Question

I am analyzing this metasploit module, and I am wondering what encoding method does payload.encoded retrieves by default in metasploit.

I did a print payload.encoded in that exploit (without setting any encoder), and I get a normal string like:

PYIIIIIIIIIIQZVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP........

The module has an encoder option but it’s commented.

I am use to see payloads encoded with the standard hex values like:

\xd9\xf7\xbd\x0f\xee\xaa\x47.......

Could someone help me understand where that string returned by payload.encoded comes from and what encoding it uses?

Answer 1

Turns out the first one was an alpha_upper encoded payload, the second is just binary data encoded with hex.