Initial support for Malleable C2 Profiles in Windows Metepreter - #759
Merged
Conversation
Removing warnings as well as making the builds work properly outside of Visual Studio and docker.
Makes sure that things build correctly across environments.
Not read for push, some sections removed to avoid the pain of dev until the rest of the work is done.
More to do, and transport stuff needs to be updated to include the C2 configuration options.
This actually stages/works as expected now. More fields to map, more work to do. More configuration to handle. Then the changes need to also be moved over to the WININET fallback version when done. Still need to handle encoding as well.
* Packet prefixes and suffixes now work as expected (at least outbound), more work to do to support inbound. * Validated that migration works. * Support encryption key transmission across migration (need to confirm if this is required).
Referrer and accept type headers no longer separate, despite what the APIs say they do support inclusion of them with custom headers. Skip counts now included so the incoming packets can be prefixed in the C2 profile. Various other code tidies/adjustments.
Various tweaks to support it on the server side as well.
Merged
20 tasks
POST requests were being killed off before reading the response. This fixes that issue.
Contributor
Author
|
Hey @smcintyre-r7 or @dledda-r7 could you have a quick look at the windows-2022 target for the visual studio build in the github actions? I changed from |
C2 encoding now supported in the GET/POST based on the C2 configuration. Changed up the way the body of an HTTP response is read, so that the content length header is used instead. This means we can read in the entire buffer, remove prefixes/suffixes and do decoding before passing this on. Prior to this, we were using the packet header to figure out how much data to read, and that doesn't makes sense any more.
dledda-r7
reviewed
Aug 4, 2025
Contributor
Author
|
@dledda-r7 is there a way of getting the |
Contributor
|
@OJ I think there is, looking up on google looks like VS2022 doesn't have XP support, but currently I am able to compiler metsrv with 141_xp on VS22. I think the steps could be:
Create a file named: There is some stuff more, like ARM64 but i think it's fine, we are going to need it at some point.
|
Contributor
Author
Correct me if I'm wrong, but would this not cause the container to be updated every time we ran a build? And if so, is that a problem? |
Contributor
|
You are not wrong. the alternative would be having local runners but I am not sure we can go through that way, also including @adfoster-r7 to the loop as probably he has more knowladge on CI/CD than me. |
dledda-r7
reviewed
Aug 12, 2025
Contributor
|
Just to keep this in the loop #761 |
Contributor
|
Hey @OJ , I have tried metsrv and it work fine with Windows 10, however i tried to test it against older systems and on windows 7 it does a weird bug: We can sync in Metasploit slack if you need more details, i can prepare the debug log and share it over if is useful? |
Contributor
Author
|
Hey @dledda-r7 I'll spin up a Windows 7 VM and have a look. But if you're happy to share some details that'd be great. Thanks! |
Contributor
|
I just checked as well. I used psexec to deliver a |
Contributor
Author
|
I admit I haven't looked at non-native windows yet because I wanted to make sure that the approach we're taking is ok. |
Contributor
Author
|
But non-modified payloads should still work, so that's on me :) |
Contributor
|
@OJ we updated the GitHub runners. Now is working with Visual Studio 2022. |
Contributor
Author
|
Excellent, thanks! |
This moves the Java Meterpreter inline with the new config block which is now a set of TLVs instead of the former static block.
Contributor
|
@zeroSteiner, I've updated the TODO on the PR, IIRC on the PHP meterpreter nothing was needed because there is no HTTP stager / transport. Should we do at least the porting of the TLV values to avoid having incosistency among the other meterpreters? |
Contributor
|
@dledda-r7 I don't think there's any more work to do on PHP. I switched the one TLV constant that needed to be switched in zeroSteiner@a42e962#diff-e7dda2cb450fafb8131b3c7918aa29e070f138cefdc5f27d8d67aecea08cc2b4 ( We can and maybe should look at adding an HTTP transport for PHP in the future but we don't need to block on that now. |
Windows 7 doesn't come with this option for use with the CryptStringToBinaryA or CryptBinaryToStringA functions. This was introduced in Windows 10. So we've got a custom implementation of this so that we know we have a working version that doesn't cause things to break on Windows 7.
This is cherry picked from the main branch just to get things going.
Contributor
Author
|
Hey @dledda-r7 @smcintyre-r7 the build actually works now, after my copy/paste of your working configs. This version appears to work for me on Windows 7 and Windows 2012 R2 (without the SPs). If you get a sec would you mind giving some thoughts? I'll be working on the other Meterpreter implementations next to get things up to speed. Thank you! |
Contributor
|
Will check it out ASAP! amazing work! |
dledda-r7
reviewed
Mar 23, 2026
Contributor
Windows 7 SP0 x64 - MinGW binaryWindows 23H2 x64 - MinGWWindows 7 SP0 x64 - MSVCWindows 11 23H2 - MSVCWindows 10 22H2 x86 - MSVCWindows 7 x86 - MSVCWindows 7 x86 - MinGWWindows 10 22H2 x86 - MinGW |
Contributor
Author
|
|
Contributor
|
Nice work as always @OJ |
Contributor
|
@OJ , I will ensure x64 is working well on Windows 7 and Windows 11 with DLLs compiled with MSVC and MinGW, i think the only missing piece is the x86 version and then we are good to go. |
Contributor
Author
|
@dledda-r7 Thank you sir! They appear to be working at this end, just need to get some more stuff tested to be sure. I've got the other Meterps mostly done too. I'll probably piggyback another PR on top of this one for those. |
dledda-r7
approved these changes
Mar 27, 2026
Contributor
Author
|
Thank you so much for all your help and support @dledda-r7 !! I appreciate the effort involved in getting this tested as well as helping me debug/fix/etc. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains a bunch of changes to support malleable C2 features stored in a
.profilefile (such as this).Given the nature of how Meterpreter works, and how payloads are generated, there are a lot of C2 profile features that can't be supported without drastic changes. The intent here is to focus on the transport-specific details around HTTP payloads.
For more information on what's supported, along with documentation, sample runs/etc, please see the associated Metasploit Framework PR.
In order to support the new features and configuration options the configuration block needed to change. Rather than expand on this rather rudimentary and outdated block of information, it was decided that the config block should be converted to a TLV Packet. That has been done as part of this PR, and is obviously a breaking change, and hence isn't backwards compatible.
This took a lot longer than I had hoped, so as of yet the other Meterpreters haven't been modified.
TODO: