Building Our Droppers
Once we choose a payload, we can build it using msfvenom.
For example, let’s create a regular executable with a non-staged payload.
First, we’ll set the payload with -p,
and the attacking IP address and port with LHOST and LPORT.
We’ll set the payload format to executable with -f
and use -o to save the payload to the root of our Apache web server.
This construction is identical for staged and non-staged payloads.
With the payload saved to our Apache root directory,
and the server started,
we can launch a Netcat listener on our Kali attack machine to receive the shell.
We’ll listen for an incoming connection -l,
avoid DNS lookups with -n
and use -v for verbose output.
We’ll also use p to specify the TCP port,
which must match the port used when generating the msfvenom executable.
With the listener ready,
let’s open Microsoft Edge on the victim’s machine
and browse the payload’s URL on our Kali Linux Apache server.
We’ll be prompted to download the file.
Once the file is downloaded, we’ll execute it,
ignoring and accepting any warning messages.
Within a few seconds, the reverse shell should open in our Netcat listener
Let’s try another example,
this time leveraging the power of
Metasploit’s signature Meterpreter payload.
The full Meterpreter payload is powerful,
but the non-staged version is quite large.
In this example, we’ll create a staged version.
This version will be more compact, and will execute in stages.
The small first stage executes a callback function,
which will retrieve the remaining code and execute it in memory.
The msfvenom command we’ll use is similar to the non-staged version.
We’ll select the staged payload,
choose HTTPS as the protocol, shown in the suffix of the payload,
and we’ll set the LPORT to 443, the typical HTTPS TCP port.
Let’s compare the payload sizes by generating both staged
and non-staged meterpreter payloads.
Notice that the non-staged payload is nearly thirty times larger
than the staged payload.
This significantly smaller payload provides
less detection surface for endpoint security solutions.
In order to use staged payloads, we’ll need to use the multi handler.
This Metasploit module listens for incoming callbacks
from staged payloads and delivers the second stage.
To do this, we’ll launch msfconsole in quiet mode with -q
and use the multi handler module.
We’ll set the payload,
LHOST,
and LPORT options,
which must match the values we used when we generated the payload.
With the multi handler module running,
we can download our msfstaged.exe executable
and run it on our victim machine.
Then, we’ll turn our attention to the output from Metasploit
A small 7 KB callback was executed to stage the full payload
and we note from the output that more than 200 KB of code
was sent to spawn the Meterpreter shell from our victim’s machine.
Now that we understand the differences
between Metasploit’s non-staged and staged payloads
and understand how to use Netcat and the multi handler to catch the shell,
we’ll discuss discretion in the next section.