WEBVTT

00:00:00.840 --> 00:00:02.360
Now let's talk about the handler.

00:00:03.150 --> 00:00:05.750
It is going to be running on the attacker's machine.

00:00:06.340 --> 00:00:10.460
Its job is to listen for incoming connections from the stager.

00:00:10.620 --> 00:00:14.000
When a connection occurs, it will send back the payload,

00:00:14.000 --> 00:00:19.520
which is then bootstrapped by the stager using the ret instruction we just saw.

00:00:19.520 --> 00:00:22.310
Once the payload has been initialized,

00:00:22.420 --> 00:00:25.560
the handler is used to interact with the Meterpreter shell.

00:00:27.040 --> 00:00:30.860
We can configure the handler manually or by using a .rc file

00:00:30.870 --> 00:00:33.250
containing all the options we want to set.

00:00:34.140 --> 00:00:36.600
We can specify the IP address and port,

00:00:36.610 --> 00:00:38.800
which we want our payload to connect back to,

00:00:38.800 --> 00:00:42.420
as was the type of payload we want to send to the stager.

00:00:43.340 --> 00:00:45.350
This command will start the handler,

00:00:45.360 --> 00:00:50.360
which will be listening on the IP address and port we specified in the .rc file.

00:00:51.140 --> 00:00:53.080
There are additional options we can set,

00:00:53.090 --> 00:00:55.970
which we will be looking at later on in the course.

00:00:55.970 --> 00:00:58.850
When a connection is received by the handler,

00:00:58.860 --> 00:01:01.900
it reads the payload, also known as metsrv,

00:01:01.910 --> 00:01:02.960
from disk.

00:01:03.440 --> 00:01:08.750
metsrv is a DLL containing the actual Meterpreter code. Before sending

00:01:08.750 --> 00:01:12.950
the payload back to the stager, the handler will patch a small stub of

00:01:12.950 --> 00:01:15.960
shell code into the payload's DOS header.

00:01:16.840 --> 00:01:24.550
We can find the code responsible for this in the meterpreter_loader_x64.rb file.

00:01:25.140 --> 00:01:32.450
Let's take a look at the code. In the asm_invoke_metsrv method, we

00:01:32.450 --> 00:01:35.360
will find the shell code stub written in assembly.

00:01:36.140 --> 00:01:38.530
When this code is executed by the stager,

00:01:38.820 --> 00:01:43.630
it needs to figure out where it is in memory in order to calculate offsets.

00:01:43.630 --> 00:01:48.880
It does this by using a call instruction, which automatically pushes the

00:01:48.880 --> 00:01:52.150
address of the next instruction on the stack.

00:01:52.840 --> 00:01:57.160
It then pops the address off the stack into the rbx register.

00:01:58.240 --> 00:02:02.240
The offset to the ReflectiveLoader function is calculated by the

00:02:02.240 --> 00:02:06.830
handler and patched into the assembly code, similar to how the

00:02:06.830 --> 00:02:10.970
ROT13 hashes were patched into the assembly code by msfvenom

00:02:10.970 --> 00:02:12.360
when generating the stager.

00:02:13.340 --> 00:02:17.310
Once the ReflectiveLoader function call returns, the

00:02:17.310 --> 00:02:21.960
stub of shell code calls DllMain, which kicks off the initialization.