Initial support for Malleable C2 Profiles in Windows Metepreter #759
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Removing warnings as well as making the builds work properly outside of Visual Studio and docker.
Makes sure that things build correctly across environments.
Not read for push, some sections removed to avoid the pain of dev until the rest of the work is done.
More to do, and transport stuff needs to be updated to include the C2 configuration options.
This actually stages/works as expected now. More fields to map, more work to do. More configuration to handle. Then the changes need to also be moved over to the WININET fallback version when done. Still need to handle encoding as well.
* Packet prefixes and suffixes now work as expected (at least outbound), more work to do to support inbound. * Validated that migration works. * Support encryption key transmission across migration (need to confirm if this is required).
Referrer and accept type headers no longer separate, despite what the APIs say they do support inclusion of them with custom headers. Skip counts now included so the incoming packets can be prefixed in the C2 profile. Various other code tidies/adjustments.
Various tweaks to support it on the server side as well.
Open
20 tasks
POST requests were being killed off before reading the response. This fixes that issue.
|
Hey @smcintyre-r7 or @dledda-r7 could you have a quick look at the windows-2022 target for the visual studio build in the github actions? I changed from |
C2 encoding now supported in the GET/POST based on the C2 configuration. Changed up the way the body of an HTTP response is read, so that the content length header is used instead. This means we can read in the entire buffer, remove prefixes/suffixes and do decoding before passing this on. Prior to this, we were using the packet header to figure out how much data to read, and that doesn't makes sense any more.
dledda-r7
reviewed
Aug 4, 2025
|
@dledda-r7 is there a way of getting the |
|
@OJ I think there is, looking up on google looks like VS2022 doesn't have XP support, but currently I am able to compiler metsrv with 141_xp on VS22. I think the steps could be:
Create a file named: There is some stuff more, like ARM64 but i think it's fine, we are going to need it at some point.
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains a bunch of changes to support malleable C2 features stored in a
.profilefile (such as this).Given the nature of how Meterpreter works, and how payloads are generated, there are a lot of C2 profile features that can't be supported without drastic changes. The intent here is to focus on the transport-specific details around HTTP payloads.
For more information on what's supported, along with documentation, sample runs/etc, please see the associated Metasploit Framework PR.
In order to support the new features and configuration options the configuration block needed to change. Rather than expand on this rather rudimentary and outdated block of information, it was decided that the config block should be converted to a TLV Packet. That has been done as part of this PR, and is obviously a breaking change, and hence isn't backwards compatible.
This took a lot longer than I had hoped, so as of yet the other Meterpreters haven't been modified.
TODO: