The first tactic that we're going to be looking at inside of Metasploit is
called a Stager.
And you can have multiple stages set throughout your entire platform.
But the idea behind the Stager is that we're prepping the target system
for a method of communication to remote back to us so that we may do things.
Now, generally, the most popular one is like a reverse shell.
But the whole point behind the Stager is having that very lightweight payload
developed in something like MSF Venom to be able to send to a target system
so that it may open a backdoor channel of communication for us.
So later on, we could do other things.
We are staging the system for communication
back to us in a controlled environment so that we may exploit further and pivot
later.
And that's it. That's the whole idea behind the Stager.
Now, we've seen examples of this as I swap over to the side screen here for us
of this being used in multiple situations throughout this course
and many others that we've done together.
Now, I will be zooming in for us.
Fear not.
And the most common one that we've been using so far is this one.
MSF Venom with a dash P for payload going into Windows X64.
Meter freighter, reverse TCP and setting the L host and L port for us in a
on this particular metasploit system that we're using inside of our lab.
Now, it could be any IP address to a system that has a listener open for it
or it could be the one you're using.
We will discuss more on that later.
I'm going to export it out as an exe file and name it dummy.exe.
You can see that it's sitting right there on the desktop.
I've already created it to kind of speed things up here.
But this will run and create the dummy XC exe file.
And I've already moved it over to the actual Windows system that is the host
for our lab.
You can see that right here where I have dummy exe in the shareholder for you
when you enter the slab.
Now, when I run this dummy exe file, it's going to open up a process inside of
this particular target
system and it's going to open up a line of communication for us to be able to
reliably listen
with on our metasploit system.
So the host being the target the metasploit being the stager to set things up
worse to continue
attacking and exploiting against known and unknown vulnerabilities later on.
So let's see this in practice, right?
We're going to first open up our task manager as you can see here.
I'm going to move this to the side very carefully.
There we go.
So that way when we execute dummy.exe, we can see that it opens up inside as a
process.
Go ahead and execute dummy exe.
I'm going to highlight it and zoom in for us.
dummy exe is running in the background.
We didn't create anything with it for a GUI or interaction because it is that
single
lightweight payload that we create for our staging.
Now, to verify that this is actually going and running inside of our
communication platform,
we can simply on the target system since we're very familiar with it,
go in to a start and go in to run, CMD because I think PowerShell is a bit over
kill for this.
And we're just going to run a net stat dash, A and O again commands below this,
don't you worry.
So we'll go ahead and run that and I'm going to stop there because that's a lot
because everything
we need is up top.
There we go right there.
Now, is it running or established? I'm looking for it and I don't necessarily
see it, but I do see
that dummy is not running anymore. That's why it's time down. So let's go ahead
and start it again.
Dummy's running. Go back into our command prompt, run this one more time and
kill it so that way
we can see where it's running. Let's go back up. Sorry, I had to clear a screen
and make sure
that I could actually find it again because there was a lot of text on there,
CLS for that.
And as you can see, I'm going to highlight the line that it's on and show you
right here.
Right there. We have from us on 192.168.01 port, whatever, trying to
communicate back to 192.168.053.4444.
And as you can see, the status is send sent. So it's trying to do that three
way,
hanging, shaking, open up that reverse communication for us to be able to go in
and do things later.
But I don't have the listener open. And that's where our Stager has to be
staged properly for
us to be able to come back and listen in return. Because as you can see in the
task manager here,
as I zoom in, there's no dummy. And the reason there's no dummy is because that
send sent packet that was executed, ran with the execution of dummy timed out.
So there was no listener staged for it. And therefore it just said, I'm not
going to try anymore.
Now inside of Cali, I now need to go into again because it timed out. I want to
minimize this
and then give us a demonstration of a proper staging. Do you like my goose?
Random things pop up when you open up MSF console. And that's where our Stager
is going to be set
up to receive that reverse communication from the target back to our Metasplo.
Now I'm going to scroll down. I just wanted to show you my goose and show you
that I've already
made the configurations for that receiving an MSF console. You could see here
that we've already
identified the payload to match that which we did in MSF venom. They do have to
match.
And inside of here, we have parameters that have to be set. So we're going to
set the L host to
192.168.053, the Cali box, which is this. And then we're going to set the
listening port.
And then I did a show options just to be able to show us two things. One, that
we are truly
configured. And two, to make sure that we didn't have any other variables
inside of that particular
payload or exploit to go through and configure or if they're required. Because
as you could see,
the L host and the L port are required, but the exit function is already set by
default.
Now the only thing that I need to do here at this point inside of MSF console
is run the command exploit. And that's going to open up the listener for our St
ager that's been
sent on the target system. So you can see started reverse with 192.168.053. And
now you can see
I did a clear screen and now you can see it loading up. And by loading up, I
mean, let's
let me get a way to be able to zoom in for us. I apologize. You see that meter
preter session one
opened from us at 4444 on our listening port to the target system 0.1, whatever
port at
timestamp. And this is good information to log as you continue to grow and
become a
pen tester log log log. Now that I'm back in it, it's going to take a little
minute to establish
the reverse capabilities, but that's not what we're getting into right now.
What we're focusing on
is the fact that we want to be able to send a Stager to a target system or
systems and be able
to have a communication channel open, regardless of whatever it is that we
truly intend to send
to that target system. And that my friends is a Stager. It's not that
complicated. And it's
probably one of the easiest things that we can do inside of the Metas White
framework,
because without communication to that target system, we can't exactly do any
exploits against
it. That goes into that physical side of the house where you just steal the
system taken all the way
to it.