Differences in Meterpreter shells

[Haxxerenr]

Hi guys,

Metaploit gives you a great list of Meterpreter shells to use for your pen testing pleasure. However I can't seem to find guidelines about when to use what shell in what situation. In all guides they just mention what payload they use, but never give a reason why.

Does someone have a good resource on this matter?

Thanks

[mreidiv]

The pay load to use depends upon what you target os you are running what services are running what programs are running ect. so there is no real way to give you an exact answer on what payload to use when since there are so many of them. Here is a good place to start.

One simple this is that a reverse merterperter will have the targe connect back to you box instead of you trying to get past the firewal router etc. and connecting to the target. If you try to spawn a meterperter shell directly anyone that is monitoring the traffic will see a red flag. so having the trget coneect back to does not through up as big of flag. and looks like the are the on initation the session.

Sorry i could not be of more help as i am still learning this also.

Edited February 25, 2014 by mreidiv

[mubix]

reverse_tcp connections I use when I know that system can get directly to me. bind_tcp I use when I don't have another option and reverse_http / reverse_https are the ones I use the most.