A simple question on where the payload is when being exploited. Tried some testing on metasploit and got a message saying the payload's been uploaded successfully under /tmp in a linux target machine but nowhere to be found.

  • 1
    What type of payload are you asking about? There's multiple types, including inline ones which bundle the payload with the exploit. offensive-security.com/metasploit-unleashed/payload-types – Daisetsu Mar 16 at 1:40
  • As far as I know, meterpreter resides in the memory so I was talking about stager and inline payloads but looking at the offensive-security site, it looks like those type of payloads get uploaded to a victim unless I misunderstood. Does that mean any reverse web shell payload would have to be stored in a victim's device to exploit? – drs12 Mar 16 at 2:02
  • Correction: Payloads aren't the exploit. The exploit itself typically leverages a payload for a goal or purpose. In most cases, like obtaining a shell or execute other code/commands. Whether or not it's stored on disk is trivial and circumstantial to the exploit being used. Most buffer-overflow exploit payloads are solely in running in memory. Not every exploit is the same though. – Steve Kline Mar 28 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.