Pearson's OSCP Notebook

Payloads

Properties1
tagsmetasploit, payload, meterpreter, reverse-shell, staged, stageless, shellcode

3 min read

Metasploit Payloads — Reference

Payload Categories

CategoryDescription
SinglesSelf-contained; no stager needed. Larger but reliable. Deliver everything in one shot.
StagersSmall; sent first. Establishes a channel between attacker and target.
StagesDownloaded by the stager over the established channel. Contains the full payload (e.g. Meterpreter).

Staged vs Stageless — Key Distinction

Staged ( / in name )

windows/x64/meterpreter/reverse_tcp
                        ^
                        / = staged (stager + stage)
  • Small initial stager connects back, downloads the full stage from MSF listener
  • Requires exploit/multi/handler running on your machine
  • Smaller initial payload size — good when payload space is limited
  • More reliable in controlled environments

Stageless ( _ in name )

windows/x64/meterpreter_reverse_tcp
                        ^
                        _ = stageless (everything in one)
  • Entire payload embedded; no second-stage download needed
  • Larger file size
  • Works without MSF running (just need a netcat listener for basic shells)
  • Better for unstable networks or when staging might fail

OSCP rule of thumb: Use staged (/) when you have MSF running as a handler. Use stageless (_) when you’re delivering a payload that needs to work standalone or you’re not sure if the second-stage download will succeed.

Payload Naming Convention

<platform>/<arch>/<type>/<connection>

windows / x64 / meterpreter / reverse_tcp
  │        │         │              │
  │        │         │              └── Connection direction & protocol
  │        │         └─────────────── Payload type (shell, meterpreter, vnc, etc.)
  │        └───────────────────────── Architecture (x86, x64, x86_64, cmd, etc.)
  └────────────────────────────────── Platform (windows, linux, osx, android, java, php, etc.)

Connection types

TypeDescription
reverse_tcpTarget connects back to attacker over TCP
reverse_httpsTarget connects back over HTTPS (encrypted + looks like legit traffic)
reverse_httpTarget connects back over HTTP
bind_tcpPayload listens on target; attacker connects in
reverse_tcp_allportsTry all ports for the callback (firewall bypass)
reverse_tcp_uuidUUID-based reverse TCP (for specific handlers)
reverse_named_pipeSMB named pipe reverse connection (Windows)
find_tagFind an existing connection via tag (for SMB exploits)

Tip: reverse_https is stealthier than reverse_tcp — traffic blends with normal HTTPS. Prefer it in real engagements.

Payload Types

TypeDescription
shellBasic OS shell (cmd.exe or /bin/sh). No MSF features.
meterpreterFull-featured in-memory agent. Most powerful.
vncVNC viewer/injector (GUI access)
upexecUpload and execute a file on target
execExecute a single command
loadlibraryLoad a DLL on target
messageboxPop a message box (testing/demo only)

Common Payloads Table

Windows

PayloadArchNotes
windows/x64/meterpreter/reverse_tcpx64Most common staged Windows payload
windows/x64/meterpreter_reverse_tcpx64Stageless equivalent
windows/x64/meterpreter/reverse_httpsx64Staged, HTTPS
windows/meterpreter/reverse_tcpx8632-bit staged
windows/meterpreter_reverse_tcpx8632-bit stageless
windows/x64/shell/reverse_tcpx64Staged basic cmd.exe shell
windows/x64/shell_reverse_tcpx64Stageless basic cmd.exe shell
windows/x64/powershell/reverse_tcpx64PowerShell session
windows/x64/vnc/reverse_tcpx64VNC GUI session

Linux

PayloadArchNotes
linux/x64/meterpreter/reverse_tcpx64Most common Linux staged
linux/x64/meterpreter_reverse_tcpx64Stageless
linux/x86/meterpreter/reverse_tcpx8632-bit Linux
linux/x64/shell/reverse_tcpx64Staged basic /bin/sh
linux/x64/shell_reverse_tcpx64Stageless /bin/sh

Web / Script

PayloadPlatformNotes
php/meterpreter/reverse_tcpPHPStaged PHP meterpreter
php/meterpreter_reverse_tcpPHPStageless PHP
php/reverse_phpPHPSimple PHP reverse shell (no MSF)
java/meterpreter/reverse_tcpJavaFor Tomcat/WAR deployments
java/shell_reverse_tcpJavaBasic Java shell
python/meterpreter/reverse_tcpPythonStaged Python meterpreter
cmd/unix/reverse_bashbashbash -i reverse shell one-liner
cmd/windows/reverse_powershellPowerShellPS reverse shell

Mobile

PayloadPlatformNotes
android/meterpreter/reverse_tcpAndroidFull meterpreter APK
apple_ios/aarch64/meterpreter_reverse_tcpiOSStageless iOS

Checking if 32-bit or 64-bit Target

Before generating a payload, confirm the architecture:

# From meterpreter (if you already have a shell)
sysinfo
 
# From Nmap scan
nmap -sV -O 10.10.10.10
 
# From a basic shell
uname -m          # Linux
wmic os get osarchitecture   # Windows CMD
[Environment]::Is64BitOperatingSystem   # PowerShell

Safe bet: If unsure, try x64 first. If the exploit/payload fails, try x86.

Payload Decision Tree

Do you need MSF features (hashdump, pivot, etc.)?
├── YES → use meterpreter
│   ├── Will MSF handler be running? → staged (/)
│   └── Standalone needed?          → stageless (_)
└── NO  → use shell (lighter, stealthier)
    ├── Will MSF handler be running? → staged shell (/)
    └── No handler?                  → stageless shell (_) or nc listener

Graph View

Backlinks