🧠 Payloads
A payload is a piece of code executed after an exploit is delivered.
It enables actions such as returning a shell or creating a backdoor.
Sent together with the exploit to interact with the compromised system.
Types of payload modules:
Singles: All-in-one, self-contained code.
Stagers: Small code to establish connection.
Stages: Large code delivered after the stager.
🔄 Payload Typologies
Single
Self-contained; executed immediately; less flexible.
Stager
Small and reliable; sets up connection for larger code.
Stage
Delivered after stager; performs full payload functionality.
Example:
windows/shell_bind_tcp(single)windows/shell/bind_tcp(staged: stager + stage)
🔍 Searching for Payloads
🔧 Selecting a Payload
After setting, check options:
Set:
Run the exploit:
🌐 Meterpreter Session Output Example
📊 Meterpreter Command Categories
Core Commands
background,sessions,load,help,exit
File System
ls,cd,upload,download,rm,mkdir,search
Networking
ipconfig,netstat,portfwd,route,resolve
System
ps,kill,migrate,shell,getuid,sysinfo,execute
User Interface
screenshot,screenshare,keyscan_start,keyboard_send
Webcam/Microphone
webcam_snap,record_mic,webcam_stream
Privilege Elevation
getsystem,steal_token,rev2self,drop_token
Password Dumping
hashdump
Timestamping
timestamp
🔌 Common Payload Examples for Windows
windows/x64/exec
Executes command
windows/x64/messagebox
Opens dialog box
windows/x64/shell_reverse_tcp
Simple shell, reverse TCP
windows/x64/meterpreter/reverse_tcp
Full Meterpreter reverse shell
windows/x64/powershell/reverse_tcp
PowerShell session
windows/x64/vncinject/reverse_tcp
VNC remote desktop
Last updated