Exploit vs Payload

ⓘ Table of Contents

The terms "exploit" and "payload" have many different definitions, depending on what area of expertise is currently discussed. This article will explain the two terms within the context of IT Security and, more specifically, Penetration Testing with Metasploit.

Definitions

"exploit"

"exploit", which comes from the verb "to exploit" meaning "to make use of meanly or unfairly for one's own advantage" (1) generally refers to a piece of software, data or sequence of commands or instructions to take advantage of a bug or vulnerability in order to cause some sort of unintendet, unwanted or malicious behavior in a piece of software or hardware. Exploits are thus usually used to take over, gain access to or interfere with the operation of a system (2), when talking about computer security more generally.

In the context of penetration testing with Metasploit, the term "exploit" is more narrowly defined as "a sequence of commands that target a specific vulnerability found in a system or application to provide the attacker with access to the system" (3). In other words, in the context of Metasploit, an "exploit" refers to any way to gain remote code execution (= "RCE") on a target system, and nothing more. Examples for exploits can be as simple as using ssh/telnet to log into a system using known (well-known or leaked) credentials and as complicated as leveraging multi-step zero-day vulnerabilities to gain RCE on a highly secured system.

"payload"

"payload", which comes from the noun of the same name meaning either "the load carried by a vehicle exclusive of what is necessary for its operation" (more relevant for computing in general) or "the destructive component carried by a missile or bomb" (more applicable to penetration testing) (4) in the context of computing generally refers to a piece of data that is the actual message or information that should be communicated, excluding all headers or other information required added by and/or required for the transmission method or protocol (5).

In Penetration Testing, the term "payload" refers to the piece of data or sequence of instructions that is transmitted to the target system and then executed there. To execute the payload, RCE has to be gained beforehand, which is the reason why payloads are designed to be used together with exploits in the Metasploit Framework. Common payloads include reverse shells (where the attacked system connects to an attacker controlled server with a shell session and this session is then reversed to gain access to the attacked system, hence the name "reverse shell"), "download and execute" payloads (which download a remote-hosted executable from an attacker-controlled server and then execute it, commonly installing malware like keyloggers, persistent shells, rootkits, adware, etc.), as well as the Metasploit-specific "Meterpreter" payload (a powerful type of reverse shell which comes with many useful tools for further working with a successfully attacked and exploited system) (6).