EH-Net

Ethical Hacking Discussions and Related Certifications => Network Pen Testing => Topic started by: H1t M0nk3y on January 24, 2013, 07:23:35 AM



Title: Metasploit payload question
Post by: H1t M0nk3y on January 24, 2013, 07:23:35 AM
Hi,

Can someone tell me what is the difference between these two Metasploit payloads:

1) windows/shell/bind_tcp
Listen for a connection, Spawn a piped command shell (staged)

2) windows/shell_bind_tcp
Listen for a connection and spawn a command shell

They both have the same basic options:

Name      Current Setting  Required  Description
----      ---------------  --------  -----------
EXITFUNC  process          yes         Exit technique: seh, thread, process, none
LPORT       4444              yes         The listen port
RHOST                           no          The target address


Basically, what does "spawn a piped shell (staged)" means compared to "spawn a command shell"?

Thanks in advance


Title: Re: Metasploit payload question
Post by: ziggy_567 on January 24, 2013, 07:43:15 AM
A staged payload uses a stager to instruct the exploit on how to shovel the payload to the victim over the network connection. Non-staged payloads are fully self-contained. The advantage to staged payloads is that they can fit into very small sections of memory, but they're not always as reliable.

You can read more here:

http://www.room362.com/blog/2011/6/26/metasploit-payloads-explained-part-1.html (http://www.room362.com/blog/2011/6/26/metasploit-payloads-explained-part-1.html)


Title: Re: Metasploit payload question
Post by: H1t M0nk3y on January 24, 2013, 09:33:51 AM
Great article, thanks!

Quote
One thing that isn't immediately obvious is another marker of staged vs. singles:

osx/ppc/shell/reverse_tcp

osx/ppc/shell_reverse_tcp



The difference between these two payloads isn't obvious other than the fact that one has an underscore '_' instead of a forward slash '/'. The one with the underscore means it's a single while the other is staged.
I already knew about staged, stagers and singles, but I didn't know about the / and the _. I also figured what "piped" meant.

Thanks again ziggy_567


Title: Re: Metasploit payload question
Post by: ziggy_567 on January 24, 2013, 10:00:16 AM
I guess I should read your posts more carefully! I didn't pick up on the "piped" part of the question!  ;D