search

🧠 Payloads

  • A payload is a piece of code executed after an exploit is delivered.

  • It enables actions such as returning a shell or creating a backdoor.

  • Sent together with the exploit to interact with the compromised system.

  • Types of payload modules:

    • Singles: All-in-one, self-contained code.

    • Stagers: Small code to establish connection.

    • Stages: Large code delivered after the stager.

hashtag
🔄 Payload Typologies

Type
Description

Single

Self-contained; executed immediately; less flexible.

Stager

Small and reliable; sets up connection for larger code.

Stage

Delivered after stager; performs full payload functionality.

Example:

  • windows/shell_bind_tcp (single)

  • windows/shell/bind_tcp (staged: stager + stage)

hashtag
🔍 Searching for Payloads

hashtag
🔧 Selecting a Payload

After setting, check options:

Set:

Run the exploit:

hashtag
🌐 Meterpreter Session Output Example

hashtag
📊 Meterpreter Command Categories

Core Commands

  • background, sessions, load, help, exit

File System

  • ls, cd, upload, download, rm, mkdir, search

Networking

  • ipconfig, netstat, portfwd, route, resolve

System

  • ps, kill, migrate, shell, getuid, sysinfo, execute

User Interface

  • screenshot, screenshare, keyscan_start, keyboard_send

Webcam/Microphone

  • webcam_snap, record_mic, webcam_stream

Privilege Elevation

  • getsystem, steal_token, rev2self, drop_token

Password Dumping

  • hashdump

Timestamping

  • timestamp

hashtag
🔌 Common Payload Examples for Windows

Payload
Description

windows/x64/exec

Executes command

windows/x64/messagebox

Opens dialog box

windows/x64/shell_reverse_tcp

Simple shell, reverse TCP

windows/x64/meterpreter/reverse_tcp

Full Meterpreter reverse shell

windows/x64/powershell/reverse_tcp

PowerShell session

windows/x64/vncinject/reverse_tcp

VNC remote desktop

Previous🎯 TargetsNext🔧 Encoders?

Last updated