Question regarding MSFListener and Triggers for a reverse shell
Hi cryton-team,
while developing an attack scenario, some questions regarding the MSFListener as a trigger came up. The documentation describes that it is possible to write a stage, which will be triggered e.g. when a reverse shell connects. In this context the use_named_session
is mentioned to get access to the MSF session established in a stage
. However, create_named_session
and use_named_session
are only defined in context of a step.
I'm not really sure if I understand this correctly, but is the stage's MSFListener only for filtering the incomming connections and triggering a stage, or is the stages MSFListener definition here already a fully working reverse shell endpoint (since the exploit and payload are already configured there)? If the MSFListener works more like a filter/trigger, is a step needed with for example MSF to receive a reverse shell and execute a command in the context of this specific MSFListener?
It would be awesome, if you could add a first step
which for example shows how to use the MSFListener reverse shell in the documentation and executes a simple command afterwards via use_named_session
.
In this context, is a output_prefix for a MSF session ($prefix.session_id) the same as create_named_session
and use_named_session
?