Re: inline meterpreter payload

[egypt () metasploit com]

On Tue, Sep 11, 2012 at 4:31 PM, Richard Miles
<richard.k.miles () googlemail com> wrote:
> Hi Joshua
>
> For example, if I use shellcodeexec and it's not detected by AV the first
> stage will be loaded on memory and it will download the second stage (.dll)
> and only run it from memory, right?
>
> Thanks

The executables that Metasploit creates do not contain meterpreter,
just a stager stub that reads a 4-byte length followed by that many
bytes of a second stage. In the case of meterpreter, the second stage
is a Reflective DLL. Anything that can connect to a Metasploit handler
and follow the same steps will accomplish the same thing.

egypt
_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework