6.5.0 prerelease build

Gemfile.lock

@@ -61,9 +61,9 @@ PATH
       metasploit-concern
       metasploit-credential (>= 6.0.21)
       metasploit-model
-      metasploit-payloads (= 2.0.245)
+      metasploit-payloads (= 2.0.246.pre.3)
       metasploit_data_models (>= 6.0.15)
-      metasploit_payloads-mettle (= 1.0.46)
+      metasploit_payloads-mettle (= 1.0.48.pre.2)
       mqtt
       msgpack (~> 1.6.0)
       mutex_m
@@ -369,7 +369,7 @@ GEM
       drb
       mutex_m
       railties (>= 7.0, < 8.1)
-    metasploit-payloads (2.0.245)
+    metasploit-payloads (2.0.246.pre.3)
     metasploit_data_models (6.0.18)
       activerecord (>= 7.0, < 8.1)
       activesupport (>= 7.0, < 8.1)
@@ -383,7 +383,7 @@ GEM
       railties (>= 7.0, < 8.1)
       recog
       webrick
-    metasploit_payloads-mettle (1.0.46)
+    metasploit_payloads-mettle (1.0.48.pre.2)
     method_source (1.1.0)
     mime-types (3.7.0)
       logger

db/modules_metadata_base.json

@@ -66658,7 +66658,7 @@
     "disclosure_date": null,
     "type": "encoder",
     "author": [
-      "OJ Reeves <oj@buffered.io>"
+      "OJ Reeves"
     ],
     "description": "Encodes a payload using a series of SUB instructions and writing the\n        encoded value to ESP. This concept is based on the known SUB encoding\n        approach that is widely used to manually encode payloads with very\n        restricted allowed character sets. It will not reset EAX to zero unless\n        absolutely necessary, which helps reduce the payload by 10 bytes for\n        every 4-byte chunk. ADD support hasn't been included as the SUB\n        instruction is more likely to avoid bad characters anyway.\n\n        The payload requires a base register to work off which gives the start\n        location of the encoder payload in memory. If not specified, it defaults\n        to ESP. If the given register doesn't point exactly to the start of the\n        payload then an offset value is also required.\n\n        Note: Due to the fact that many payloads use the FSTENV approach to\n        get the current location in memory there is an option to protect the\n        start of the payload by setting the 'OverwriteProtect' flag to true.\n        This adds 3-bytes to the start of the payload to bump ESP by 32 bytes\n        so that it's clear of the top of the payload.",
     "references": [],
@@ -86684,7 +86684,7 @@
     "disclosure_date": "2015-03-01",
     "type": "exploit",
     "author": [
-      "OJ Reeves <oj@beyondbinary.io>"
+      "OJ Reeves"
     ],
     "description": "Some Seagate Business NAS devices are vulnerable to command execution via a local\n          file include vulnerability hidden in the language parameter of the CodeIgniter\n          session cookie. The vulnerability manifests in the way the language files are\n          included in the code on the login page, and hence is open to attack from users\n          without the need for authentication. The cookie can be easily decrypted using a\n          known static encryption key and re-encrypted once the PHP object string has been\n          modified.\n\n          This module has been tested on the STBN300 device.",
     "references": [
@@ -189649,7 +189649,7 @@
     "author": [
       "superkojiman",
       "PsychoSpy <neinwechter@gmail.com>",
-      "OJ Reeves <oj@buffered.io>"
+      "OJ Reeves"
     ],
     "description": "This module exploits a stack based buffer overflow in Ultra Mini HTTPD 1.21,\n          allowing remote attackers to execute arbitrary code via a long resource name in an HTTP\n          request. This exploit has to deal with the fact that the application's request handler\n          thread is terminated after 60 seconds by a \"monitor\" thread. To do this, it allocates\n          some RWX memory, copies the payload to it and creates another thread. When done, it\n          terminates the current thread so that it doesn't crash and hence doesn't bring down\n          the process with it.",
     "references": [
@@ -207276,7 +207276,7 @@
     "author": [
       "Sean Dillon <sean.dillon@risksense.com>",
       "Ryan Hanson",
-      "OJ Reeves <oj@beyondbinary.io>",
+      "OJ Reeves",
       "Brent Cook <bcook@rapid7.com>"
     ],
     "description": "The RDP termdd.sys driver improperly handles binds to internal-only channel MS_T120,\n          allowing a malformed Disconnect Provider Indication message to cause use-after-free.\n          With a controllable data/size remote nonpaged pool spray, an indirect call gadget of\n          the freed channel is used to achieve arbitrary code execution.\n\n          Windows 7 SP1 and Windows Server 2008 R2 are the only currently supported targets.\n\n          Windows 7 SP1 should be exploitable in its default configuration, assuming your target\n          selection is correctly matched to the system's memory layout.\n\n          HKLM\\SYSTEM\\CurrentControlSet\\Control\\TerminalServer\\Winstations\\RDP-Tcp\\fDisableCam\n          *needs* to be set to 0 for exploitation to succeed against Windows Server 2008 R2.\n          This is a non-standard configuration for normal servers, and the target will crash if\n          the aforementioned Registry key is not set!\n\n          If the target is crashing regardless, you will likely need to determine the non-paged\n          pool base in kernel memory and set it as the GROOMBASE option.",
@@ -311249,4 +311249,4 @@
     "needs_cleanup": null,
     "actions": []
   }
-}
+}

lib/msf/base/sessions/mettle_config.rb

@@ -96,15 +96,61 @@ def generate_config(opts = {})
 
         opts[:uuid] ||= generate_payload_uuid
 
-        case opts[:scheme]
-        when 'http'
-          opts[:uri] = generate_http_uri(transport_config_reverse_http(opts))
-        when 'https'
-          opts[:uri] = generate_http_uri(transport_config_reverse_https(opts))
-        when 'tcp'
-          opts[:uri] = generate_tcp_uri(transport_config_reverse_tcp(opts))
-        else
-          raise ArgumentError, "Unknown scheme: #{opts[:scheme]}"
+        unless opts[:transport_config]
+          if opts[:stageless] == true
+            case opts[:scheme]
+            when 'http'
+              opts[:transport_config] = [transport_config_reverse_http(opts)]
+            when 'https'
+              opts[:transport_config] = [transport_config_reverse_https(opts)]
+            when 'tcp'
+              opts[:transport_config] = [transport_config_reverse_tcp(opts)]
+            else
+              raise ArgumentError, "Unknown scheme: #{opts[:scheme]}"
+            end
+          else
+            # Staged payloads inherit the stager's socket (fd transport);
+            # the stage must not synthesise its own C2 transport. Use an
+            # explicit empty array ([] is truthy, so the build is skipped).
+            opts[:transport_config] = []
+          end
+        end
+
+        # Generate the TLV config block
+        config_opts = {
+          ascii_str:         true,
+          null_session_guid: opts[:stageless] == true,
+          expiration:        (ds[:expiration] || ds['SessionExpirationTimeout']).to_i,
+          uuid:              opts[:uuid],
+          transports:        opts[:transport_config],
+          extensions:        opts[:extensions] || [],
+          ext_format:        'bin',
+          mettle_platform:   opts[:mettle_platform],
+          stageless:         opts[:stageless] == true,
+        }.merge(meterpreter_logging_config(opts))
+
+        config = Rex::Payloads::Meterpreter::Config.new(config_opts)
+        opts[:config_block] = config.to_b
+
+        # Mettle reserves a fixed 8 KB slot in the binary for the config
+        # block. Catch the overflow here with a useful message instead of
+        # letting the gem's `to_binary` raise a generic "config block too
+        # large" -- baked-in EXTENSIONS= is the usual culprit.
+        if opts[:config_block].length > MetasploitPayloads::Mettle::CONFIG_BLOCK_MAX
+          raise ArgumentError, "Mettle config block (#{opts[:config_block].length} bytes) exceeds the #{MetasploitPayloads::Mettle::CONFIG_BLOCK_MAX}-byte embedded slot. " \
+            "Drop EXTENSIONS= and `load <ext>` once the session is up."
+        end
+
+        # Keep the legacy CLI config for backward compatibility during
+        # transition. Skipped for staged payloads, which have no transport.
+        transport = opts[:transport_config].first
+        if transport
+          case opts[:scheme]
+          when 'http', 'https'
+            opts[:uri] = generate_http_uri(transport)
+          when 'tcp'
+            opts[:uri] = generate_tcp_uri(transport)
+          end
         end
 
         opts[:uuid] = Base64.encode64(opts[:uuid].to_raw).strip
@@ -114,7 +160,7 @@ def generate_config(opts = {})
         end
         opts[:session_guid] = Base64.encode64(guid).strip
 
-        opts.slice(:uuid, :session_guid, :uri, :debug, :log_file, :name, :background)
+        opts.slice(:uuid, :session_guid, :uri, :debug, :log_file, :name, :background, :config_block)
       end
 
       # Stage encoding is not safe for Mettle (doesn't apply to stageless)