码迷,mamicode.com
首页 > 其他好文 > 详细

Msfvenom 学习笔记与总结

时间:2016-03-01 12:18:41      阅读:291      评论:0      收藏:0      [点我收藏+]

标签:

平台:Android,可用Payload:

1  android/meterpreter/reverse_http                    Run a meterpreter server on Android. Tunnel communication over HTTP
2  android/meterpreter/reverse_https                   Run a meterpreter server on Android. Tunnel communication over HTTPS
3  android/meterpreter/reverse_tcp                     Run a meterpreter server on Android. Connect back stager
4  android/shell/reverse_http                          Spawn a piped command shell (sh). Tunnel communication over HTTP
5  android/shell/reverse_https                         Spawn a piped command shell (sh). Tunnel communication over HTTPS
6  android/shell/reverse_tcp                           Spawn a piped command shell (sh). Connect back stager

不常用的是最后三行的Payload ,用它只能得到一个sh的shell,不如meterpreter提供的后渗透模块强大,可能是有其他的用处吧..不解..

运行平台:Java,可用Payload:

1  java/jsp_shell_bind_tcp                             Listen for a connection and spawn a command shell
2  java/jsp_shell_reverse_tcp                          Connect back to attacker and spawn a command shell
3  java/meterpreter/bind_tcp                           Run a meterpreter server in Java. Listen for a connection
4  java/meterpreter/reverse_http                       Run a meterpreter server in Java. Tunnel communication over HTTP
5  java/meterpreter/reverse_https                      Run a meterpreter server in Java. Tunnel communication over HTTPS
6  java/meterpreter/reverse_tcp                        Run a meterpreter server in Java. Connect back stager
7  java/shell/bind_tcp                                 Spawn a piped command shell (cmd.exe on Windows, /bin/sh everywhere else). Listen for a connection
8  java/shell/reverse_tcp                              Spawn a piped command shell (cmd.exe on Windows, /bin/sh everywhere else). Connect back stager
9  java/shell_reverse_tcp                              Connect back to attacker and spawn a command shell

明白怎么回事,说不出来,还是没明白透,先略过了

 

平台:Linux ,可用Payload:

 1     linux/armle/adduser                                 Create a new user with UID 0
 2     linux/armle/exec                                    Execute an arbitrary command
 3     linux/armle/shell/bind_tcp                          dup2 socket in r12, then execve. Listen for a connection
 4     linux/armle/shell/reverse_tcp                       dup2 socket in r12, then execve. Connect back to the attacker
 5     linux/armle/shell_bind_tcp                          Connect to target and spawn a command shell
 6     linux/armle/shell_reverse_tcp                       Connect back to attacker and spawn a command shell
 7     linux/mipsbe/exec                                   A very small shellcode for executing commands. This module is sometimes helpful for testing purposes.
 8     linux/mipsbe/reboot                                 A very small shellcode for rebooting the system. This payload is sometimes helpful for testing purposes or executing other payloads that rely on initial startup procedures.
 9     linux/mipsbe/shell/reverse_tcp                      Spawn a command shell (staged). Connect back to the attacker
10     linux/mipsbe/shell_bind_tcp                         Listen for a connection and spawn a command shell
11     linux/mipsbe/shell_reverse_tcp                      Connect back to attacker and spawn a command shell
12     linux/mipsle/exec                                   A very small shellcode for executing commands. This module is sometimes helpful for testing purposes as well as on targets with extremely limited buffer space.
13     linux/mipsle/reboot                                 A very small shellcode for rebooting the system. This payload is sometimes helpful for testing purposes.
14     linux/mipsle/shell/reverse_tcp                      Spawn a command shell (staged). Connect back to the attacker
15     linux/mipsle/shell_bind_tcp                         Listen for a connection and spawn a command shell
16     linux/mipsle/shell_reverse_tcp                      Connect back to attacker and spawn a command shell
17     linux/ppc/shell_bind_tcp                            Listen for a connection and spawn a command shell
18     linux/ppc/shell_find_port                           Spawn a shell on an established connection
19     linux/ppc/shell_reverse_tcp                         Connect back to attacker and spawn a command shell
20     linux/ppc64/shell_bind_tcp                          Listen for a connection and spawn a command shell
21     linux/ppc64/shell_find_port                         Spawn a shell on an established connection
22     linux/ppc64/shell_reverse_tcp                       Connect back to attacker and spawn a command shell
23     linux/x64/exec                                      Execute an arbitrary command
24     linux/x64/shell/bind_tcp                            Spawn a command shell (staged). Listen for a connection
25     linux/x64/shell/reverse_tcp                         Spawn a command shell (staged). Connect back to the attacker
26     linux/x64/shell_bind_tcp                            Listen for a connection and spawn a command shell
27     linux/x64/shell_bind_tcp_random_port                Listen for a connection in a random port and spawn a command shell. Use nmap to discover the open port: ‘nmap -sS target -p-‘.
28     linux/x64/shell_find_port                           Spawn a shell on an established connection
29     linux/x64/shell_reverse_tcp                         Connect back to attacker and spawn a command shell
30     linux/x86/adduser                                   Create a new user with UID 0
31     linux/x86/chmod                                     Runs chmod on specified file with specified mode
32     linux/x86/exec                                      Execute an arbitrary command
33     linux/x86/meterpreter/bind_ipv6_tcp                 Inject the meterpreter server payload (staged). Listen for an IPv6 connection (Linux x86)
34     linux/x86/meterpreter/bind_ipv6_tcp_uuid            Inject the meterpreter server payload (staged). Listen for an IPv6 connection with UUID Support (Linux x86)
35     linux/x86/meterpreter/bind_nonx_tcp                 Inject the meterpreter server payload (staged). Listen for a connection
36     linux/x86/meterpreter/bind_tcp                      Inject the meterpreter server payload (staged). Listen for a connection (Linux x86)
37     linux/x86/meterpreter/bind_tcp_uuid                 Inject the meterpreter server payload (staged). Listen for a connection with UUID Support (Linux x86)
38     linux/x86/meterpreter/find_tag                      Inject the meterpreter server payload (staged). Use an established connection
39     linux/x86/meterpreter/reverse_ipv6_tcp              Inject the meterpreter server payload (staged). Connect back to attacker over IPv6
40     linux/x86/meterpreter/reverse_nonx_tcp              Inject the meterpreter server payload (staged). Connect back to the attacker
41     linux/x86/meterpreter/reverse_tcp                   Inject the meterpreter server payload (staged). Connect back to the attacker
42     linux/x86/meterpreter/reverse_tcp_uuid              Inject the meterpreter server payload (staged). Connect back to the attacker
43     linux/x86/metsvc_bind_tcp                           Stub payload for interacting with a Meterpreter Service
44     linux/x86/metsvc_reverse_tcp                        Stub payload for interacting with a Meterpreter Service
45     linux/x86/read_file                                 Read up to 4096 bytes from the local file system and write it back out to the specified file descriptor
46     linux/x86/shell/bind_ipv6_tcp                       Spawn a command shell (staged). Listen for an IPv6 connection (Linux x86)
47     linux/x86/shell/bind_ipv6_tcp_uuid                  Spawn a command shell (staged). Listen for an IPv6 connection with UUID Support (Linux x86)
48     linux/x86/shell/bind_nonx_tcp                       Spawn a command shell (staged). Listen for a connection
49     linux/x86/shell/bind_tcp                            Spawn a command shell (staged). Listen for a connection (Linux x86)
50     linux/x86/shell/bind_tcp_uuid                       Spawn a command shell (staged). Listen for a connection with UUID Support (Linux x86)
51     linux/x86/shell/find_tag                            Spawn a command shell (staged). Use an established connection
52     linux/x86/shell/reverse_ipv6_tcp                    Spawn a command shell (staged). Connect back to attacker over IPv6
53     linux/x86/shell/reverse_nonx_tcp                    Spawn a command shell (staged). Connect back to the attacker
54     linux/x86/shell/reverse_tcp                         Spawn a command shell (staged). Connect back to the attacker
55     linux/x86/shell/reverse_tcp_uuid                    Spawn a command shell (staged). Connect back to the attacker
56     linux/x86/shell_bind_ipv6_tcp                       Listen for a connection over IPv6 and spawn a command shell
57     linux/x86/shell_bind_tcp                            Listen for a connection and spawn a command shell
58     linux/x86/shell_bind_tcp_random_port                Listen for a connection in a random port and spawn a command shell. Use nmap to discover the open port: ‘nmap -sS target -p-‘.
59     linux/x86/shell_find_port                           Spawn a shell on an established connection
60     linux/x86/shell_find_tag                            Spawn a shell on an established connection (proxy/nat safe)
61     linux/x86/shell_reverse_tcp                         Connect back to attacker and spawn a command shell
62     linux/x86/shell_reverse_tcp2                        Connect back to attacker and spawn a command shell

真他妈的多

 

平台:osx(mac电脑的系统吗:) ) ,可用payload:

 1     osx/armle/execute/bind_tcp                          Spawn a command shell (staged). Listen for a connection
 2     osx/armle/execute/reverse_tcp                       Spawn a command shell (staged). Connect back to the attacker
 3     osx/armle/shell/bind_tcp                            Spawn a command shell (staged). Listen for a connection
 4     osx/armle/shell/reverse_tcp                         Spawn a command shell (staged). Connect back to the attacker
 5     osx/armle/shell_bind_tcp                            Listen for a connection and spawn a command shell
 6     osx/armle/shell_reverse_tcp                         Connect back to attacker and spawn a command shell
 7     osx/armle/vibrate                                   Causes the iPhone to vibrate, only works when the AudioToolkit library has been loaded. Based on work by Charlie Miller <cmiller[at]securityevaluators.com>.
 8     osx/ppc/shell/bind_tcp                              Spawn a command shell (staged). Listen for a connection
 9     osx/ppc/shell/find_tag                              Spawn a command shell (staged). Use an established connection
10     osx/ppc/shell/reverse_tcp                           Spawn a command shell (staged). Connect back to the attacker
11     osx/ppc/shell_bind_tcp                              Listen for a connection and spawn a command shell
12     osx/ppc/shell_reverse_tcp                           Connect back to attacker and spawn a command shell
13     osx/x64/dupandexecve/bind_tcp                       dup2 socket in edi, then execve. Listen, read length, read buffer, execute
14     osx/x64/dupandexecve/reverse_tcp                    dup2 socket in edi, then execve. Connect, read length, read buffer, execute
15     osx/x64/exec                                        Execute an arbitrary command
16     osx/x64/say                                         Say an arbitrary string outloud using Mac OS X text2speech
17     osx/x64/shell_bind_tcp                              Bind an arbitrary command to an arbitrary port
18     osx/x64/shell_find_tag                              Spawn a shell on an established connection (proxy/nat safe)
19     osx/x64/shell_reverse_tcp                           Connect back to attacker and spawn a command shell
20     osx/x86/bundleinject/bind_tcp                       Inject a custom Mach-O bundle into the exploited process. Listen, read length, read buffer, execute
21     osx/x86/bundleinject/reverse_tcp                    Inject a custom Mach-O bundle into the exploited process. Connect, read length, read buffer, execute
22     osx/x86/exec                                        Execute an arbitrary command
23     osx/x86/isight/bind_tcp                             Inject a Mach-O bundle to capture a photo from the iSight (staged). Listen, read length, read buffer, execute
24     osx/x86/isight/reverse_tcp                          Inject a Mach-O bundle to capture a photo from the iSight (staged). Connect, read length, read buffer, execute
25     osx/x86/shell_bind_tcp                              Listen for a connection and spawn a command shell
26     osx/x86/shell_find_port                             Spawn a shell on an established connection
27     osx/x86/shell_reverse_tcp                           Connect back to attacker and spawn a command shell
28     osx/x86/vforkshell/bind_tcp                         Call vfork() if necessary and spawn a command shell (staged). Listen, read length, read buffer, execute
29     osx/x86/vforkshell/reverse_tcp                      Call vfork() if necessary and spawn a command shell (staged). Connect, read length, read buffer, execute
30     osx/x86/vforkshell_bind_tcp                         Listen for a connection, vfork if necessary, and spawn a command shell
31     osx/x86/vforkshell_reverse_tcp                      Connect back to attacker, vfork if necessary, and spawn a command shell

挺想用用这个payload做实验呢,就是找不到mac电脑~~~

 

运行环境:python,php,ruby, 可用Payload:

 1     php/bind_perl                                       Listen for a connection and spawn a command shell via perl (persistent)
 2     php/bind_perl_ipv6                                  Listen for a connection and spawn a command shell via perl (persistent) over IPv6
 3     php/bind_php                                        Listen for a connection and spawn a command shell via php
 4     php/bind_php_ipv6                                   Listen for a connection and spawn a command shell via php (IPv6)
 5     php/download_exec                                   Download an EXE from an HTTP URL and execute it
 6     php/exec                                            Execute a single system command
 7     php/meterpreter/bind_tcp                            Run a meterpreter server in PHP. Listen for a connection
 8     php/meterpreter/bind_tcp_ipv6                       Run a meterpreter server in PHP. Listen for a connection over IPv6
 9     php/meterpreter/bind_tcp_ipv6_uuid                  Run a meterpreter server in PHP. Listen for a connection over IPv6 with UUID Support
10     php/meterpreter/bind_tcp_uuid                       Run a meterpreter server in PHP. Listen for a connection with UUID Support
11     php/meterpreter/reverse_tcp                         Run a meterpreter server in PHP. Reverse PHP connect back stager with checks for disabled functions
12     php/meterpreter/reverse_tcp_uuid                    Run a meterpreter server in PHP. Reverse PHP connect back stager with checks for disabled functions
13     php/meterpreter_reverse_tcp                         Connect back to attacker and spawn a Meterpreter server (PHP)
14     php/reverse_perl                                    Creates an interactive shell via perl
15     php/reverse_php                                     Reverse PHP connect back shell with checks for disabled functions
16     php/shell_findsock                                  Spawn a shell on the established connection to the webserver. Unfortunately, this payload can leave conspicuous evil-looking entries in the apache error logs, so it is probably a good idea to use a bind or reverse shell unless firewalls prevent them from working. The issue this payload takes advantage of (CLOEXEC flag not set on sockets) appears to have been patched on the Ubuntu version of Apache and may not work on other Debian-based distributions. Only tested on Apache but it might work on other web servers that leak file descriptors to child processes.
17     python/meterpreter/bind_tcp                         Run a meterpreter server in Python (2.5-2.7 & 3.1-3.5). Listen for a connection
18     python/meterpreter/bind_tcp_uuid                    Run a meterpreter server in Python (2.5-2.7 & 3.1-3.5). Listen for a connection with UUID Support
19     python/meterpreter/reverse_http                     Run a meterpreter server in Python (2.5-2.7 & 3.1-3.5). Tunnel communication over HTTP
20     python/meterpreter/reverse_https                    Run a meterpreter server in Python (2.5-2.7 & 3.1-3.5). Tunnel communication over HTTP using SSL
21     python/meterpreter/reverse_tcp                      Run a meterpreter server in Python (2.5-2.7 & 3.1-3.5). Connect back to the attacker
22     python/meterpreter/reverse_tcp_uuid                 Run a meterpreter server in Python (2.5-2.7 & 3.1-3.5). Connect back to the attacker with UUID Support
23     python/meterpreter_bind_tcp                         Connect to the victim and spawn a Meterpreter shell
24     python/meterpreter_reverse_http                     Connect back to the attacker and spawn a Meterpreter shell
25     python/meterpreter_reverse_https                    Connect back to the attacker and spawn a Meterpreter shell
26     python/meterpreter_reverse_tcp                      Connect back to the attacker and spawn a Meterpreter shell
27     python/shell_reverse_tcp                            Creates an interactive shell via python, encodes with base64 by design. Compatible with Python 2.3.3
28     python/shell_reverse_tcp_ssl                        Creates an interactive shell via python, uses SSL, encodes with base64 by design.
29     ruby/shell_bind_tcp                                 Continually listen for a connection and spawn a command shell via Ruby
30     ruby/shell_bind_tcp_ipv6                            Continually listen for a connection and spawn a command shell via Ruby
31     ruby/shell_reverse_tcp                              Connect back and create a command shell via Ruby
32     ruby/shell_reverse_tcp_ssl                          Connect back and create a command shell via Ruby, uses SSL

 

重点来了 Windows:

  1  windows/adduser                                     Create a new user and add them to local administration group. Note: The specified password is checked for common complexity requirements to prevent the target machine rejecting the user for failing to meet policy requirements. Complexity check: 8-14 chars (1 UPPER, 1 lower, 1 digit/special)
  2     windows/dllinject/bind_hidden_ipknock_tcp           Inject a DLL via a reflective loader. Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method (you can spoof it with tools like hping). After that you could get your shellcode from any IP. The socket will appear as "closed," thus helping to hide the shellcode
  3     windows/dllinject/bind_hidden_tcp                   Inject a DLL via a reflective loader. Listen for a connection from a hidden port and spawn a command shell to the allowed host.
  4     windows/dllinject/bind_ipv6_tcp                     Inject a DLL via a reflective loader. Listen for an IPv6 connection (Windows x86)
  5     windows/dllinject/bind_ipv6_tcp_uuid                Inject a DLL via a reflective loader. Listen for an IPv6 connection with UUID Support (Windows x86)
  6     windows/dllinject/bind_nonx_tcp                     Inject a DLL via a reflective loader. Listen for a connection (No NX)
  7     windows/dllinject/bind_tcp                          Inject a DLL via a reflective loader. Listen for a connection (Windows x86)
  8     windows/dllinject/bind_tcp_rc4                      Inject a DLL via a reflective loader. Listen for a connection
  9     windows/dllinject/bind_tcp_uuid                     Inject a DLL via a reflective loader. Listen for a connection with UUID Support (Windows x86)
 10     windows/dllinject/find_tag                          Inject a DLL via a reflective loader. Use an established connection
 11     windows/dllinject/reverse_hop_http                  Inject a DLL via a reflective loader. Tunnel communication over an HTTP or HTTPS hop point. Note that you must first upload data/hop/hop.php to the PHP server you wish to use as a hop.
 12     windows/dllinject/reverse_http                      Inject a DLL via a reflective loader. Tunnel communication over HTTP (Windows wininet)
 13     windows/dllinject/reverse_http_proxy_pstore         Inject a DLL via a reflective loader. Tunnel communication over HTTP
 14     windows/dllinject/reverse_ipv6_tcp                  Inject a DLL via a reflective loader. Connect back to the attacker over IPv6
 15     windows/dllinject/reverse_nonx_tcp                  Inject a DLL via a reflective loader. Connect back to the attacker (No NX)
 16     windows/dllinject/reverse_ord_tcp                   Inject a DLL via a reflective loader. Connect back to the attacker
 17     windows/dllinject/reverse_tcp                       Inject a DLL via a reflective loader. Connect back to the attacker
 18     windows/dllinject/reverse_tcp_allports              Inject a DLL via a reflective loader. Try to connect back to the attacker, on all possible ports (1-65535, slowly)
 19     windows/dllinject/reverse_tcp_dns                   Inject a DLL via a reflective loader. Connect back to the attacker
 20     windows/dllinject/reverse_tcp_rc4                   Inject a DLL via a reflective loader. Connect back to the attacker
 21     windows/dllinject/reverse_tcp_rc4_dns               Inject a DLL via a reflective loader. Connect back to the attacker
 22     windows/dllinject/reverse_tcp_uuid                  Inject a DLL via a reflective loader. Connect back to the attacker with UUID Support
 23     windows/dllinject/reverse_winhttp                   Inject a DLL via a reflective loader. Tunnel communication over HTTP (Windows winhttp)
 24     windows/dns_txt_query_exec                          Performs a TXT query against a series of DNS record(s) and executes the returned payload
 25     windows/download_exec                               Download an EXE from an HTTP(S)/FTP URL and execute it
 26     windows/exec                                        Execute an arbitrary command
 27     windows/format_all_drives                           This payload formats all mounted disks in Windows (aka ShellcodeOfDeath). After formatting, this payload sets the volume label to the string specified in the VOLUMELABEL option. If the code is unable to access a drive for any reason, it skips the drive and proceeds to the next volume.
 28     windows/loadlibrary                                 Load an arbitrary library path
 29     windows/messagebox                                  Spawns a dialog via MessageBox using a customizable title, text & icon
 30     windows/meterpreter/bind_hidden_ipknock_tcp         Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method (you can spoof it with tools like hping). After that you could get your shellcode from any IP. The socket will appear as "closed," thus helping to hide the shellcode
 31     windows/meterpreter/bind_hidden_tcp                 Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Listen for a connection from a hidden port and spawn a command shell to the allowed host.
 32     windows/meterpreter/bind_ipv6_tcp                   Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Listen for an IPv6 connection (Windows x86)
 33     windows/meterpreter/bind_ipv6_tcp_uuid              Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Listen for an IPv6 connection with UUID Support (Windows x86)
 34     windows/meterpreter/bind_nonx_tcp                   Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Listen for a connection (No NX)
 35     windows/meterpreter/bind_tcp                        Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Listen for a connection (Windows x86)
 36     windows/meterpreter/bind_tcp_rc4                    Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Listen for a connection
 37     windows/meterpreter/bind_tcp_uuid                   Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Listen for a connection with UUID Support (Windows x86)
 38     windows/meterpreter/find_tag                        Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Use an established connection
 39     windows/meterpreter/reverse_hop_http                Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Tunnel communication over an HTTP or HTTPS hop point. Note that you must first upload data/hop/hop.php to the PHP server you wish to use as a hop.
 40     windows/meterpreter/reverse_http                    Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Tunnel communication over HTTP (Windows wininet)
 41     windows/meterpreter/reverse_http_proxy_pstore       Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Tunnel communication over HTTP
 42     windows/meterpreter/reverse_https                   Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Tunnel communication over HTTPS (Windows wininet)
 43     windows/meterpreter/reverse_https_proxy             Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Tunnel communication over HTTP using SSL with custom proxy support
 44     windows/meterpreter/reverse_ipv6_tcp                Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Connect back to the attacker over IPv6
 45     windows/meterpreter/reverse_nonx_tcp                Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Connect back to the attacker (No NX)
 46     windows/meterpreter/reverse_ord_tcp                 Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Connect back to the attacker
 47     windows/meterpreter/reverse_tcp                     Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Connect back to the attacker
 48     windows/meterpreter/reverse_tcp_allports            Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Try to connect back to the attacker, on all possible ports (1-65535, slowly)
 49     windows/meterpreter/reverse_tcp_dns                 Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Connect back to the attacker
 50     windows/meterpreter/reverse_tcp_rc4                 Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Connect back to the attacker
 51     windows/meterpreter/reverse_tcp_rc4_dns             Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Connect back to the attacker
 52     windows/meterpreter/reverse_tcp_uuid                Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Connect back to the attacker with UUID Support
 53     windows/meterpreter/reverse_winhttp                 Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Tunnel communication over HTTP (Windows winhttp)
 54     windows/meterpreter/reverse_winhttps                Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged). Tunnel communication over HTTPS (Windows winhttp)
 55     windows/meterpreter_bind_tcp                        Connect to victim and spawn a Meterpreter shell
 56     windows/meterpreter_reverse_http                    Connect back to attacker and spawn a Meterpreter shell
 57     windows/meterpreter_reverse_https                   Connect back to attacker and spawn a Meterpreter shell
 58     windows/meterpreter_reverse_ipv6_tcp                Connect back to attacker and spawn a Meterpreter shell
 59     windows/meterpreter_reverse_tcp                     Connect back to attacker and spawn a Meterpreter shell
 60     windows/metsvc_bind_tcp                             Stub payload for interacting with a Meterpreter Service
 61     windows/metsvc_reverse_tcp                          Stub payload for interacting with a Meterpreter Service
 62     windows/patchupdllinject/bind_hidden_ipknock_tcp    Inject a custom DLL into the exploited process. Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method (you can spoof it with tools like hping). After that you could get your shellcode from any IP. The socket will appear as "closed," thus helping to hide the shellcode
 63     windows/patchupdllinject/bind_hidden_tcp            Inject a custom DLL into the exploited process. Listen for a connection from a hidden port and spawn a command shell to the allowed host.
 64     windows/patchupdllinject/bind_ipv6_tcp              Inject a custom DLL into the exploited process. Listen for an IPv6 connection (Windows x86)
 65     windows/patchupdllinject/bind_ipv6_tcp_uuid         Inject a custom DLL into the exploited process. Listen for an IPv6 connection with UUID Support (Windows x86)
 66     windows/patchupdllinject/bind_nonx_tcp              Inject a custom DLL into the exploited process. Listen for a connection (No NX)
 67     windows/patchupdllinject/bind_tcp                   Inject a custom DLL into the exploited process. Listen for a connection (Windows x86)
 68     windows/patchupdllinject/bind_tcp_rc4               Inject a custom DLL into the exploited process. Listen for a connection
 69     windows/patchupdllinject/bind_tcp_uuid              Inject a custom DLL into the exploited process. Listen for a connection with UUID Support (Windows x86)
 70     windows/patchupdllinject/find_tag                   Inject a custom DLL into the exploited process. Use an established connection
 71     windows/patchupdllinject/reverse_ipv6_tcp           Inject a custom DLL into the exploited process. Connect back to the attacker over IPv6
 72     windows/patchupdllinject/reverse_nonx_tcp           Inject a custom DLL into the exploited process. Connect back to the attacker (No NX)
 73     windows/patchupdllinject/reverse_ord_tcp            Inject a custom DLL into the exploited process. Connect back to the attacker
 74     windows/patchupdllinject/reverse_tcp                Inject a custom DLL into the exploited process. Connect back to the attacker
 75     windows/patchupdllinject/reverse_tcp_allports       Inject a custom DLL into the exploited process. Try to connect back to the attacker, on all possible ports (1-65535, slowly)
 76     windows/patchupdllinject/reverse_tcp_dns            Inject a custom DLL into the exploited process. Connect back to the attacker
 77     windows/patchupdllinject/reverse_tcp_rc4            Inject a custom DLL into the exploited process. Connect back to the attacker
 78     windows/patchupdllinject/reverse_tcp_rc4_dns        Inject a custom DLL into the exploited process. Connect back to the attacker
 79     windows/patchupdllinject/reverse_tcp_uuid           Inject a custom DLL into the exploited process. Connect back to the attacker with UUID Support
 80     windows/patchupmeterpreter/bind_hidden_ipknock_tcp  Inject the meterpreter server DLL (staged). Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method (you can spoof it with tools like hping). After that you could get your shellcode from any IP. The socket will appear as "closed," thus helping to hide the shellcode
 81     windows/patchupmeterpreter/bind_hidden_tcp          Inject the meterpreter server DLL (staged). Listen for a connection from a hidden port and spawn a command shell to the allowed host.
 82     windows/patchupmeterpreter/bind_ipv6_tcp            Inject the meterpreter server DLL (staged). Listen for an IPv6 connection (Windows x86)
 83     windows/patchupmeterpreter/bind_ipv6_tcp_uuid       Inject the meterpreter server DLL (staged). Listen for an IPv6 connection with UUID Support (Windows x86)
 84     windows/patchupmeterpreter/bind_nonx_tcp            Inject the meterpreter server DLL (staged). Listen for a connection (No NX)
 85     windows/patchupmeterpreter/bind_tcp                 Inject the meterpreter server DLL (staged). Listen for a connection (Windows x86)
 86     windows/patchupmeterpreter/bind_tcp_rc4             Inject the meterpreter server DLL (staged). Listen for a connection
 87     windows/patchupmeterpreter/bind_tcp_uuid            Inject the meterpreter server DLL (staged). Listen for a connection with UUID Support (Windows x86)
 88     windows/patchupmeterpreter/find_tag                 Inject the meterpreter server DLL (staged). Use an established connection
 89     windows/patchupmeterpreter/reverse_ipv6_tcp         Inject the meterpreter server DLL (staged). Connect back to the attacker over IPv6
 90     windows/patchupmeterpreter/reverse_nonx_tcp         Inject the meterpreter server DLL (staged). Connect back to the attacker (No NX)
 91     windows/patchupmeterpreter/reverse_ord_tcp          Inject the meterpreter server DLL (staged). Connect back to the attacker
 92     windows/patchupmeterpreter/reverse_tcp              Inject the meterpreter server DLL (staged). Connect back to the attacker
 93     windows/patchupmeterpreter/reverse_tcp_allports     Inject the meterpreter server DLL (staged). Try to connect back to the attacker, on all possible ports (1-65535, slowly)
 94     windows/patchupmeterpreter/reverse_tcp_dns          Inject the meterpreter server DLL (staged). Connect back to the attacker
 95     windows/patchupmeterpreter/reverse_tcp_rc4          Inject the meterpreter server DLL (staged). Connect back to the attacker
 96     windows/patchupmeterpreter/reverse_tcp_rc4_dns      Inject the meterpreter server DLL (staged). Connect back to the attacker
 97     windows/patchupmeterpreter/reverse_tcp_uuid         Inject the meterpreter server DLL (staged). Connect back to the attacker with UUID Support
 98     windows/powershell_bind_tcp                         Listen for a connection and spawn an interactive powershell session
 99     windows/powershell_reverse_tcp                      Listen for a connection and spawn an interactive powershell session
100     windows/shell/bind_hidden_ipknock_tcp               Spawn a piped command shell (staged). Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method (you can spoof it with tools like hping). After that you could get your shellcode from any IP. The socket will appear as "closed," thus helping to hide the shellcode
101     windows/shell/bind_hidden_tcp                       Spawn a piped command shell (staged). Listen for a connection from a hidden port and spawn a command shell to the allowed host.
102     windows/shell/bind_ipv6_tcp                         Spawn a piped command shell (staged). Listen for an IPv6 connection (Windows x86)
103     windows/shell/bind_ipv6_tcp_uuid                    Spawn a piped command shell (staged). Listen for an IPv6 connection with UUID Support (Windows x86)
104     windows/shell/bind_nonx_tcp                         Spawn a piped command shell (staged). Listen for a connection (No NX)
105     windows/shell/bind_tcp                              Spawn a piped command shell (staged). Listen for a connection (Windows x86)
106     windows/shell/bind_tcp_rc4                          Spawn a piped command shell (staged). Listen for a connection
107     windows/shell/bind_tcp_uuid                         Spawn a piped command shell (staged). Listen for a connection with UUID Support (Windows x86)
108     windows/shell/find_tag                              Spawn a piped command shell (staged). Use an established connection
109     windows/shell/reverse_ipv6_tcp                      Spawn a piped command shell (staged). Connect back to the attacker over IPv6
110     windows/shell/reverse_nonx_tcp                      Spawn a piped command shell (staged). Connect back to the attacker (No NX)
111     windows/shell/reverse_ord_tcp                       Spawn a piped command shell (staged). Connect back to the attacker
112     windows/shell/reverse_tcp                           Spawn a piped command shell (staged). Connect back to the attacker
113     windows/shell/reverse_tcp_allports                  Spawn a piped command shell (staged). Try to connect back to the attacker, on all possible ports (1-65535, slowly)
114     windows/shell/reverse_tcp_dns                       Spawn a piped command shell (staged). Connect back to the attacker
115     windows/shell/reverse_tcp_rc4                       Spawn a piped command shell (staged). Connect back to the attacker
116     windows/shell/reverse_tcp_rc4_dns                   Spawn a piped command shell (staged). Connect back to the attacker
117     windows/shell/reverse_tcp_uuid                      Spawn a piped command shell (staged). Connect back to the attacker with UUID Support
118     windows/shell_bind_tcp                              Listen for a connection and spawn a command shell
119     windows/shell_bind_tcp_xpfw                         Disable the Windows ICF, then listen for a connection and spawn a command shell
120     windows/shell_hidden_bind_tcp                       Listen for a connection from certain IP and spawn a command shell. The shellcode will reply with a RST packet if the connections is not comming from the IP defined in AHOST. This way the port will appear as "closed" helping us to hide the shellcode.
121     windows/shell_reverse_tcp                           Connect back to attacker and spawn a command shell
122     windows/speak_pwned                                 Causes the target to say "You Got Pwned" via the Windows Speech API
123     windows/upexec/bind_hidden_ipknock_tcp              Uploads an executable and runs it (staged). Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method (you can spoof it with tools like hping). After that you could get your shellcode from any IP. The socket will appear as "closed," thus helping to hide the shellcode
124     windows/upexec/bind_hidden_tcp                      Uploads an executable and runs it (staged). Listen for a connection from a hidden port and spawn a command shell to the allowed host.
125     windows/upexec/bind_ipv6_tcp                        Uploads an executable and runs it (staged). Listen for an IPv6 connection (Windows x86)
126     windows/upexec/bind_ipv6_tcp_uuid                   Uploads an executable and runs it (staged). Listen for an IPv6 connection with UUID Support (Windows x86)
127     windows/upexec/bind_nonx_tcp                        Uploads an executable and runs it (staged). Listen for a connection (No NX)
128     windows/upexec/bind_tcp                             Uploads an executable and runs it (staged). Listen for a connection (Windows x86)
129     windows/upexec/bind_tcp_rc4                         Uploads an executable and runs it (staged). Listen for a connection
130     windows/upexec/bind_tcp_uuid                        Uploads an executable and runs it (staged). Listen for a connection with UUID Support (Windows x86)
131     windows/upexec/find_tag                             Uploads an executable and runs it (staged). Use an established connection
132     windows/upexec/reverse_ipv6_tcp                     Uploads an executable and runs it (staged). Connect back to the attacker over IPv6
133     windows/upexec/reverse_nonx_tcp                     Uploads an executable and runs it (staged). Connect back to the attacker (No NX)
134     windows/upexec/reverse_ord_tcp                      Uploads an executable and runs it (staged). Connect back to the attacker
135     windows/upexec/reverse_tcp                          Uploads an executable and runs it (staged). Connect back to the attacker
136     windows/upexec/reverse_tcp_allports                 Uploads an executable and runs it (staged). Try to connect back to the attacker, on all possible ports (1-65535, slowly)
137     windows/upexec/reverse_tcp_dns                      Uploads an executable and runs it (staged). Connect back to the attacker
138     windows/upexec/reverse_tcp_rc4                      Uploads an executable and runs it (staged). Connect back to the attacker
139     windows/upexec/reverse_tcp_rc4_dns                  Uploads an executable and runs it (staged). Connect back to the attacker
140     windows/upexec/reverse_tcp_uuid                     Uploads an executable and runs it (staged). Connect back to the attacker with UUID Support
141     windows/vncinject/bind_hidden_ipknock_tcp           Inject a VNC Dll via a reflective loader (staged). Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method (you can spoof it with tools like hping). After that you could get your shellcode from any IP. The socket will appear as "closed," thus helping to hide the shellcode
142     windows/vncinject/bind_hidden_tcp                   Inject a VNC Dll via a reflective loader (staged). Listen for a connection from a hidden port and spawn a command shell to the allowed host.
143     windows/vncinject/bind_ipv6_tcp                     Inject a VNC Dll via a reflective loader (staged). Listen for an IPv6 connection (Windows x86)
144     windows/vncinject/bind_ipv6_tcp_uuid                Inject a VNC Dll via a reflective loader (staged). Listen for an IPv6 connection with UUID Support (Windows x86)
145     windows/vncinject/bind_nonx_tcp                     Inject a VNC Dll via a reflective loader (staged). Listen for a connection (No NX)
146     windows/vncinject/bind_tcp                          Inject a VNC Dll via a reflective loader (staged). Listen for a connection (Windows x86)
147     windows/vncinject/bind_tcp_rc4                      Inject a VNC Dll via a reflective loader (staged). Listen for a connection
148     windows/vncinject/bind_tcp_uuid                     Inject a VNC Dll via a reflective loader (staged). Listen for a connection with UUID Support (Windows x86)
149     windows/vncinject/find_tag                          Inject a VNC Dll via a reflective loader (staged). Use an established connection
150     windows/vncinject/reverse_hop_http                  Inject a VNC Dll via a reflective loader (staged). Tunnel communication over an HTTP or HTTPS hop point. Note that you must first upload data/hop/hop.php to the PHP server you wish to use as a hop.
151     windows/vncinject/reverse_http                      Inject a VNC Dll via a reflective loader (staged). Tunnel communication over HTTP (Windows wininet)
152     windows/vncinject/reverse_http_proxy_pstore         Inject a VNC Dll via a reflective loader (staged). Tunnel communication over HTTP
153     windows/vncinject/reverse_ipv6_tcp                  Inject a VNC Dll via a reflective loader (staged). Connect back to the attacker over IPv6
154     windows/vncinject/reverse_nonx_tcp                  Inject a VNC Dll via a reflective loader (staged). Connect back to the attacker (No NX)
155     windows/vncinject/reverse_ord_tcp                   Inject a VNC Dll via a reflective loader (staged). Connect back to the attacker
156     windows/vncinject/reverse_tcp                       Inject a VNC Dll via a reflective loader (staged). Connect back to the attacker
157     windows/vncinject/reverse_tcp_allports              Inject a VNC Dll via a reflective loader (staged). Try to connect back to the attacker, on all possible ports (1-65535, slowly)
158     windows/vncinject/reverse_tcp_dns                   Inject a VNC Dll via a reflective loader (staged). Connect back to the attacker
159     windows/vncinject/reverse_tcp_rc4                   Inject a VNC Dll via a reflective loader (staged). Connect back to the attacker
160     windows/vncinject/reverse_tcp_rc4_dns               Inject a VNC Dll via a reflective loader (staged). Connect back to the attacker
161     windows/vncinject/reverse_tcp_uuid                  Inject a VNC Dll via a reflective loader (staged). Connect back to the attacker with UUID Support
162     windows/vncinject/reverse_winhttp                   Inject a VNC Dll via a reflective loader (staged). Tunnel communication over HTTP (Windows winhttp)
163     windows/x64/exec                                    Execute an arbitrary command (Windows x64)
164     windows/x64/loadlibrary                             Load an arbitrary x64 library path
165     windows/x64/meterpreter/bind_ipv6_tcp               Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Listen for an IPv6 connection (Windows x64)
166     windows/x64/meterpreter/bind_ipv6_tcp_uuid          Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Listen for an IPv6 connection with UUID Support (Windows x64)
167     windows/x64/meterpreter/bind_tcp                    Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Listen for a connection (Windows x64)
168     windows/x64/meterpreter/bind_tcp_uuid               Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Listen for a connection with UUID Support (Windows x64)
169     windows/x64/meterpreter/reverse_http                Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Tunnel communication over HTTP (Windows x64 wininet)
170     windows/x64/meterpreter/reverse_https               Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Tunnel communication over HTTP (Windows x64 wininet)
171     windows/x64/meterpreter/reverse_tcp                 Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Connect back to the attacker (Windows x64)
172     windows/x64/meterpreter/reverse_tcp_uuid            Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Connect back to the attacker with UUID Support (Windows x64)
173     windows/x64/meterpreter/reverse_winhttp             Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Tunnel communication over HTTP (Windows x64 winhttp)
174     windows/x64/meterpreter/reverse_winhttps            Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Tunnel communication over HTTPS (Windows x64 winhttp)
175     windows/x64/meterpreter_bind_tcp                    Connect to victim and spawn a Meterpreter shell
176     windows/x64/meterpreter_reverse_http                Connect back to attacker and spawn a Meterpreter shell
177     windows/x64/meterpreter_reverse_https               Connect back to attacker and spawn a Meterpreter shell
178     windows/x64/meterpreter_reverse_ipv6_tcp            Connect back to attacker and spawn a Meterpreter shell
179     windows/x64/meterpreter_reverse_tcp                 Connect back to attacker and spawn a Meterpreter shell
180     windows/x64/powershell_bind_tcp                     Listen for a connection and spawn an interactive powershell session
181     windows/x64/powershell_reverse_tcp                  Listen for a connection and spawn an interactive powershell session
182     windows/x64/shell/bind_ipv6_tcp                     Spawn a piped command shell (Windows x64) (staged). Listen for an IPv6 connection (Windows x64)
183     windows/x64/shell/bind_ipv6_tcp_uuid                Spawn a piped command shell (Windows x64) (staged). Listen for an IPv6 connection with UUID Support (Windows x64)
184     windows/x64/shell/bind_tcp                          Spawn a piped command shell (Windows x64) (staged). Listen for a connection (Windows x64)
185     windows/x64/shell/bind_tcp_uuid                     Spawn a piped command shell (Windows x64) (staged). Listen for a connection with UUID Support (Windows x64)
186     windows/x64/shell/reverse_tcp                       Spawn a piped command shell (Windows x64) (staged). Connect back to the attacker (Windows x64)
187     windows/x64/shell/reverse_tcp_uuid                  Spawn a piped command shell (Windows x64) (staged). Connect back to the attacker with UUID Support (Windows x64)
188     windows/x64/shell_bind_tcp                          Listen for a connection and spawn a command shell (Windows x64)
189     windows/x64/shell_reverse_tcp                       Connect back to attacker and spawn a command shell (Windows x64)
190     windows/x64/vncinject/bind_ipv6_tcp                 Inject a VNC Dll via a reflective loader (Windows x64) (staged). Listen for an IPv6 connection (Windows x64)
191     windows/x64/vncinject/bind_ipv6_tcp_uuid            Inject a VNC Dll via a reflective loader (Windows x64) (staged). Listen for an IPv6 connection with UUID Support (Windows x64)
192     windows/x64/vncinject/bind_tcp                      Inject a VNC Dll via a reflective loader (Windows x64) (staged). Listen for a connection (Windows x64)
193     windows/x64/vncinject/bind_tcp_uuid                 Inject a VNC Dll via a reflective loader (Windows x64) (staged). Listen for a connection with UUID Support (Windows x64)
194     windows/x64/vncinject/reverse_http                  Inject a VNC Dll via a reflective loader (Windows x64) (staged). Tunnel communication over HTTP (Windows x64 wininet)
195     windows/x64/vncinject/reverse_https                 Inject a VNC Dll via a reflective loader (Windows x64) (staged). Tunnel communication over HTTP (Windows x64 wininet)
196     windows/x64/vncinject/reverse_tcp                   Inject a VNC Dll via a reflective loader (Windows x64) (staged). Connect back to the attacker (Windows x64)
197     windows/x64/vncinject/reverse_tcp_uuid              Inject a VNC Dll via a reflective loader (Windows x64) (staged). Connect back to the attacker with UUID Support (Windows x64)
198     windows/x64/vncinject/reverse_winhttp               Inject a VNC Dll via a reflective loader (Windows x64) (staged). Tunnel communication over HTTP (Windows x64 winhttp)
199     windows/x64/vncinject/reverse_winhttps              Inject a VNC Dll via a reflective loader (Windows x64) (staged). Tunnel communication over HTTPS (Windows x64 winhttp)

 

 

 

Msfvenom 学习笔记与总结

标签:

原文地址:http://www.cnblogs.com/dire/p/5230298.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!