Hands-On Penetration Testing on Windows

Preparing your raw payload

Once again, we're revisiting the ever-gorgeous msfvenom. We're not doing anything new here, but if you're not coming here from Chapter 6, Advanced Exploitation with Metasploit, I recommend checking out the coverage of msfvenom first:

# msfvenom --payload windows/shell_bind_tcp --bad-chars '\x00' -f raw > shellcode.raw

Here, we have a quick and simple bind payload; this time, the target will be listening for our connection to spawn a shell. Note that I specified that null bytes should be avoided with --bad-chars, and that instead of generating an EXE file or any other special formatting, the -f raw parameter makes ...