2

I've been looking for some decent documentation on Meterpreter shells, but I can't seem to find anything useful.

I would like to know when to use what kind of shell for a certain situation. All I can find are guides that just mention what shell they are using but never elaborate why they prefer the shell.

Do any of you have a decent source where I can find this kind of information?

2

Meterpreter is a multi-stage payload where the first stage is send first which then downloads the second stage DLL. Two things you need to understand here: what transport will be used by the Meterpreter to communicate with the handler and whether the first stage should connect back to the handler or the handler should connect to the listening socket (reverse vs bind).

There are three types of transports available: TCP, HTTP and HTTPS. If you are operating inside a LAN environment, you can use the TCP transport since it is a reliable transport mechanism. However, TCP transport needs an established socket to communicate which means if for some reason the session gets close between the attacker's machine and victim's, it can't get reconnected (unless persistence is already achieved). TCP transport can't traverse proxy servers in order to access Internet and first stage transport is in plain text which can trigger IDS/IPS.

HTTP and HTTPS both use WinInet which means if the victim is behind an HTTP proxy, the first stage meterpreter will be able to use the proxy server and the cached credentials (if required) to traverse the proxy and access the Internet.

HTTPS transport has the added benefit to transfer the second stage DLL on a complete SSL tunneled transport that can't be sniffed by IDS/IPS unless the session is MITM-ed at the proxy.

In case of bind vs reverse, reverse is almost always the preferred method because a lot of times organizations have script ingress filtering in place but egress filtering is not that much strict (although it is changing).

One final thing you need to understand is that compared to TCP, HTTP(S) transport is bigger in size that is why it won't be fit in every exploit due to the limited payload space they can carry. However, egy7t did some great work to reduce the size of reverse HTTPS transport so that most of the exploits can carry it. You can find more details regarding this at Shellcode Golf: Every Byte is Sacred.

  • Thank you very much! I guess this knowledge came from experience? Do you maybe have a resource? I am writing a paper on Social Engineering and I can't reference posts like this... – David Feb 25 '14 at 17:59
  • Most of my own knowledge about Metasploit came from Metasploit IRC channel and reading the source code of the framework. I don't think you can cite either one. Tutorials and books focus on the working of the framework more, not the low level stuff. These you have to cover on your own I am afraid. – void_in Feb 25 '14 at 18:05
0

May or may not be what you're looking for but have you seen this?

http://dev.metasploit.com/documents/meterpreter.pdf

  • Yes, I have found similar information on offensive-security – David Feb 25 '14 at 16:22
  • Do you mean when to use TCP vs Reverse_TCP etc...? – Four_0h_Three Feb 25 '14 at 16:27
  • That's what I am looking for – David Feb 25 '14 at 16:30
  • Basically; When you use Reverse_TCP or reverse anything you open a port on your machine then make the victim connect back to your machine on that port. When using the non Reverse connections you're connecting straight to the victim machine. – Four_0h_Three Feb 25 '14 at 17:43
  • 2
    No offense but you should probably learn TCP/IP 101 before playing with a tool like Meatsploit. If only to save your own meat from the repercussions of sending your attack traffic across the Internet. – Anonymous Feb 25 '14 at 17:57
0

First of all I just wanted to point out that just about every version of ms has unique properties. Meaning some things just work better in some versions of ms. Some exploits are more reliable, etc.. all kinds of little variation.. and as far as I know there is no good publicly available documentation about this stuff. I suggest you download and install almost every version of ms in a VM and just test stuff out for yourself. In fact here's your chance to make a name for yourself in the community, if that's what you want. This kind of documentation is in pretty high demand and apparently desperately needed by many.

You're asking for resources.. I strongly suggest this book for starters. I also strongly suggest looking into professional training depending on your available resources and your goals. SANS security 580 is an excellent two day course which really covers all the bases pretty good.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.