MeterpreterOptions break-up and default extension loading removal #20012

dledda-r7 · 2025-04-08T14:37:16Z

This PR is related to #19975
In order to reduce the memory footprint of Meterpreter on target system is necessary to be sure only necessary code is loaded inside Meterpreter.

While working on standard api split, I noticed the presence of two extensions that were loaded without the user knowladge, priv and unhook.
This PR modifies the loading logic to use a datastore option AutoLoadExtension which contains a ';' separated list of extensions to load. At the moment inside lib/msf/base/sessions/meterpreter.rb is present a code block (commented) that keep the compability of the current working logic of Meterpreter.

Since the AutoLoadExtension logic depends on the platform, the break-up of meterpreter_option.rb to platform-specific option was necessary.

Tasks:

lib/msf/base/sessions/meterpreter.rb

dledda-r7 · 2025-04-09T11:23:53Z

~~Also blocked by #19799~~
~~because need of modify: tools/modules/meterpreter_reverse.erb~~

~~To future me: modify it to have the architecutre specific MeterpreterOptions~~

Let's resolve the conflicts once one of them is landed.

lib/msf/base/sessions/meterpreter_options/osx.rb

lib/msf/base/sessions/meterpreter.rb

…s, adding AutoLoadExtensions option (Windows, Linux)

…s, adding AutoLoadExtensions option (AppleIos,Php,Python,Java,Osx,Android)

…rpreterOptions

adfoster-r7 · 2025-07-17T14:25:33Z

lib/msf/base/sessions/meterpreter.rb

-      end
-    end
-
+    extensions = datastore['AutoLoadExtensions']&.split(';') || []


Might be worth a quick data-mine to see if splitting by , is more common as a pattern, as well as stripping whitespace etc, to handle stdapi, priv etc

Long-term: Maybe we should have an Opt for supporting a comma separated values for handling this consistently

adfoster-r7 · 2025-07-17T14:27:53Z

lib/msf/base/sessions/meterpreter.rb

-    if session.platform == 'android'
-      session.load_android
+    extensions.each do |extension|
+      console.run_single("load #{extension}")


Maybe we should have some begin/rescue/ensure block mechanisms here so that if an extension fails to load, the output can be safely re-enabled again

adfoster-r7 · 2025-07-17T14:32:25Z

tools/modules/meterpreter_reverse.erb

@@ -8,7 +8,7 @@
 module MetasploitModule

  include Msf::Payload::Single
-  include Msf::Sessions::MeterpreterOptions
+  include Msf::Sessions::MeterpreterOptions::<%= platform.split('_').each { |s| s.capitalize! }.join %>


Suggested change

include Msf::Sessions::MeterpreterOptions::<%= platform.split('_').each { |s| s.capitalize! }.join %>

include Msf::Sessions::MeterpreterOptions::<%= platform.split('_').each { |s| s.casecmp?('osx') ? 'OSX' : s.capitalize! }.join %>

Or we can change lib/msf_autoload.rb - but I believe OSX is the existing convention to follow

adfoster-r7 · 2025-07-17T14:37:38Z

lib/msf/base/sessions/meterpreter.rb

-
+    extensions = datastore['AutoLoadExtensions']&.split(';') || []
+
+    # BEGIN: This should be removed on MSF 7


Maybe we can keep this around in MSF 7 still; maybe we could just change the default behaviors in the upcoming malleable profile config file setup that we're wanting to ship so that these aren't loaded by default, and they need to be opt-in. That way we're being less detected by default, rather than fighting against these older default values

msutovsky-r7 · 2025-07-28T14:25:43Z

lib/msf/base/sessions/meterpreter.rb

+    # BEGIN: This should be removed on MSF 7
+    # Unhook the process prior to loading stdapi to reduce logging/inspection by any AV/PSP (by default unhook is first, see meterpreter_options/windows.rb)
+    extensions.push('unhook') if datastore['AutoUnhookProcess'] && session.platform == 'windows'
+    extensions.push('stdapi') if datastore['AutoLoadStdapi']


I'm wondering whether this isn't maybe bit redundant in some cases:
payload/linux/x64/meterpreter_reverse_tcp has two advanced datastore options AutoLoadExtensions and AutoLoadStdapi, which basically do the same thing (?). The AutoLoadExtensions has stdapi as value and AutoLoadStdapi is set to true, so if I understand correctly, it does the same thing. Wouldn't it be better to either set AutoLoadStdapi to false by default or remove stdapi from AutoLoadExtensions for those payloads which have AutoLoadStdapi set to true?

msutovsky-r7 · 2025-07-29T06:04:28Z

modules/payloads/stages/php/meterpreter.rb

@@ -6,7 +6,8 @@
 require 'securerandom'

 module MetasploitModule
-  include Msf::Sessions::MeterpreterOptions
+


Suggested change

dledda-r7 commented Apr 8, 2025

View reviewed changes

lib/msf/base/sessions/meterpreter.rb Show resolved Hide resolved

dledda-r7 commented Apr 9, 2025

View reviewed changes

lib/msf/base/sessions/meterpreter_options/osx.rb Outdated Show resolved Hide resolved

dledda-r7 changed the title ~~[WIP] Remove default loaded extensions on Meterpreter~~ [WIP] MeterpreterOptions break-up and default extension loading removal Apr 9, 2025

dledda-r7 self-assigned this Apr 9, 2025

dledda-r7 added payload rn-payload-enhancement release notes for enhanced payloads labels Apr 9, 2025

dledda-r7 added this to Metasploit Kanban Apr 9, 2025

dledda-r7 moved this to In Progress in Metasploit Kanban Apr 9, 2025

dledda-r7 added the blocked Blocked by one or more additional tasks label Apr 9, 2025

jvoisin reviewed Apr 9, 2025

View reviewed changes

lib/msf/base/sessions/meterpreter.rb Outdated Show resolved Hide resolved

lib/msf/base/sessions/meterpreter.rb Show resolved Hide resolved

dledda-r7 marked this pull request as ready for review April 15, 2025 10:37

dledda-r7 removed this from Metasploit Kanban May 22, 2025

dledda-r7 changed the title ~~[WIP] MeterpreterOptions break-up and default extension loading removal~~ MeterpreterOptions break-up and default extension loading removal Jun 2, 2025

dledda-r7 added 6 commits June 2, 2025 08:06

feat: split platform-specific meterpreter options on different module…

44617cb

…s, adding AutoLoadExtensions option (Windows, Linux)

feat: split platform-specific meterpreter options on different module…

a7f4da5

…s, adding AutoLoadExtensions option (AppleIos,Php,Python,Java,Osx,Android)

fix: restored deleted comments

e44043b

fix: modified meterpreter_reverse template for platform-specific Mete…

dd23be9

…rpreterOptions

fix: changed MeterpreterOptions to be platform-specific in pivot

e4bc2a6

fix: delete of meterpreter_options.rb

70bafdf

dledda-r7 force-pushed the feat/remove-default-extensions branch from 9c568c0 to 70bafdf Compare June 2, 2025 12:08

dledda-r7 removed the blocked Blocked by one or more additional tasks label Jun 2, 2025

dledda-r7 added 2 commits June 2, 2025 08:14

fix: re-include OSX specific option

c4ca4d6

fix: renaming Osx to OSX for autoload support

5e3e975

dledda-r7 mentioned this pull request Jun 2, 2025

Split Stdapi #19975

Open

dledda-r7 removed their assignment Jun 11, 2025

msutovsky-r7 self-assigned this Jun 27, 2025

adfoster-r7 reviewed Jul 17, 2025

View reviewed changes

msutovsky-r7 reviewed Jul 29, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

MeterpreterOptions break-up and default extension loading removal #20012

MeterpreterOptions break-up and default extension loading removal #20012

Uh oh!

dledda-r7 commented Apr 8, 2025 •

edited

Loading

Uh oh!

Uh oh!

dledda-r7 commented Apr 9, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

adfoster-r7 Jul 17, 2025

Uh oh!

adfoster-r7 Jul 17, 2025 •

edited by msutovsky-r7

Loading

Uh oh!

adfoster-r7 Jul 17, 2025 •

edited

Loading

Uh oh!

adfoster-r7 Jul 17, 2025 •

edited

Loading

Uh oh!

msutovsky-r7 Jul 28, 2025

Uh oh!

msutovsky-r7 Jul 29, 2025

Uh oh!

Uh oh!

	include Msf::Sessions::MeterpreterOptions::<%= platform.split('_').each { \|s\| s.capitalize! }.join %>
	include Msf::Sessions::MeterpreterOptions::<%= platform.split('_').each { \|s\| s.casecmp?('osx') ? 'OSX' : s.capitalize! }.join %>


		extensions = datastore['AutoLoadExtensions']&.split(';') \|\| []

		# BEGIN: This should be removed on MSF 7

MeterpreterOptions break-up and default extension loading removal #20012

Are you sure you want to change the base?

MeterpreterOptions break-up and default extension loading removal #20012

Uh oh!

Conversation

dledda-r7 commented Apr 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

dledda-r7 commented Apr 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

adfoster-r7 Jul 17, 2025

Choose a reason for hiding this comment

Uh oh!

adfoster-r7 Jul 17, 2025 • edited by msutovsky-r7 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adfoster-r7 Jul 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adfoster-r7 Jul 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

msutovsky-r7 Jul 28, 2025

Choose a reason for hiding this comment

Uh oh!

msutovsky-r7 Jul 29, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dledda-r7 commented Apr 8, 2025 •

edited

Loading

dledda-r7 commented Apr 9, 2025 •

edited

Loading

adfoster-r7 Jul 17, 2025 •

edited by msutovsky-r7

Loading

adfoster-r7 Jul 17, 2025 •

edited

Loading

adfoster-r7 Jul 17, 2025 •

edited

Loading