2

Below are some conclusions I came up reading ebooks, blogs and tutorials about pentesting. I would like you to correct those conclusions if they are (all or partly) wrong.

  1. A vulnerability is any chunk of code of an application/service/OS which gives us the ability to INPUT something other than the input it is meant to accept.

  2. An exploit is the code we send to this INPUT in order to make payload injection possible.

  3. Payload is the code that is injected (how?) to the loaded instructions of the vulnerable software/service, and when this software runs it also runs our payload. This payload enables us to establish shell sessions etc.

  4. If the target system doesn't have any open ports, or have open ports bound to a software/service that is NOT vulnerable or exploitable, then the only way to deliver a payload is through social engineering.

And a question:

If I convert a meterpreter payload into an executable and run it manually on the target system, will I have the same results as if I injected it remotely through an exploited software/service on this system?

0

3 Answers 3

3

What is a vulnerability?

A vulnerability is more than that. It is any state of the software that allows an attacker to do or know something they are not supposed to be able to do or know.

For example, if your website only uses HTTP, that is a vulnerability, because anyone with Man-in-the-Middle capabilities can read and modify the data on your site.

What is an exploit?

An exploit is a way to abuse a vulnerability. It can be code that sends data to your server, or it can be a specially crafted HTTP request, or a maliciously crafted e-Mail.

The term "exploit" generally refers to "the thing that abuses a vulnerability".

What is a payload?

A payload something that can be executed when using an exploit. For example, imagine a vulnerability allows me to execute any code when you open an e-Mail attachment. That piece of code that I execute then is the payload.

For demonstration purposes, some payloads just start calc.exe on Windows. This demonstrates that "any" code can be run. Of course, malicious payloads do much worse, such as adding backdoors, stealing or encrypting your data, etc...

Simply put, the payload is "the thing you want to get from A to B".

How do Vulnerabilities, Exploits and Payloads relate to each other?

Think of a vulnerability as a weak spot in a wall. The Exploit is a rocket going right through that weakspot. The payload is the explosive core of that rocket, designed to explode after the wall was penetrated and destroying everything behind the wall.

How can payloads be delivered?

Your question adds a very specific set of constraints. Specifically, software that has "no vulnerabilities". It is very very difficult, borderline impossible even, to make useful software that has no vulnerabilities. Even the seL4 Microkernel, which was formally verified, has some notable exceptions on their claim of provable security.

Simply put, no software is free from vulns. This is the reason any program bugs you at least once per month to do an update for "various security improvements".

However, assuming that your publicly exposed software was indeed 100% vulnerability free, you still can't know about anything it communicates with. The load balancer may have vulnerabilities, the sysadmin may have been victim of a phishing campaign, the USB keyboard may have been compromised, etc.

Social Engineering are one way of getting a payload on a target system, but with a bit of creativity, there are many more.

Will a Meterpreter executable have the same effect if run by hand as if done through an exploit`

Possibly. It depends on the exploit at hand. For example, if you used ETERNALBLUE, your payload would run as NT-SYSTEM/SYSTEM, which are the highest privileges available on a Windows system. Whereas if you ran the exploit as a limited user, it would run with your privileges, and thus your limitations.

2
  • So you say that almost always there will be a way to penetrate a target system remotely (without using Social Engineering)? Apr 28, 2020 at 15:17
  • @BrainTrance Most certainly, yes. But the question is whether or not you will discover that vulnerability, or whether or not you can get yourself in a position to exploit it.
    – user163495
    Apr 28, 2020 at 17:48
2
  1. A vulnerability is any weakness that can be exploited. It can be in code or a configuration or how something is used or a person.

  2. An exploit is what is done using the vulnerability to achieve one's aims. If the vulnerability is code-based, then the exploit is most often code-based, too. Not all exploits require payloads.

  3. A payload is what is sent using the exploit to transfer information or code to the target that the attacker can manipulate. It is most often code, but is only relevant if the vulnerability allows for code execution.

  4. Since a vulnerability need not be code-based, and payloads are not required, I think you can re-think the basis for this question. The answer to what you've asked is both 'yes' and 'no'.

3
  • So for example, a Meterpreter can be established even with a not code-based vulnerability? Apr 28, 2020 at 15:20
  • Sure. You create a meterpreter binary, transfer it to the target machine and run it. You could do it manually, if there is that functionality, or send it over and get the user to run it. Meterpreter is, ultimately, just a program. No vulnerability or exploit required.
    – schroeder
    Apr 28, 2020 at 15:24
  • I see. This clarifies a lot of things for me. Thanks! Apr 28, 2020 at 15:30
2

Yes, this is a correct example of relations between a vulnerability, an exploit and a payload, but not their definition. Meterpreter with the same configuration parameters can be converted into an executable and run manually on the system, giving the same level of access than using a vulnerability on a software run as the same user.

This already gives another example, as in this case:

  1. The vulnerability might be the human psyche that is vulnerable to social engineering.
  2. The exploit might be an email, a USB stick...
  3. The payload is your executable.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .