Metasploit Penetration Testing Cookbook - Third Edition

Using MSFvenom to generate shellcode

We already read about MSFvenom and now we will use it again, but this time to generate custom shellcode that we can safely use in a PoC exploit. PoC exploits found online often use a bind shell, have hardcoded IP addresses, or simply open a calculator to prove code execution, which means that they may not fit your needs during a penetration test. For this reason, most of the time we need to replace the shellcode with our own code.

Shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called shellcode because most of the time it is used to launch a shell so that the attacker can control the compromised target.