What is the difference between a payload and shellcode?

Question

I am new to penetration testing and I would like to know the differences between these two things:

1. Payload (reverse TCP vs. bind shell)

2. Shell vs. Shellcode

Any help?

Answer 1

When exploiting an application, the payload is the code that the attacker actually wants to execute. It's the part that not just serves the purpose of leveraging the vulnerability itself, but does whatever the attacker considers useful.

When choosing a payload, an attacker typically wants code that starts them a shell. A shell is the program you interact with on the command line to control your OS (on Linux you might be familiar with the Bourne shell or Bash).

A payload that starts a shell is referred to as shellcode. But note that you will eventually find payloads that don't start a shell sloppily called shellcode, too.

A bind shell is a program that binds itself to a port and listens for incoming connections. Since opening a port attracts attention and because the attacker might often not be able to reach the port from outside the network, there is an opposite concept: A reverse shell doesn't wait for incoming connections but connects to a specified address and port itself. That is, the attacker waits for an incoming connection by the compromised server instead of initiating the connection themself.

Answer 2

Exploit - An exploit is the means by which an attacker, or penetration tester for that matter, takes advantage of a vulnerability within a system, an application, or a service. An attacker uses an exploit to attack a system in a way that results in a particular desired outcome that the developer never expected. Common exploits include buffer overflows, web application vulnerabilities (such as SQL injection), and configuration errors.

Payload - A payload is a custom code that attacker want the system to execute and that is to be selected and delivered by the Framework. For example, a reverse shell is a payload that creates a connection from the target machine back to the attacker as a Windows command prompt, whereas a bind shell is a payload that “binds” a command prompt to a listening port on the target machine, which the attacker can then connect. A payload could also be something as simple as a few commands to be executed on the target operating system.

Shellcode - Shellcode is basically a list of carefully crafted commands that can be executed once the code is injected into a running application. It’s a series of instructions used as a payload when exploiting a vulnerability. Shellcode is typically written in assembly language. In most cases, a command shell or a Meterpreter shell will be provided after the set of instructions have been performed by the target machine, hence the name.

Source: https://latesthackingnews.com/2017/07/12/difference-exploit-payload-shellcode/

Answer 3

Shellcode is injected with the payload or even sometimes referred to as payload in general. Payload on the other hand doesnt necessarily have to be shellcode (code spawning a shell) but could be code performing any action of your choice, i.e. spawning a calculator, reboot the system,... The payload usually not only includes the code to be injected and executed but also encompasses return addresses, NOP sleds, new SEH's, stub data fixing the stack, decoder, egghunter,...