Staged vs Non-staged Payloads
Metasploit contains an impressive library of payloads
that can be formatted in many different ways.
The framework include both staged and non-staged payloads.
For example,
windows/shell_reverse_tcp
is a simple non-staged reverse TCP shell payload.
It contains all the code needed
to open up a reverse command shell to an attacker’s machine.
The payload itself is actually a number of assembly instructions,
which when executed,
call a number of Windows APIs that connect to the attackers C2
and expose a cmd.exe command prompt.
Staged payloads, such as windows/shell/reverse_tcp,
contain a minimal amount of code that performs a callback,
then downloads any remaining code and executes it in the target’s memory.
This slimmed-down payload does not take up as much memory as a non-staged payload,
and may evade anti-virus programs.
Note the difference in the delimiters used in the names of these payloads.
Non-staged payloads use an _
and staged payloads use /
The payload’s description also indicates whether it is staged or non-staged.