msfpayload - Replacing Shell Code in Exploit

[hdm at metasploit.com (H D Moore)]

On Sat, 2009-02-07 at 15:30 +0100, Florian Roth wrote:
> Can anyone explain how to handle 2-stage shell code (meterpreter) or
> how to integrate it in the working exploit?

There is more to it than just sending the right bytes. 

1. Send the stager (reverse|bind) in the exploit itself
2. Handle the connection to the stager, send a middle stager
3. Transfer the 2000+ byte DLL injection stage using the middle stager
4. Transfer the Meterpreter DLL using the DLL injection stager
5. Communicate over the port using the Meterpreter API/protocol
6. Use this protocol to load stdapi,priv,etc

In the 2-part stage above (shell), send the first part in the exploit,
and once the connection is established, send the second part, and you
have your shell. If you don't want a staged payload, generate
windows/shell_(reverse|bind)_tcp instead.

-HD