Skip to main content

​
Payloads

A payload in Metasploit is the module that works with an exploit to execute post-exploitation code on the target, often resulting in shell/session access.
  • The exploit bypasses the vulnerable service logic.
  • The payload runs on the target and establishes/maintains access.
Metasploit payload modules are grouped into three types:
  1. Singles
  2. Stagers
  3. Stages
Whether a payload is staged is indicated by / in the payload name. Examples:
  • windows/shell_bind_tcp -> single payload (no staged split)
  • windows/shell/bind_tcp -> staged payload (bind_tcp stager + shell stage)

​
Singles

Single payloads are self-contained. They include all shellcode needed for the task in one object.
  • Usually more stable because everything is inline.
  • Can become too large for some exploit constraints.
  • Execute immediately once delivered.
Typical outcomes include launching a process, executing a command, or returning a shell directly.

​
Stagers

Stagers are compact bootstrap payloads that establish a communication channel from victim to attacker, then prepare delivery of a larger stage.
  • Designed to be small and reliable.
  • Commonly initialize reverse or bind channels.
  • Metasploit can auto-select suitable stagers per scenario.

​
Windows NX vs NO-NX Stagers

  • Reliability concerns exist on NX/DEP-protected systems.
  • NX-compatible stagers are larger (for example, VirtualAlloc-style memory handling).
  • Current defaults generally favor NX and newer Windows compatibility.

​
Stages

Stages are the larger payload components fetched after stager execution. They provide advanced capabilities such as Meterpreter and VNC injection. Operationally:
  • A single recv() may fail for large payloads.
  • The initial stager can receive an intermediate downloader.
  • The intermediate component completes full stage download into memory.

​
Staged Payloads

A staged payload breaks exploitation into chained functional parts to reduce initial size and improve delivery reliability.
  • Stage0: initial shellcode (for example reverse_tcp, reverse_https, bind_tcp)
  • Stage1: larger functional component delivered after channel setup

​
MSF: Staged Payloads

Reverse connections are often effective because they leverage outbound traffic paths that are commonly more permissive than inbound filtering.

​
Searching for Payloads

To choose a payload, start with the intended objective on the target. For example, Meterpreter payloads are commonly selected for flexible post-exploitation workflows.

​
MSF: List Payloads

​
Windows x64 Meterpreter Block (Example)

​
MSF: Searching for Specific Payloads

Use grep in msfconsole to reduce large output.
Chaining filters:

​
Selecting Payloads

After choosing an exploit module, set a payload by index: set payload <no.>

​
MSF: Select Payload

​
Payload Types

The table below lists common payload families for Windows targets. Other well-known operational payload ecosystems also exist outside default Metasploit modules. Those are out of scope here.