Skip to content

Move AArch64 payload mixins under payload/windows/aarch64/ - #8

Open
vinicius-batistella wants to merge 1 commit into
bwatters-r7:feature/add-aarch64-psexecfrom
vinicius-batistella:feature/aarch64-payload-mixin-layout
Open

Move AArch64 payload mixins under payload/windows/aarch64/#8
vinicius-batistella wants to merge 1 commit into
bwatters-r7:feature/add-aarch64-psexecfrom
vinicius-batistella:feature/aarch64-payload-mixin-layout

Conversation

@vinicius-batistella

Copy link
Copy Markdown

Follow-up to rapid7#21744 addressing @dledda-r7's non-blocking note about the AArch64 mixin layout.

Summary

  • Move exitfunk_aarch64.rb and reverse_tcp_aarch64.rb from lib/msf/core/payload/windows/ into lib/msf/core/payload/windows/aarch64/, mirroring the existing payload/windows/x64/ layout.
  • Add lib/msf/core/payload/windows/aarch64 to Zeitwerk's collapse_list in lib/msf_autoload.rb so the module namespaces stay flat (Msf::Payload::Windows::Exitfunk_Aarch64, Msf::Payload::Windows::ReverseTcp_Aarch64), matching the x64 convention (BindTcp_x64, Exitfunk_x64, etc.).
  • No code changes in the moved files. No include statements in payload modules needed updating.

The shared helper module (Msf::Payload::Windows::Aarch64, in windows/aarch64.rb) stays where it is - the sibling .rb file defines the parent namespace and the collapsed aarch64/ directory contributes the individual mixins under the same namespace.

Verification

./msfvenom --refresh-cache -l payloads | grep 'windows/aarch64' on this branch:

windows/aarch64/exec                Executes an arbitrary command on a Windows on ARM (AArch64) target...
windows/aarch64/shell/reverse_tcp   Spawn a piped command shell on Windows on ARM (AArch64) (staged)...
windows/aarch64/shell_reverse_tcp   Connect back to the attacker and spawn a Windows command shell...

Generation still produces identical shellcode sizes:

$ ./msfvenom -p windows/aarch64/shell_reverse_tcp LHOST=192.0.2.10 LPORT=4444 -f raw
Payload size: 664 bytes

$ ./msfvenom -p windows/aarch64/shell/reverse_tcp  LHOST=192.0.2.10 LPORT=4444 -f raw
Payload size: 716 bytes
  • rubocop on the moved files and lib/msf_autoload.rb: no new offenses (two pre-existing Style/Documentation offenses on msf_autoload.rb are already present on rapid7/master).
  • ruby tools/dev/msftidy.rb on the three consuming modules (singles/windows/aarch64/shell_reverse_tcp.rb, stagers/windows/aarch64/reverse_tcp.rb, stages/windows/aarch64/shell.rb): clean.

Made with Cursor

Mirror the layout used for x86_64 payload mixins (payload/windows/x64/)
by relocating exitfunk_aarch64.rb and reverse_tcp_aarch64.rb into
lib/msf/core/payload/windows/aarch64/ and adding that directory to
Zeitwerk's collapse_list so the module namespaces stay flat
(Msf::Payload::Windows::Exitfunk_Aarch64 and ReverseTcp_Aarch64), as
noted by dledda-r7 on rapid7#21744.

The shared helper module (Msf::Payload::Windows::Aarch64, in
windows/aarch64.rb) is left where it is - Zeitwerk resolves it from
the sibling .rb file while the collapsed aarch64/ directory contributes
the individual mixins to the same parent namespace.

No code changes in the moved files; msfvenom loads and generates
windows/aarch64/exec, shell/reverse_tcp, and shell_reverse_tcp
unchanged.

Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant