The MSFVenom framework is replacing the msfpayload and msfencode environment. The MSFVenom framework is going to replace the msfpayload and msfencode environments on the 8th of June 2015. This will mean that a lot of new courses and trainings will be provided for the new penetration testing framework.
So what is MSFVenom
MSFVenom is a combination of the msfpayload and msfencode environment. The MSFVenom has been tested for more than 3.5 years and the environment is ready to go public. The MSFVenom environment will allow you to perform multiple actions within a couple of commands.
Let’s take a look at the MSFVenom commands which are available:
Payload to use. Specify a ‘-‘ or stdin to use custom payloads
List a module type example: payloads, encoders, nops, all
Prepend a nopsled of [length] size on to the payload
Output format (use –help-formats for a list)
The encoder to use
The architecture to use
The platform of the payload
The maximum size of the resulting payload
The list of characters to avoid example: ‘\x00\xff’
The number of times to encode the payload
Specify an additional win32 shellcode file to include
Specify a custom executable file to use as a template
Preserve the template behavior and inject the payload as a new thread
List the payload’s standard options
Save the payload
Specify a custom variable name to use for certain output formats
Provides an interface with multiple MSFVenom commands
List available formats
How to generate a payload
To generate a payload, you can use the -p flag. You will also most likely use the -f flag (also known as –format) to specify what the output should be. Format can be two things: either you’re generating an executable type format, or you are generating a transform type format. The executable type means when you create the payload, the output is meant to be a file. The transform format means this is code, as in you probably copy and paste this to some exploit code you’re working on.
The executable format is pretty straight forward, so it needs no further explanation. But there is another flag that’s specifically designed for some transform formats, and that is the -v flag (–var-name). This option allows you have a custom variable name in your output, and currently only the following transform formats support –var-name: bash, c, csharp, java, perl, powershell, py, rb, sh, vbapplication, vbscript.
The following is a basic example of how to generate a file:
./msfvenom -p windows/meterpreter/bind_tcp -f exe
The -p flag also supports “-” as a way to accept a custom payload:
cat payload_file.bin | ./msfvenom -p – -a x86 –platform win -e x86/shikata_ga_nai -f raw
More official MSFVenom examples
The MSFVenom framework has been documented on the Github Rapid7 Wiki page. This page will provide insight on how to use the MSFVenom framework for penetration testing activities.
The page discusses:
- How to generate a payload
- How to encode a payload
- How to avoid bad characters
- How to supply a custom template
MSFVenom on GitHub
You can find the official MSFVenom package on the Github domain.
The current Github for MSFVenom is: