WEBVTT

00:00:01.040 --> 00:00:02.520
As explained previously,

00:00:02.750 --> 00:00:07.550
the payload is a Dynamic Link Library, also known as a DLL file.

00:00:08.540 --> 00:00:12.880
The DLL contains a special reflective DLL injection library,

00:00:13.120 --> 00:00:14.560
which makes it reflective.

00:00:15.340 --> 00:00:18.460
We will cover reflective DLL injection shortly.

00:00:18.460 --> 00:00:20.070
As we saw previously,

00:00:20.070 --> 00:00:23.980
the payload is bootstrapped by the stager using a ret instruction,

00:00:23.980 --> 00:00:28.450
which jumps into the stub of shell code which was patched by the handler,

00:00:29.040 --> 00:00:32.759
which, in turn, calls the reflective loader and DllMain.

00:00:34.340 --> 00:00:39.490
The payload contains the code which provides Meterpreter's core functionality.

00:00:39.490 --> 00:00:44.840
Although metsrv is shipped precompiled with the Metasploit framework,

00:00:44.840 --> 00:00:47.590
if you want to take a look at the source code or

00:00:47.590 --> 00:00:49.780
modify and recompile the payload,

00:00:50.130 --> 00:00:53.990
the Meterpreter codebase can be cloned from the Rapid7 GitHub

00:00:53.990 --> 00:00:56.660
repository using the following commands.

00:00:59.240 --> 00:01:01.320
Once the repository has been cloned,

00:01:01.420 --> 00:01:05.800
we can go ahead and build the 64‑bit payload by running the following

00:01:05.800 --> 00:01:09.460
commands from a Visual Studio developer command prompt.

00:01:14.140 --> 00:01:18.250
When the build completes, the payloads will be available in the output folder.

00:01:18.640 --> 00:01:21.960
We could then copy these files to our Metasploit handler.

00:01:24.640 --> 00:01:27.150
Now that we are able to compile the payload, let's take

00:01:27.150 --> 00:01:28.750
a look at the payload source code.

00:01:29.340 --> 00:01:33.260
We can open Visual Studio 2019 and open the solution.

00:01:38.440 --> 00:01:42.550
Once opened, we can browse the Solution Explorer for the metsrv project.

00:01:48.040 --> 00:01:50.860
We can then open the metsrv.c file.

00:01:52.440 --> 00:01:56.660
We can see that we are indeed including the reflective DLL injection library.

00:01:57.940 --> 00:02:01.400
And if we scroll down, we will find the DllMain function,

00:02:01.480 --> 00:02:04.950
which gets called by the shell code stub which was embedded in

00:02:04.950 --> 00:02:07.260
the payload's DOS header by the handler.

00:02:08.539 --> 00:02:11.120
We can see that there is an Init function which

00:02:11.120 --> 00:02:13.380
handles the payload's initialization.

00:02:13.550 --> 00:02:15.460
If we view the code for this function,

00:02:16.740 --> 00:02:20.380
we can see that it calls the server_setup function,

00:02:20.470 --> 00:02:24.280
which completes the payload's initialization and should, if all goes

00:02:24.280 --> 00:02:27.450
well, provide a fully functional Meterpreter shell.