Add AArch64 Windows target support to exploit/windows/smb/psexec - #21779
Draft
bwatters-r7 wants to merge 1 commit into
Draft
Add AArch64 Windows target support to exploit/windows/smb/psexec#21779bwatters-r7 wants to merge 1 commit into
bwatters-r7 wants to merge 1 commit into
Conversation
The AArch64 Windows PE loader template (to_winaarch64pe) and the windows/aarch64/exec payload already existed, but nothing actually wired ARCH_AARCH64 into the executable-generation paths psexec (and msfvenom/RPC) depend on: - lib/msf/util/exe.rb: to_executable_fmt had no ARCH_AARCH64 case for exe/exe-service/exe-small/exe-only/msi/msi-nouac, so requesting any of those formats for AArch64 silently produced no output. - lib/msf/core/exploit/exe.rb: generate_payload_exe_service (what psexec's native_upload calls) hard-coded an X64-or-X86 choice, so an AArch64 payload would have been embedded in a broken x86 PE. - lib/msf/util/exe/windows/aarch64.rb: to_winaarch64pe had no bounds check on the template's fixed 8192-byte payload buffer, unlike the analogous to_win32pe_old. Also add ARCH_AARCH64 to psexec's Automatic/Native upload/MOF upload targets, and make Automatic skip the PowerShell-delivery branch for AArch64 payloads (the rex-powershell injection wrapper only knows how to spawn x86/x64 powershell.exe). Only one AArch64 Windows payload exists upstream so far (windows/aarch64/exec, single-stage command exec, no stager/meterpreter for ARM64 Windows yet), so this enables command execution via psexec against Windows-on-ARM targets, not a full session. Verified live against a real Windows AArch64 host: Native upload with PAYLOAD windows/aarch64/exec correctly generates and drops an ARM64 PE, registers/starts/removes it as a service, and the embedded WinExec shellcode executes as NT AUTHORITY\SYSTEM. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
11 tasks
Contributor
|
Hey, @bwatters-r7. Just say which workflow you prefer. 👍 |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds Windows ARM64 (AArch64) support to the exploit/windows/smb/psexec module by allowing AArch64 payload selection and routing Automatic targeting away from the PowerShell delivery path, while extending the framework’s Windows EXE generation paths to emit AArch64 executables (including when an exe-service is requested).
Changes:
- Extend
psexecmodule targets (Automatic/Native/MOF) to includeARCH_AARCH64, and force Automatic to select native upload when an AArch64 payload is chosen. - Add an explicit maximum payload size guard for the Windows AArch64 PE template generator.
- Thread
ARCH_AARCH64through EXE format selection forexe-serviceand related Windows EXE outputs, and add AArch64 handling ingenerate_payload_exe_service.
Impact Analysis:
- Blast radius: medium — affects
modules/exploits/windows/smb/psexecusers plus any consumers of Windows EXE generation (Msf::Util::EXE/Msf::Exploit::EXE), including payload generation flows. - Data and contract effects: introduces a hard size limit for AArch64 template-based EXE generation (errors on oversize payloads) and changes behavior when requesting Windows exe-service output for AArch64 (mapped to the loader template).
- Rollback and test focus: rollback is straightforward (revert commits); test focus on AArch64 payload EXE generation (success + oversize failure) and
psexecnative upload execution path with an AArch64 payload.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| modules/exploits/windows/smb/psexec.rb | Allows AArch64 payloads and makes Automatic target choose native upload for AArch64. |
| lib/msf/util/exe/windows/aarch64.rb | Adds a fixed-size template limit constant and enforces a maximum embedded payload size. |
| lib/msf/util/exe.rb | Adds AArch64 support for multiple Windows EXE format branches, including exe-service. |
| lib/msf/core/exploit/exe.rb | Updates generate_payload_exe_service to generate an AArch64 Windows PE when requested. |
Suppressed comments (1)
lib/msf/util/exe/windows/aarch64.rb:46
- Important: Problem:
to_winaarch64peusescode.lengthand raises a genericRuntimeErroron overflow, which is fragile for binary encodings and makes targeted rescue harder in library code. Impact: payload size checks can be inconsistent and callers can’t reliably rescue a specific error type. Fix: usecode.bytesizeand raise a more specific error (e.g.,ArgumentError) with the actual size.
if code.length > WINAARCH64_PAYLOAD_SPACE
raise RuntimeError, "The Windows AArch64 EXE generator has a max size of " \
"#{WINAARCH64_PAYLOAD_SPACE} bytes, please fix the calling module"
end
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
74
to
+78
| [ 'Native upload', { # upload a service executable | ||
| 'Arch' => [ARCH_X86, ARCH_X64], | ||
| 'Arch' => [ARCH_X86, ARCH_X64, ARCH_AARCH64], | ||
| 'Payload' => { 'Space' => 2 ** 30 } # service executables place the payload within a segment, 1GiB is a practical max in many cases | ||
| } ], | ||
| [ 'MOF upload', { 'Arch' => [ARCH_X86, ARCH_X64] } ], | ||
| [ 'MOF upload', { 'Arch' => [ARCH_X86, ARCH_X64, ARCH_AARCH64] } ], |
Comment on lines
32
to
+46
| def to_winaarch64pe(framework, code, opts = {}) | ||
| # Use the standard template if not specified by the user. | ||
| # This helper finds the full path and stores it in opts[:template]. | ||
| set_template_default(opts, 'template_aarch64_windows.exe') | ||
|
|
||
| # Read the template directly from the path now stored in the options. | ||
| pe = File.read(opts[:template], mode: 'rb') | ||
|
|
||
| # Find the tag and inject the payload | ||
| bo = find_payload_tag(pe, 'Invalid Windows AArch64 template: missing "PAYLOAD:" tag') | ||
|
|
||
| if code.length > WINAARCH64_PAYLOAD_SPACE | ||
| raise RuntimeError, "The Windows AArch64 EXE generator has a max size of " \ | ||
| "#{WINAARCH64_PAYLOAD_SPACE} bytes, please fix the calling module" | ||
| end |
Contributor
Author
|
@vinicius-batistella I don't think I can add you as a collaborator, since that permission appears to be at the repo level if I'm reading correctly. Feel free to PR to this branch, though! I'll be out of touch for a couple days but I should pop back up next week. |
Contributor
|
Great, no worries. I'll do that way. Thanks. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
We have AARCH64 shell payloads! This adds support for them into the psexec module.
Breaking Changes
None
Reviewer Notes
Verification Steps
Test Evidence
Environment