Exploit vs Payload
The terms "exploit" and "payload" have many different definitions, depending on what area of expertise is currently discussed. This article will explain the two terms within the context of IT Security and, more specifically, Penetration Testing with Metasploit.
Definitions
"exploit"
"exploit", which comes from the verb "to exploit" meaning "to make use of meanly or unfairly for one's own advantage" (1) generally refers to a piece of software, data or sequence of commands or instructions to take advantage of a bug or vulnerability in order to cause some sort of unintendet, unwanted or malicious behavior in a piece of software or hardware. Exploits are thus usually used to take over, gain access to or interfere with the operation of a system (2), when talking about computer security more generally.
In the context of penetration testing with Metasploit, the term "exploit" is more narrowly defined as "a sequence of commands that target a specific vulnerability found in a system or application to provide the attacker with access to the system" (3). In other words, in the context of Metasploit, an "exploit" refers to any way to gain remote code execution (= "RCE") on a target system, and nothing more. Examples for exploits can be as simple as using ssh/telnet to log into a system using known (well-known or leaked) credentials and as complicated as leveraging multi-step zero-day vulnerabilities to gain RCE on a highly secured system.