Payloads and Meterpreter

A payload is the code that executes on the target after an exploit succeeds. It defines what you can do next, from running a single command to opening a full interactive shell.

Choosing the right payload depends on the target OS, the network setup, and how much access you need.

Payloads come in two delivery styles:

• Staged (note the / in meterpreter/reverse_tcp): sends a small stub first, which then downloads the full payload. Smaller initial footprint.
• Stageless (note the _ in meterpreter_reverse_tcp): the entire payload is delivered at once. More reliable on flaky networks.

Two connection directions:

• Bind shell: the target opens a port and waits; you connect to it. Often blocked by firewalls.
• Reverse shell: the target connects back to you (LHOST/LPORT). This usually slips past outbound-friendly firewalls.

Reverse payloads are the common default for this reason.

Meterpreter is Metasploit's advanced payload. Unlike a basic command shell, it runs in memory, communicates over an encrypted channel, and offers a rich command set for post-exploitation.

Because it avoids writing to disk, it is stealthier than dropping a separate executable.

Once you have a Meterpreter session, foundational commands orient you on the target.

Meterpreter moves files between your machine and the target with simple commands, useful for grabbing evidence or staging tools in authorized tests.

The shell command drops you from Meterpreter into the target's native command interpreter (cmd.exe or /bin/sh) when you need OS-level commands directly.

Type exit to return to the Meterpreter prompt without losing the session.

You often land with limited privileges. Meterpreter helps escalate:

• getsystem attempts known techniques to gain SYSTEM on Windows.
• The local_exploit_suggester post module recommends local privilege escalation exploits for the host.

Higher privileges unlock credential dumping and deeper access.

Your session lives inside a process. If that process is unstable or likely to be killed, migrate into a more stable, long-running process to keep your session alive.

Migrating into a process that matches your privilege level also helps blend in and can shift your user context.

Meterpreter includes features for capturing useful data during authorized assessments, such as hashdump to collect password hashes and keyscan tools to demonstrate input capture impact.

Use such capabilities only within the agreed scope, and document everything for the client report.

A reverse payload needs something listening on your side to catch the connection. The multi/handler module is that catcher. You configure it with the same payload, LHOST, and LPORT used to generate the payload.

This is essential when you deliver a msfvenom payload outside the console: start the handler first, then trigger the payload on the target.

Pick the payload that bypasses a restrictive firewall.

You learned payloads and Meterpreter:

• Payloads can be staged (/) or stageless (_), and bind or reverse; reverse usually beats firewalls.
• Meterpreter runs in memory over an encrypted channel with rich commands.
• Core tasks: sysinfo, getuid, ps, download/upload, shell.
• Escalate with getsystem and local_exploit_suggester; migrate for stability.
• Use gathering features only within scope and document everything.

Next: post-exploitation modules, pivoting, and looting.