Lesson 106 : Payloads Video Lecture | Ethical Hacking using Kali Linux (in English) - Software Development

hey guys and welcome to the next
tutorial of ethical hacking and
penetration testing we are Kali Linux so
interest tutorial we will be learning
about payloads in the previous tutorial
I have taught you about Metasploit
meterpreter and the exploit so if you
have not gone through that then I would
recommend you going through all of those
tutorials because else you will not
understand what exactly payload ease so
a payload in Metasploit refers to an
exploit module so there are different
types of payload modules in Metasploit
framework such as single stage roles and
stages these different types allow for a
great deal of versatility and it can be
useful across numerous types of
scenarios whether or not a payload each
stage it easy presented by slash in the
payload name so for example let me just
show you I'll just go ahead open the MSF
console and well the time it opens I'll
show you how exactly a payload would
look like so if I wanted a Windows let's
say PI in TCP payload then I'll just go
and use Windows slash bind underscore
TCP something like that it is a single
payload with no stage whereas Windows
consists of a stager and a stage so it
might be a bit confusing to understand
so bind TCP ease the stager and if you
want to go ahead and check the stage
then I can just go and type shell
underscore pound ECB so shell over here
is the stage whereas mine TCP is the
stage oh so three things that I would be
covering today in detail will be the
singles the stagers and the status so we
have our MSF console open so singles our
payloads that are self-contained and
they completely standalone a single
payload can be used can be used or it
can be something as simple as a user or
adding a user to the target system or
running a calculator period exe file
after that we have stagers and stages
set up a network connection between the
attacker and the victim and are designed
to be small and reliable it is difficult
to always do both of these so both of
these wells so the result is multiple
similar stagers meter sprite will use
the best one when it can
fall back to a less preferred one when
it's not necessary or when it's
necessary so Windows NX or NT version
versus the noindex stager they contain
nothing reliability issues for the NX
CPUs and depa next stages are bigger
that's it's a virtual allocation and
default for now is NX plus Windows 7
compatible so you don't need to worry
about that after that we have stages so
stages are payload components that are
downloaded by our stages modules the
variate various payload stages toward
advanced features with no size limit
such as meterpreter or let's say VNC
injection or even the iPhone I pawn
shell payload stages automatically used
middle stages a single receive fail with
large payloads the single stage ur
receives or you can say as single
receive fails with slash payloads the
stage here receives the middle stage and
the middle stage then performs a full
download and it will go ahead and read
write and can perform any kind of those
talks so expanding on payload types in
Metasploit so I have briefly covered
three main types that is singles stages
and stages Metasploit contains many
different types of payloads each serving
a unique role within the framework so
let's take a brief look at the various
types of payloads available and get an
idea of when each type should be used
exactly so let's solve within it start
with the non-stressed inline module a
single payload containing the exploit
and full shell code for the selected
tasks inline payloads are by desire are
you can see as it's by design more
stable than their counterparts because
they contain everything all in one
so however some exploits will not
support the resulting size of these
payloads but still some Ville so these
are how the inline on stage look like
after that we have the stage where
payloads which work in connection with
the stage payloads in order to perform a
specific task a stretcher at a
establishes a communication channel
between the attacker and the victim and
reads in a stage payload to execute on
the remote host meetha pittha emitter
beta is the short form of meter
interpreter which
an advanced multifaceted payload that
operates via DLL injection the
meterpreter resides completely in the
memory of the remote host and leaves no
traces on the hard drive making it
exceptionally difficult to detect with
conventional forensic techniques scripts
and plugins can be loaded and unloaded
dynamically as required and material
development is very strong and
constantly evolving so whenever you quit
and try to run some kind of payload on a
system and you execute a meterpreter
into their shell you don't need to worry
about because normally no one will
actually be able to gather any kind of
information whether you actually went
ahead and get gathering the kind of
information already actually hacked into
that because there are no traces left on
the hard drive it only works on the
memory or the virtual memory and you
don't even need to worry about the RAM
cleaning the RAM because it's not that
hard after all but still there are
chances that some people may try to find
you out if they are checking that but
still if they are taking what are the
things that are actually consuming Ram
but still that's again a totally
different story because payload or the
meter period does not eat any kind of
resources it's a simple powershell or a
command prompt kind of thing which
you'll hardly use like a few key
kilobytes so you don't need to worry
about any of these things because
normally any kind of application if
that's running it will take probably a
few MB like 6-7 MB or up to more than
every 100 MB so don't need to so people
will not actually go ahead and be able
to understand it until and unless the
person is actually far-far smart after
that we have the passive explode passive
X is a payload that can help in
circumventing restrictive outbound
firewalls it does this by using the
ActiveX control to create a hidden
instance of the Internet Explorer and
using the new ActiveX control it will
communicate with the attacker via HTTP
requests and responses so just go down I
explained this to you in detail let's
say for example you have a firewall in
built but somehow the person is has
gotten into a computer but after he has
sent you the exploit the expert
successfully passed on through computer
but it is not able to code and reach out
so I decided well create a back-end
connection through the meterpreter to
our own Kali Linux so what the Pacific's
will do is that it will create a fake
Internet Explorer type of let's say
networking prompt and I'll just show you
exactly looks like I'll just go ahead in
the task manager and I'll just go to the
process ok it won't take me ok so this
how it will look like so the firewall
will probably think that it will
probably think that ok it's not a big
deal because Internet Explorer is trying
to gain access so it will look something
like it's actually something from the
Internet Explorer that is trying to get
access and the firewall will actually
allow it the reason being that it's
going from inside to outside and not
actually going to some random connection
from some random application so that's
how strong it is so after that we have
the know NX module so Pro X X is a short
form for no execute bit and it is a
feature built in into some CPUs to
prevent code from executing into certain
areas memories in Windows NX is
implemented as DEP that is data
execution prevention and the Metasploit
no NX payloads are designed to
circumvent the DEP so it's not a big
deal to go ahead and bypass that as well
after knowin X now you know what knowing
says we have the OID that's ordinary
payloads and ordinal payloads are
windows stretcher they are based their
windows teacher based payloads which
have distinct advantages and
disadvantages the advantages being it
such as it was on every flavor and
language of Windows such as XP Windows
NT Windows 98 Windows 2000 it doesn't
matter which until necessities Windows
and works on doors and without the
explicit definition of a return address
so that they are extremely very tiny
however two very specific disadvantages
of ordinal payloads make them not the
difficult choice the first thing that it
relies on is the fact that ws to
underscore 32 period dll you
loaded into the process it is being
exploited before exploitation which is
not exactly a happen several time and
the second thing being that it's a bit
less stable than the other stages so
that's quite not a good thing for us
hackers to go ahead and execute this
kind of payload but it works in every
kind of thing in all types of windows so
until unless you have these two things
running it won't matter so after that we
have the ipv6 payloads and the
Metasploit ipv6 payloads as the name
indicates are built into the function
over ipv6 networks so not much to know
about all of these things but these are
the basics that you should know before
going ahead and actually using start
using the payloads because they can be
quite harmful not only to the person
whom you're trying to attack but can be
you even if you're trying to go ahead
and do some kind of mischief as well so
that would be it for this tutorial in
the rest will be continuing with the
reflective DLL injection and generating
a payload for meters Floyd