function,
we can see that it calls the server_setup function,
which completes the payload's initialization and should, if all goes
well, provide a fully functional Meterpreter shell.