Fix broken ssl server support on windows

[adfoster-r7]

Fixes a bug introduced by 04b35d4

Before 🔴

On windows the reverse https c2 malleable payload supports in 6.5 consistently failed:

[07/23/2026 10:32:19] [e(0)] core: Error in stream server server monitor: undefined method `sslsock' for #<Socket:0x000001b0e8493b90>

Call stack:
C:/metasploit/apps/pro/vendor/bundle/ruby/3.3.0/gems/rex-socket-0.1.70/lib/rex/socket/ssl_tcp_server.rb:75:in `rescue in accept'
C:/metasploit/apps/pro/vendor/bundle/ruby/3.3.0/gems/rex-socket-0.1.70/lib/rex/socket/ssl_tcp_server.rb:71:in `accept'
C:/metasploit/apps/pro/vendor/bundle/ruby/3.3.0/gems/rex-core-0.1.36/lib/rex/io/stream_server.rb:142:in `monitor_listener'
C:/metasploit/apps/pro/vendor/bundle/ruby/3.3.0/gems/rex-core-0.1.36/lib/rex/io/stream_server.rb:61:in `block in start'
C:/metasploit/apps/pro/vendor/bundle/ruby/3.3.0/bundler/gems/metasploit-framework-7e49ec9853e3/lib/rex/thread_factory.rb:22:in `block in spawn'
C:/metasploit/apps/pro/vendor/bundle/ruby/3.3.0/bundler/gems/metasploit-framework-7e49ec9853e3/lib/msf/core/thread_manager.rb:105:in `block in spawn'
C:/metasploit/apps/pro/vendor/bundle/ruby/3.3.0/gems/logging-2.4.0/lib/logging/diagnostic_context.rb:474:in `block in create_with_logging_context'

After 🍏

no stack trace, and shells:

[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
[+] [2026.07.23-11:19:42] Workspace:MalleableCleanup Beginning step 1/1 Exploiting 10.140.10.238 - Progress: 0%
[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
[*] [2026.07.23-11:19:43] Started HTTPS reverse handler on https://10.140.110.21:4455/
[*] [2026.07.23-11:19:43] 10.140.10.238:445 - Connecting to the server...
[*] [2026.07.23-11:19:43] 10.140.10.238:445 - Authenticating to 10.140.10.238:445 as user 'vagrant'...
[*] [2026.07.23-11:19:43] 10.140.10.238:445 - Selecting PowerShell target
[*] [2026.07.23-11:19:43] 10.140.10.238:445 - Executing the payload...
[+] [2026.07.23-11:19:44] 10.140.10.238:445 - Service start timed out, OK if running a command or non-service executable...
[*] [2026.07.23-11:19:50] https://10.140.110.21:4455/ handling request from 10.140.10.238; (UUID: ho8a24yp) Staging x86 payload (203962 bytes) ...
[*] [2026.07.23-11:20:42] Complete (1 session opened) exploit/windows/smb/psexec
[+] [2026.07.23-11:20:42] Workspace:MalleableCleanup Task Completed - Progress: 100%

[Copilot]

Pull request overview

Fixes Windows SSL TCP server accept retry logic by selecting on the in-progress OpenSSL::SSL::SSLSocket instead of an invalid self.sslsock reference, and adds regression specs to cover TLS accept behavior.

Changes:

• Fix SslTcpServer#accept non-blocking retry path to call IO.select on ssl (the SSLSocket being accepted) rather than self.sslsock.
• Add RSpec coverage for successful TLS accept, sequential accepts, non-blocking accept regression, and aborted-handshake behavior.

Impact Analysis:

• Blast radius: medium; affects all consumers of Rex::Socket::SslTcpServer#accept (e.g., reverse HTTPS handlers / stream servers) across platforms, with primary benefit on Windows.
• Data and contract effects: no schema/payload changes; behavioral change is limited to readiness waiting during non-blocking TLS handshake.
• Rollback and test focus: rollback is straightforward (single-method change); validate Windows reverse-HTTPS handlers and run the added specs, focusing on non-blocking accept retry paths and handshake-failure handling.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
lib/rex/socket/ssl_tcp_server.rb	Fixes non-blocking TLS accept retry logic to select on the correct socket object.
spec/rex/socket/ssl_tcp_server_spec.rb	Adds regression and behavior tests for SSL TCP server accept/handshake flows.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.