Skip to content

Conversation

@zeroSteiner
Copy link
Contributor

This makes a change to the preferred list of payloads inspired by the exploit added in #20747. In that PR it was noticed that the payload was defaulting to AARCH64 when it wasn't specified and that's not as common of an architecture as x86 / x64. The changes in this PR will prioritize the 32-bit Windows meterpreter when it's compatible. 64-bit version of Windows always support 32-bit code execution AFAIK. The same isn't true for Linux though, so in cases where the 32-bit version of the Windows Meterpreter isn't compatible, we'll default to an x64 meterpreter for any platform.

Testing

  • Use a couple of exploits and see that the automatically selected payload is reasonable. For advanced testing, you could make a mock module and toggle the different platform and architecture options to see how they affect the automatic selection.

@zeroSteiner zeroSteiner marked this pull request as ready for review December 12, 2025 20:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant