|
Title: Metasploit payload question Post by: H1t M0nk3y on January 24, 2013, 07:23:35 AM Hi,
Can someone tell me what is the difference between these two Metasploit payloads: 1) windows/shell/bind_tcp Listen for a connection, Spawn a piped command shell (staged) 2) windows/shell_bind_tcp Listen for a connection and spawn a command shell They both have the same basic options: Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique: seh, thread, process, none LPORT 4444 yes The listen port RHOST no The target address Basically, what does "spawn a piped shell (staged)" means compared to "spawn a command shell"? Thanks in advance Title: Re: Metasploit payload question Post by: ziggy_567 on January 24, 2013, 07:43:15 AM A staged payload uses a stager to instruct the exploit on how to shovel the payload to the victim over the network connection. Non-staged payloads are fully self-contained. The advantage to staged payloads is that they can fit into very small sections of memory, but they're not always as reliable.
You can read more here: http://www.room362.com/blog/2011/6/26/metasploit-payloads-explained-part-1.html (http://www.room362.com/blog/2011/6/26/metasploit-payloads-explained-part-1.html) Title: Re: Metasploit payload question Post by: H1t M0nk3y on January 24, 2013, 09:33:51 AM Great article, thanks!
Quote One thing that isn't immediately obvious is another marker of staged vs. singles: I already knew about staged, stagers and singles, but I didn't know about the / and the _. I also figured what "piped" meant.osx/ppc/shell/reverse_tcp osx/ppc/shell_reverse_tcp The difference between these two payloads isn't obvious other than the fact that one has an underscore '_' instead of a forward slash '/'. The one with the underscore means it's a single while the other is staged. Thanks again ziggy_567 Title: Re: Metasploit payload question Post by: ziggy_567 on January 24, 2013, 10:00:16 AM I guess I should read your posts more carefully! I didn't pick up on the "piped" part of the question! ;D
Powered by SMF 1.1.18 |
SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com |