MSFVENOM – All payload examples – Cheatsheet 2017

Msfvenom is a Metasploit Standalone Payload Generator which is a replacement of msfpayload and msfencode. Through msfvenom, you can generate any kind of shellcode/payload depending upon the platform/OS you want to hack.

Often one of the most useful abilities of Metasploit is the msfvenom module. Multiple payloads can be created with this module and it helps something that can give you a shell in almost any situation.

For each of these payloads you can go into msfconsole and select exploit/multi/handler. Run “set payload” for the relevant payload used and configure all necessary options (LHOST, LPORT, SRVHOST, SRVPORT etc). Execute and wait for the payload to be run.

For exploitation in local network, fill up your IP address in LHOST but for exploitation over WAN, you need to fill it with your Public IP and make sure that your port must be forwarded or you can also use NGROK tunnel if you’re facing any problem with port forwarding. Ngrok will automatically forwards all traffic to your localhost.

The advantages of msfvenom are:

One single tool
Standardized command line options
Increased speed

Usage of Msfvenom:

msfvenom [options] <var=val>

To list out all options, type “msfvenom -h”

-p, –payload Payload to use. Specify a ‘-‘ or stdin to use custom payloads
–payload-options List the payload’s standard options
-l, –list [type] List a module type. Options are: payloads, encoders, nops, all
-n, –nopsled Prepend a nopsled of [length] size on to the payload
-f, –format Output format (use –help-formats for a list)
–help-formats List available formats
-e, –encoder The encoder to use
-a, –arch The architecture to use
–platform The platform of the payload
–help-platforms List available platforms
-s, –space The maximum size of the resulting payload
–encoder-space The maximum size of the encoded payload (defaults to the -s value)
-b, –bad-chars The list of characters to avoid example: ‘\x00\xff’
-i, –iterations The number of times to encode the payload
-c, –add-code Specify an additional win32 shellcode file to include
-x, –template Specify a custom executable file to use as a template
-k, –keep Preserve the template behavior and inject the payload as a new thread
-o, –out Save the payload
-v, –var-name Specify a custom variable name to use for certain output formats
–smallest Generate the smallest possible payload
-h, –help Show this message