Senin, 27 Februari 2012

What is msfencode, msfpayload and example

msfpayload is a command-line instance of metasploit that is used to generate and output all or the various type of shellcode that are available in metasploit.

msfencode is The shellcode generated by msfpayload is fully functional, but it contains several
null characters that, when interpreted by many programs, signify the
end of a string, and this will cause the code to terminate before completion.
In other words, those x00s and xffs can break your payload!
In addition, shellcode traversing a network in cleartext is likely to be
picked up by intrusion detection systems (IDSs) and antivirus software. To
address this problem, Metasploit’s developers offer msfencode, which helps
you to avoid bad characters and evade antivirus and IDSs by encoding the
original payload in a way that does not include “bad” characters. Enter
msfencode -h to see a list of msfencode options.
Metasploit contains a number of different encoders for specific situations.
Some will be useful when you can use only alphanumeric characters as part
of a payload, as is the case with many file format exploits or other applications
that accept only printable characters as input, while others are great general
purpose encoders that do well in every situation.
When in doubt, though, you really can’t go wrong with the x86/shikata_
ga_nai encoder, the only encoder with the rank of Excellent, a measure of
the reliability and stability of a module. In the context of an encoder, an
Excellent ranking implies that it is one of the most versatile encoders and
can accommodate a greater degree of fine-tuning than other encoders. To
see the list of encoders available, append -l to msfencode as shown next. The
payloads are ranked in order of reliability




Tidak ada komentar:

Posting Komentar