Executable Payloads
Metasploit also provides the functionality to export payloads
into various file types and formats
such as Windows and Linux binaries,
webshells, and more.
Metasploit contains msfvenom as a standalone tool
to generate these payloads.
It provides standardized command line options
and includes various techniques to customize payloads.
To get familiar with msfvenom,
we’ll first create a malicious Windows binary starting a raw TCP reverse shell.
Let’s begin by listing all payloads with payloads as argument for -l.
In addition, we use --platform to specify the platform for the payload
and --arch for the architecture.
The output shows that we can choose between a staged and non-staged payload.
For this example, we’ll use the non-staged payload first.
Now, let’s use the -p flag to set the payload,
set LHOST and LPORT
to assign the host and port for the reverse connection,
-f to set the output format (exe in this case),
and -o to specify the output file name:
Now that we have created the malicious binary file, let’s use it.
For this, we start a Netcat listener on port 443,
a Python3 web server on port 80,
and connect to BRUTE2 via RDP with user justin and his password.
Once we’ve connected over RDP,
we can start PowerShell to transfer the file and execute it.
Once we executed the binary file,
we’ll receive an incoming reverse shell on our Netcat listener.
Now, let’s use a staged payload to do the same.
For this, we’ll again use msfvenom to create a Windows binary
with a staged TCP reverse shell payload.
We’ll also start the Netcat listener again.
And download our staged payload to BRUTE2.
While we received an incoming connection,
we cannot execute any commands through it.
This is because Netcat doesn’t know how to handle a staged payload.
To get a functional interactive command prompt,
we can use Metasploit’s multi/handler module,
which works for the majority of staged,
non-staged, and more advanced payloads.
Let’s use this module to receive the incoming connection from staged.exe.
In Metasploit, let’s select the module with use.
Then, we have to specify the payload of the incoming connection.
In our case, this is windows/x64/shell/reverse_tcp.
In addition, we have to set the options for the payload.
We enter the IP of our Kali machine as argument for LHOST
and port 443 as argument for LPORT.
Finally, we can enter run to launch the module and set up the listener.
Once our listener is running on port 443, we can start staged.exe again on BRUTE2.
Our Metasploit multi/handler receives the incoming staged payload
and provides us with an interactive reverse shell in the context of a session.
Nice!
For staged and other advanced payload types (such as Meterpreter),
we must use multi/handler instead of tools like Netcat
in order for the payload to work.
Using run without any arguments will block the command prompt
until execution finishes or we background the session.
As we’ve learned before,
we can use run -j to start the listener in the background,
allowing us to continue other work while we wait for the connection.
We can use the jobs command to get a list of all currently active jobs,
such as active listeners waiting for connections.
Let’s exit our session and restart the listener with run -j.
Then, we’ll list the currently active jobs using jobs.
Once we execute staged.exe again,
Metasploit notifies us that a new session was created.
As Metasploit created a new session for the incoming connection,
we’ll display the list sessions with -L.
And again interact with it with sessions -i
and the session ID as argument.
We can use the generated executable payloads from msfvenom
in various situations during a penetration test.
First, we can use them to create executable file types
such as PowerShell scripts,
Windows executables,
or Linux executable files to transfer them to a target and start a reverse shell.
Next, we can create malicious files
such as web shells to exploit web application vulnerabilities.
Finally, we can also use the generated files from msfvenom
as part of a client-side attack.