打算通过批量生成进行编码后的payload作为数据集，进行训练自动提取IOC规则。或者自动训练出分类器进行识别。当然脚本中我不仅采用了不同的编码格式还采用了不同的文件格式，其实也可以不需要。不过目前只是针对linux平台的做了输出。将$(grep linux $PAYLOADSLIST)替换为$(cat $PAYLOADSLIST)即可输出所有。

关键的命令无非是分别列出各项支持的条目，然后进行输出。

msfvenom -l formats
msfvenom -l encoders
msfvenom -l payloads

完整脚本如下，根绝自需修改。


#!/usr/bin/env bash

ENCODERSLIST='encoders.list'
PAYLOADSLIST='payloads.list'
# also you can use `msfvenom -l formats` to generator your encodeformat
ENCODEFORMAT='bash sh c java perl pl powershell ps1 py python rb ruby vbscript'

mkdir -p linux
mkdir -p windows
mkdir -p osx
mkdir -p android

echo "[*] Generator your encoders list file"
msfvenom -l encoders | awk '{print $1}' | sed '1,6d' > $ENCODERSLIST

echo "[*] Generator your payloads list file"
msfvenom -l payloads | awk '{print $1}' | sed '1,6d' > $PAYLOADSLIST

for linuxpayload in  $(grep linux $PAYLOADSLIST)
do
    for format in $ENCODEFORMAT
    do
        echo "[+] Generate payloads from: $linuxpayload"
        for encoder in $(cat $ENCODERSLIST)
        do
            fpath=`echo "$linuxpayload"_"$encoder"."$format" | sed -e "s/\//\_/g"`
            msfvenom -p $linuxpayload -e $encoder -f $format -o linux/$fpath
        done
    done
done

References

How-to-use-msfvenom

mylamour / blog

metasploit批量生成payload #47

References