Throughout the section, you're going to learn about an interpreter and examine what it's capable of
to reach your most exploitation goals.
So interpretor is a custom, dynamically extensible payload that is developed for MSF.
Comparing that to other payload types, it's the most used and feature rich one.
Generally speaking, with most other payloads, you're pretty much limited to execute one command at
a certain time simply to interact with the system.
If you want to execute some others, such as add a user download or upload a file, jump into another
network, you will see how difficult it is because of exploiting the target again and again and again.
So, oh, additionally, normal payloads are not generally stealthy, and this is also undesirable for
any pin tester, on the other hand.
Lucky you have met her, so it's loaded directly into the memory of an exploited process using a technique
called reflexive DRL injection.
It's uploaded into the heap of the compromise process on the target and writes nothing to the disc.
Now, because it worked completely within the memory, doesn't touch the filesystem directly if it's
not necessary and it remains generally undetectable.
Not going to say I guarantee stealthy, but it's pretty much always stealthy.
And yeah, so as I was saying before, it works in memory and injects a pre run process, but usually
something else like adding a user is probably going to send up an alarm, who knows?
Matricular doesn't need to start a new process that might be noticed by an intrusion prevention or detection
system.
And because of that capability, generally, most intrusion detection systems can't detect it.
Now, moreover, the process in which the interpreter is attached can be changed at any time.
And actually, this makes tracking it very hard.
Another important thing about an interpreter is that it communicates with Métis point using transport
layer security, encryption.
So it communicates over the stagers socket and provides a comprehensive client side Ruby API.
And to me, the best of the best my interpreter allows for multitasking by creating multiple sessions.
And it also provides a bash style shell and has features such as command history, tab, completion
channels and many more.