Does the metasploit module: exploit/multi/handler
- sends payloads to stagers?
- Or does it just listens for an incoming connection like a netcat listener?
- Or does it do both, as needed?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
It depends. The
exploit/multi/handler is more of a stub for whatever payload handler you need to run. So whichever payload you select (with
set payload ...) is responsible for doing whatever it needs, just like if you were running it from a regular exploit module.
So yes, from a multi-handler, any of the following could happen:
A simple socket listener/connection, like netcat (for plain shell payloads)
A handler for stager payloads that uploads Meterpreter (for
A handler for single-stage (stageless?) Meterpreter (for