Forum Thread: Exploit Payload and Whatnot

Exploit Payload and Whatnot

Ok so ive been getting a little confused here.. I read that 0day exploits are the best and undetectable by av... I see the word "exploit" and what comes to my mind is that it takes advantage of a vulnerability to install our payload..

  1. So are payload injected into exe undetected by av??
  2. If not then what is the difference in payload and exploit??
  3. What is encoding?? And what are iterations.. I mean no matter u encode it 1 time or 200 times.. whats the difference??

16 Responses

I don't feel like I can construct a comprehensive answer to this question because I'm a dumbo, so let's hope someone else gives you a nice answer. Meanwhile, I can give you probably one of the worst analogies ever: I like to think of the payload as a bomb, the exploit is a truck, and the encoding part is like a box. We put the bomb in a few different boxes (number of boxes = number of iterations (even though iterations are more like a single box with a changing shape)), put the massive box in the truck, deliver the truck to the given destination (the boxes are hiding the bomb from being seen so it can slip by easily) and then we crash the truck into the target building's wall so we make a hole and we kinda "push" the boxes and the bomb all inside the building and then detonate it from afar. I don't know if this has been any helpful, I really hope it was :D

EDIT: If anyone finds any mistakes in my logic, please address them below, it would be helpful for me too.

Loved this answer :)

Thanks, tried my best :D

Give this man a cookie.

Can I say I love that.. and you...

I already knew about that bomb and wall and everything... but the box was lovely... but I still dont get that changing shape thing?? Whats that about...

EDIT - and also you didnt answer about the av... really need an answer on the av

Okay so about the changing shape thing and the AV, let's say that while we are travelling we get stopped by the police (or the AV in this case) and they are trained to check for clues for dangerous stuff on the trucks (like a small emblem on the box in which the bomb is placed that says "TNT" (in this case the antivirus software is "trained" to look for specific signs that there might be something dangerous in a file on a PC for example)), when we encode the payload, imagine that we are "swiping off and blurring" the emblem on the box that says "TNT" so it can no longer be read as something dangerous (more iterations = more swipes and amount of distortion of the "TNT" emblem) (no police officer in this case is gonna look at the box saying for example "UFT" (distorted "TNT" text) and think that there is something dangerous about it)). I think that's most of it covered, hope I helped :D

EDIT: I figured that a text-changing analogy instead of a shape-changing one might prove more sufficient for the logic that I'm trying to construct. Also don't trust what I say too much as I'm no way near an experienced person in this field and it'd be better if you wait to see if someone corrects anything of the above things before letting the analogies dwell in your brain :D

Literally the best analogies I've heard in my life.

Thanks AppleDash :D

exploit = the way you take advantage of a vulnerability in a program.

payload = the stuff (usually shellcode) you inject into the memory of the service you are exploiting.

encoding = changing the singature of the payload (a.k.a how it looks) so it doesn't get detected by an AV or IDS or whatnot. encoding is usually done by "XOR'ing" the payload.

iterations = the amount of times the payload is encoded. encoding multiple times gives a higher chance of going by undetected, but if you encode it too much, it will increase in size, and when it does, an IDS might pick it up.

hope i helped.

-Phoenix750

Thanks everyone... that was lovely...

So how many max iterations are safe to use??

i usually use 3-5

-Phoenix750

I saw a tutorial... they said to use 200 lol... but how much maximum should I use??

AV looks for patterns in known exploits and payloads. A custom exploit and payload is less likely to be detected. But AV does (I believe) look for certain patterns (/bin/sh, NOP sleds). So using a new custom exploit and payload that is encoded will work a lot better than an old exploit and payload that is encoded.

couldn't agree more.

and se7enpeace, it depends on the payload you are using. i would say, don't let your payload get bigger than 900 bytes.

-Phoenix750

Share Your Thoughts

  • Hot
  • Active