2

So starting with the absolute basics - an exploit is the means used to gain access to a vulnerable system and a payload is the actual program/shellcode used to fulfill attacker's intentions

A staged payload creates a connection to a victim's machine using a stager - which is a small initial payload that creates a connection to the victim (creating a stager socket) and then passes execution to the next stage which will be the main payload - in this case meterpreter.

In this context, meterpreter is a payload that will be loaded through the stager socket and will allow dlls to be injected to victim machines (meterpreter server) memory...

I've done some research and for me to understand things I attempt to put them in my own words and terms as much as possible.. This is my basic understanding of how staged payloads and meterpreter works, so can you please clarify that my understanding is actually correct?

Improve this question
2
  • Very clear and focused question!
    – schroeder ♦
    Commented Mar 23, 2015 at 23:55
  • 1
    Gotta make mistakes to learn eh! @schroeder
    – l30n1d45
    Commented Mar 23, 2015 at 23:57

2 Answers 2

Reset to default
2

Yeah basically you need a vulnerability to exploit in order to direct code execution to your shellcode or payload, which can be anything from popping calc to a meterpreter or command shell. This link is a great reference for metasploit in general and specifically about some of the points about payloads it sounds like you are interested in.

http://www.offensive-security.com/metasploit-unleashed/Payloads

Improve this answer
2
  • I think I got it! So your payload could be setting up a meterpreter session on a remote host, then using that to inject a dll that will run or take over calc? @thalfpop
    – l30n1d45
    Commented Mar 23, 2015 at 23:53
  • The payload can run whatever code you want. It's already game over at that point. You can perform dll injection to hide a meterpreter in another process at that point if you wanted or whatever.
    – tyh
    Commented Mar 23, 2015 at 23:59
2

The basic idea is correct. Just want to explain what is the purpose of staged payloads. Every exploit has a limited space through which it can carry user code. Meterpreter DLL is around 900KB which won't fit in any common buffer overflow exploits. That is the size of only the bare bone meterpreter DLL. When it is loaded with extensions (stdlib, sniffer etc), the size is in multi megabytes. That's why the stager is used as the initial shell code that contacts the handler, allocate the appropriate RWX memory in the target process and load the DLL through reflective DLL injection.

Improve this answer
4
  • So basically, stager creates connection, then automatically creates a meterpreter session (by downloading the meterpreter dll) allowing reflective dll injection? and is this just a reverse of a process loading a dll? instead a dll will be loaded and then a process can be started? @void_in
    – l30n1d45
    Commented Mar 24, 2015 at 7:11
  • The loading of DLL is the same as in normal operations i.e. create a process and then load the DLL. The difference here is that LoadLibrary API load DLL from the disk while reflective DLL injection load it from within the memory. Disk touching is avoided for security reasons e.g. AV bypass.
    – void_in
    Commented Mar 24, 2015 at 7:14
  • So the rest of what I said was correct? I understand.. AV only scans files on the disks and not memory so meterpreter is stealthy! Are all native DLL's loaded through loadlibrary api? @void_in
    – l30n1d45
    Commented Mar 24, 2015 at 7:17
  • Yes. LoadLibrary API is the preferred means through which DLLs are loaded into a process at run time.
    – void_in
    Commented Mar 24, 2015 at 7:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .