• No results found

How powerful this tool can be is fully seen when showing the vast number of different types of shellcode that are available to be customized for your specific exploit:

In document Metasploit Unleashed (Page 124-135)

root@bt:~# msfpayload -l

Framework Payloads (238 total)

==============================

Name Description ---- --- aix/ppc/shell_bind_tcp Listen for a connection and spawn a command shell

aix/ppc/shell_find_port Spawn a shell on an established connection

aix/ppc/shell_interact Simply execve /bin/sh (for inetd programs)

aix/ppc/shell_reverse_tcp Connect back to attacker and spawn a command shell

bsd/sparc/shell_bind_tcp Listen for a connection and spawn a command shell

bsd/sparc/shell_reverse_tcp Connect back to attacker and spawn a command shell

bsd/x86/exec Execute an arbitrary command

bsd/x86/metsvc_bind_tcp Stub payload for interacting with a Meterpreter Service

bsd/x86/metsvc_reverse_tcp Stub payload for interacting with a Meterpreter Service

bsd/x86/shell/bind_tcp Listen for a connection, Spawn a command shell (staged)

bsd/x86/shell/find_tag Use an established connection, Spawn a command shell (staged)

bsd/x86/shell/reverse_tcp Connect back to the attacker, Spawn a command shell (staged)

bsd/x86/shell_bind_tcp Listen for a connection and spawn a command shell

bsd/x86/shell_find_port Spawn a shell on an established connection

bsd/x86/shell_find_tag Spawn a shell on an established connection (proxy/nat safe)

bsd/x86/shell_reverse_tcp Connect back to attacker and spawn a command shell

bsdi/x86/shell/bind_tcp Listen for a connection, Spawn a command shell (staged)

bsdi/x86/shell/reverse_tcp Connect back to the attacker, Spawn a command shell (staged)

bsdi/x86/shell_bind_tcp Listen for a connection and spawn a command shell

bsdi/x86/shell_find_port Spawn a shell on an established connection

bsdi/x86/shell_reverse_tcp Connect back to attacker and spawn a command shell

cmd/unix/bind_inetd Listen for a connection and spawn a command shell (persistent)

cmd/unix/bind_netcat Listen for a connection and spawn a command shell via netcat

cmd/unix/bind_netcat_ipv6 Listen for a connection and spawn a command shell via netcat

cmd/unix/bind_perl Listen for a connection and spawn a command shell via perl

cmd/unix/bind_perl_ipv6 Listen for a connection and spawn a command shell via perl

cmd/unix/bind_ruby Continually listen for a connection and spawn a command shell via Ruby

cmd/unix/bind_ruby_ipv6 Continually listen for a connection and spawn a command shell via Ruby

cmd/unix/generic Executes the supplied command

cmd/unix/interact Interacts with a shell on an established socket connection

cmd/unix/reverse Creates an interactive shell through two inbound connections

cmd/unix/reverse_bash

Creates an interactive shell via bash's builtin /dev/tcp.

This will not work on most Debian-based Linux distributions

(including Ubuntu) because they compile bash without the create a command shell via Ruby

cmd/windows/adduser Create a new user and add them to local administration group

cmd/windows/bind_perl Listen for a connection and spawn a command shell via perl (persistent)

cmd/windows/bind_perl_ipv6 Listen for a connection and spawn a command shell via perl (persistent)

cmd/windows/bind_ruby Continually listen for a connection and spawn a command shell via Ruby

cmd/windows/download_eval_vbs Downloads a file from an HTTP(S) URL and executes it as a vbs script.

Use it to stage a vbs encoded payload from a short command line.

cmd/windows/download_exec_vbs Download an EXE from an HTTP(S) URL and execute it

cmd/windows/reverse_perl Creates an interactive shell via perl

cmd/windows/reverse_ruby Connect back and create a command shell via Ruby

generic/custom Use custom string or file as payload. Set either PAYLOADFILE or

PAYLOADSTR.

generic/debug_trap Generate a debug trap in the target process

generic/shell_bind_tcp Listen for a connection and spawn a command shell

generic/shell_reverse_tcp Connect back to attacker and spawn a command shell

generic/tight_loop Generate a tight loop in the target process

java/jsp_shell_bind_tcp Listen for a connection and spawn a command shell

java/jsp_shell_reverse_tcp Connect back to attacker and spawn a command shell

java/meterpreter/bind_tcp Listen for a connection, Run a meterpreter server in Java

java/meterpreter/reverse_http Tunnel communication over HTTP, Run a meterpreter server in Java

java/meterpreter/reverse_https Tunnel communication over HTTPS, Run a meterpreter server in Java

java/meterpreter/reverse_tcp Connect back stager, Run a meterpreter server in Java

java/shell/bind_tcp Listen for a connection, Spawn a piped command shell (cmd.exe on Windows, /bin/sh everywhere else)

java/shell/reverse_tcp Connect back stager, Spawn a piped command shell (cmd.exe on Windows, /bin/sh everywhere else) java/shell_reverse_tcp Connect back to attacker and spawn a command shell

linux/armle/adduser Create a new user with UID 0

linux/armle/exec Execute an arbitrary command

linux/armle/shell_reverse_tcp Connect back to attacker and spawn a command shell

linux/mipsbe/shell_reverse_tcp Connect back to attacker and spawn a command shell

linux/mipsle/shell_reverse_tcp Connect back to attacker and spawn a command shell

linux/ppc/shell_bind_tcp Listen for a connection and spawn a command shell

linux/ppc/shell_find_port Spawn a shell on an established connection

linux/ppc/shell_reverse_tcp Connect back to attacker and spawn a command shell

linux/ppc64/shell_bind_tcp Listen for a connection and spawn a command shell

linux/ppc64/shell_find_port Spawn a shell on an established connection

linux/ppc64/shell_reverse_tcp Connect back to attacker and spawn a command shell

linux/x64/exec Execute an arbitrary command

linux/x64/shell/bind_tcp Listen for a connection, Spawn a command shell (staged)

linux/x64/shell/reverse_tcp Connect back to the attacker, Spawn a command shell (staged)

linux/x64/shell_bind_tcp Listen for a connection and spawn a command shell

linux/x64/shell_reverse_tcp Connect back to attacker and spawn a command shell

linux/x86/adduser Create a new user with UID 0

linux/x86/chmod Runs chmod on specified file with specified mode

linux/x86/exec Execute an arbitrary command

linux/x86/meterpreter/bind_ipv6_tcp Listen for a connection over IPv6, Staged meterpreter server

linux/x86/meterpreter/bind_tcp Listen for a connection, Staged meterpreter server

linux/x86/meterpreter/find_tag Use an established connection, Staged meterpreter server

linux/x86/meterpreter/reverse_ipv6_tcp Connect back to attacker over IPv6, Staged meterpreter server

linux/x86/meterpreter/reverse_tcp Connect back to the attacker, Staged meterpreter server

linux/x86/metsvc_bind_tcp Stub payload for interacting with a Meterpreter Service

linux/x86/metsvc_reverse_tcp Stub payload for interacting with a Meterpreter Service

linux/x86/shell/bind_ipv6_tcp Listen for a connection over IPv6, Spawn a command shell (staged)

linux/x86/shell/bind_tcp Listen for a connection, Spawn a command shell (staged)

linux/x86/shell/find_tag Use an established connection, Spawn a command shell (staged)

linux/x86/shell/reverse_ipv6_tcp Connect back to attacker over IPv6, Spawn a command shell (staged)

linux/x86/shell/reverse_tcp Connect back to the attacker, Spawn a command shell (staged)

linux/x86/shell_bind_ipv6_tcp Listen for a connection over IPv6 and spawn a command shell

linux/x86/shell_bind_tcp Listen for a connection and spawn a command shell

linux/x86/shell_find_port Spawn a shell on an established connection

linux/x86/shell_find_tag Spawn a shell on an established connection (proxy/nat safe)

linux/x86/shell_reverse_tcp Connect back to attacker and spawn a command shell

linux/x86/shell_reverse_tcp2 Connect back to attacker and spawn a command shell

netware/shell/reverse_tcp Connect back to the attacker, Connect to the NetWare console (staged)

osx/armle/execute/bind_tcp Listen for a connection, Spawn a command shell (staged)

osx/armle/execute/reverse_tcp Connect back to the attacker, Spawn a command shell (staged)

osx/armle/shell/bind_tcp Listen for a connection, Spawn a command shell (staged)

osx/armle/shell/reverse_tcp Connect back to the attacker, Spawn a command shell (staged)

osx/armle/shell_bind_tcp Listen for a connection and spawn a command shell

osx/armle/shell_reverse_tcp Connect back to attacker and spawn a command shell

osx/armle/vibrate

Causes the iPhone to vibrate, only works when the AudioToolkit library has been loaded.

Based on work by Charlie Miller .

osx/ppc/shell/bind_tcp Listen for a connection, Spawn a command shell (staged)

osx/ppc/shell/find_tag Use an established connection, Spawn a command shell (staged)

osx/ppc/shell/reverse_tcp Connect back to the attacker, Spawn a command shell (staged)

osx/ppc/shell_bind_tcp Listen for a connection and spawn a command shell

osx/ppc/shell_reverse_tcp Connect back to attacker and spawn a command shell

osx/x86/bundleinject/bind_tcp Listen, read length, read buffer, execute, Inject a custom Mach-O bundle into the exploited process

osx/x86/bundleinject/reverse_tcp Connect, read length, read buffer, execute, Inject a custom Mach-O bundle into the exploited process

osx/x86/exec Execute an arbitrary command

osx/x86/isight/bind_tcp Listen, read length, read buffer, execute, Inject a Mach-O bundle to capture a photo from the iSight (staged)

osx/x86/isight/reverse_tcp Connect, read length, read buffer, execute, Inject a Mach-O bundle to capture a photo from the iSight (staged)

osx/x86/shell_bind_tcp Listen for a connection and spawn a command shell

osx/x86/shell_find_port Spawn a shell on an established connection

osx/x86/shell_reverse_tcp Connect back to attacker and spawn a command shell

osx/x86/vforkshell/bind_tcp Listen, read length, read buffer, execute, Call vfork() if necessary and spawn a command shell (staged)

osx/x86/vforkshell/reverse_tcp Connect, read length, read buffer, execute, Call vfork() if necessary and spawn a command shell (staged)

osx/x86/vforkshell_bind_tcp Listen for a connection, vfork if necessary, and spawn a command shell

osx/x86/vforkshell_reverse_tcp Connect back to attacker, vfork if necessary, and spawn a command shell

php/bind_perl Listen for a connection and spawn a command shell via perl (persistent)

php/bind_php Listen for a connection and spawn a command shell via php

php/download_exec Download an EXE from an HTTP URL and execute it

php/exec Execute a single system command

php/meterpreter/bind_tcp Listen for a connection, Run a meterpreter server in PHP

php/meterpreter/reverse_tcp Reverse PHP connect back stager with checks for disabled functions, Run a meterpreter server in PHP

php/meterpreter_reverse_tcp Connect back to attacker and spawn a Meterpreter server (PHP)

php/reverse_perl Creates an interactive shell via perl

php/reverse_php Reverse PHP connect back shell with checks for disabled functions

php/shell_findsock

Spawn a shell on the established connection to

the webserver. Unfortunately, this payload can leave conspicuous evil-looking entries in the

apache error logs, so it is probably a good idea

to use a bind or reverse shell unless firewalls

prevent them from working. The issue this payload takes advantage of (CLOEXEC flag not set

on sockets) appears to have been patched on the

Ubuntu version of Apache and may not work on other Debian-based distributions. Only tested on

Apache but it might work on other web servers that leak file descriptors to child

processes.

solaris/sparc/shell_bind_tcp Listen for a connection and spawn a command shell

solaris/sparc/shell_find_port Spawn a shell on an established connection

solaris/sparc/shell_reverse_tcp Connect back to attacker and spawn a command shell

solaris/x86/shell_bind_tcp Listen for a connection and spawn a command shell

solaris/x86/shell_find_port Spawn a shell on an established connection

solaris/x86/shell_reverse_tcp Connect back to attacker and spawn a command shell

tty/unix/interact Interacts with a TTY on an established socket connection

windows/adduser Create a new user and add them to local administration group

windows/dllinject/bind_ipv6_tcp Listen for a connection over IPv6, Inject a Dll via a reflective loader

windows/dllinject/bind_nonx_tcp Listen for a connection (No NX), Inject a Dll via a reflective loader

windows/dllinject/bind_tcp Listen for a connection, Inject a Dll via a reflective loader

windows/dllinject/find_tag Use an established connection, Inject a Dll via a reflective loader

windows/dllinject/reverse_http Tunnel communication over HTTP, Inject a Dll via a reflective loader

windows/dllinject/reverse_ipv6_http Tunnel communication over HTTP and IPv6, Inject a Dll via a reflective loader

windows/dllinject/reverse_ipv6_tcp Connect back to the attacker over IPv6, Inject a Dll via a reflective loader

windows/dllinject/reverse_nonx_tcp Connect back to the attacker (No NX), Inject a Dll via a reflective loader

windows/dllinject/reverse_ord_tcp Connect back to the attacker, Inject a Dll via a reflective loader

windows/dllinject/reverse_tcp Connect back to the attacker, Inject a Dll via a reflective loader

windows/dllinject/reverse_tcp_allports Try to connect back to the attacker, on all possible ports (1-65535, slowly), Inject a Dll via a reflective loader

windows/dllinject/reverse_tcp_dns Connect back to the attacker, Inject a Dll via a reflective loader

windows/download_exec Download an EXE from an HTTP URL and execute it

windows/exec Execute an arbitrary command

windows/loadlibrary Load an arbitrary library path

windows/messagebox Spawns a dialog via MessageBox using a customizable title, text & icon

windows/meterpreter/bind_ipv6_tcp Listen for a

connection over IPv6, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)

windows/meterpreter/bind_nonx_tcp Listen for a

connection (No NX), Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)

windows/meterpreter/bind_tcp Listen for a connection, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)

windows/meterpreter/find_tag Use an established connection, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)

windows/meterpreter/reverse_http Tunnel communication over HTTP, Inject the meterpreter server DLL via the Reflective Dll

Injection payload (staged)

windows/meterpreter/reverse_https Tunnel communication over HTTP using SSL, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)

windows/meterpreter/reverse_ipv6_http Tunnel communication over HTTP and IPv6, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)

windows/meterpreter/reverse_ipv6_https Tunnel communication over HTTP using SSL and IPv6, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)

windows/meterpreter/reverse_ipv6_tcp Connect back to the attacker over IPv6, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)

windows/meterpreter/reverse_nonx_tcp Connect back to the attacker (No NX), Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged)

windows/meterpreter/reverse_ord_tcp Connect back to the attacker, Inject the meterpreter server DLL via the Reflective Dll

Injection payload (staged)

windows/meterpreter/reverse_tcp Connect back to the attacker, Inject the meterpreter server DLL via the Reflective Dll

Injection payload (staged)

windows/meterpreter/reverse_tcp_allports Try to connect back to the attacker, on all possible ports (1-65535, slowly), Inject the

meterpreter server DLL via the Reflective Dll Injection payload (staged) windows/meterpreter/reverse_tcp_dns Connect back to the attacker, Inject the meterpreter server DLL via the Reflective Dll

Injection payload (staged)

windows/metsvc_bind_tcp Stub payload for interacting with a Meterpreter Service

windows/metsvc_reverse_tcp Stub payload for interacting with a Meterpreter Service

windows/patchupdllinject/bind_ipv6_tcp Listen for a connection over IPv6, Inject a custom DLL into the exploited process windows/patchupdllinject/bind_nonx_tcp Listen for a connection (No NX), Inject a custom DLL into the exploited process windows/patchupdllinject/bind_tcp Listen for a connection, Inject a custom DLL into the exploited process

windows/patchupdllinject/find_tag Use an established connection, Inject a custom DLL into the exploited process

windows/patchupdllinject/reverse_ipv6_tcp Connect back to the attacker over IPv6, Inject a custom DLL into the exploited process

windows/patchupdllinject/reverse_nonx_tcp Connect back to the attacker (No NX), Inject a custom DLL into the exploited process

windows/patchupdllinject/reverse_ord_tcp Connect back to the attacker, Inject a custom DLL into the exploited process

windows/patchupdllinject/reverse_tcp Connect back to the attacker, Inject a custom DLL into the exploited process

windows/patchupdllinject/reverse_tcp_allports Try to connect back to the attacker, on all possible ports (1-65535, slowly), Inject a custom DLL into the exploited process

windows/patchupdllinject/reverse_tcp_dns Connect back to the attacker, Inject a custom DLL into the exploited process

windows/patchupmeterpreter/bind_ipv6_tcp Listen for a connection over IPv6, Inject the meterpreter server DLL (staged) windows/patchupmeterpreter/bind_nonx_tcp Listen for a connection (No NX), Inject the meterpreter server DLL (staged) windows/patchupmeterpreter/bind_tcp Listen for a connection, Inject the meterpreter server DLL (staged)

windows/patchupmeterpreter/find_tag Use an established connection, Inject the meterpreter server DLL (staged)

windows/patchupmeterpreter/reverse_ipv6_tcp Connect back to the attacker over IPv6, Inject the meterpreter server DLL (staged)

windows/patchupmeterpreter/reverse_nonx_tcp Connect back to the attacker (No NX), Inject the meterpreter server DLL (staged)

windows/patchupmeterpreter/reverse_ord_tcp Connect back to the attacker, Inject the meterpreter server DLL (staged)

windows/patchupmeterpreter/reverse_tcp Connect back to the attacker, Inject the meterpreter server DLL (staged)

windows/patchupmeterpreter/reverse_tcp_allports Try to connect back to the attacker, on all possible ports (1-65535, slowly), Inject the

meterpreter server DLL (staged)

windows/patchupmeterpreter/reverse_tcp_dns Connect back to the attacker, Inject the meterpreter server DLL (staged)

windows/shell/bind_ipv6_tcp Listen for a connection over IPv6, Spawn a piped command shell (staged)

windows/shell/bind_nonx_tcp Listen for a connection (No NX), Spawn a piped command shell (staged)

windows/shell/bind_tcp Listen for a connection, Spawn a piped command shell (staged)

windows/shell/find_tag Use an established connection, Spawn a piped command shell (staged)

windows/shell/reverse_http Tunnel communication over HTTP, Spawn a piped command shell (staged)

windows/shell/reverse_ipv6_http Tunnel communication over HTTP and IPv6, Spawn a piped command shell (staged)

windows/shell/reverse_ipv6_tcp Connect back to the attacker over IPv6, Spawn a piped command shell (staged)

windows/shell/reverse_nonx_tcp Connect back to the attacker (No NX), Spawn a piped command shell (staged)

windows/shell/reverse_ord_tcp Connect back to the attacker, Spawn a piped command shell (staged)

windows/shell/reverse_tcp Connect back to the attacker, Spawn a piped command shell (staged)

windows/shell/reverse_tcp_allports Try to connect back to the attacker, on all possible ports (1-65535, slowly), Spawn a piped

command shell (staged)

windows/shell/reverse_tcp_dns Connect back to the attacker, Spawn a piped command shell (staged)

windows/shell_bind_tcp Listen for a connection and spawn a command shell

windows/shell_bind_tcp_xpfw Disable the Windows ICF, then listen for a connection and spawn a command shell

windows/shell_reverse_tcp Connect back to attacker and spawn a command shell

windows/speak_pwned Causes the target to say "You Got Pwned" via the Windows Speech API

windows/upexec/bind_ipv6_tcp Listen for a connection over IPv6, Uploads an executable and runs it (staged) windows/upexec/bind_nonx_tcp Listen for a connection (No NX), Uploads an executable and runs it (staged) windows/upexec/bind_tcp Listen for a connection, Uploads an executable and runs it (staged)

windows/upexec/find_tag Use an established connection, Uploads an executable and runs it (staged)

windows/upexec/reverse_http Tunnel communication over HTTP, Uploads an executable and runs it (staged)

windows/upexec/reverse_ipv6_http Tunnel communication over HTTP and IPv6, Uploads an executable and runs it (staged)

windows/upexec/reverse_ipv6_tcp Connect back to the attacker over IPv6, Uploads an executable and runs it (staged)

windows/upexec/reverse_nonx_tcp Connect back to the attacker (No NX), Uploads an executable and runs it (staged)

windows/upexec/reverse_ord_tcp Connect back to the attacker, Uploads an executable and runs it (staged)

windows/upexec/reverse_tcp Connect back to the attacker, Uploads an executable and runs it (staged)

windows/upexec/reverse_tcp_allports Try to connect back to the attacker, on all possible ports (1-65535, slowly), Uploads an

executable and runs it (staged)

windows/upexec/reverse_tcp_dns Connect back to the attacker, Uploads an executable and runs it (staged)

windows/vncinject/bind_ipv6_tcp Listen for a

connection over IPv6, Inject a VNC Dll via a reflective loader (staged) windows/vncinject/bind_nonx_tcp Listen for a

connection over IPv6, Inject a VNC Dll via a reflective loader (staged) windows/vncinject/bind_nonx_tcp Listen for a

In document Metasploit Unleashed (Page 124-135)