Creating Metasploit Payloads

Often one of the most useful (and to the beginner, underrated) abilities of Metasploit is the msfpayload module. Multiple payloads can be created with this module and it helps to have something that can give you a shell in almost any situation. For each of these payloads, you can go into msfconsole and select exploit/multi/handler. Run ‘set payload’ for the relevant payloads and configure all necessary options (LHOST, LPORT, etc). Execute and wait for the payload to run.For the examples below, it’s pretty self explanatory but LHOST should be filled in with your IP address (LAN IP if attacking within the network, WAN IP if attacking across the internet). LPORT should be the port you wish to be connected back on.

List payloads

msfvenom -l

Binaries

LinuxWindowsMac

Web Payloads

PHPASPJSPWAR

Scripting Payloads

PythonBashPerl

Shellcode

For all shellcode, see ‘msfvenom –help-formats’ for information on valid parameters. Msfvenom will output code that's able to be cut and pasted in this language for your exploits.Linux Based ShellcodeWindows Based ShellcodeMac Based Shellcode

Handlers

Metasploit handlers can be great for quickly setting up Metasploit to be in a position to receive your incoming shells. Handlers should be in the following format:Once the required values are completed, the following command will execute your handler: – ‘msfconsole -L -r ‘