Repository navigation
Fix exec payload size crash - #21424
Merged
adfoster-r7 merged 3 commits intoMay 8, 2026
Merged
Conversation
adfoster-r7
reviewed
May 7, 2026
sjanusz-r7
changed the title
dledda-r7
reviewed
May 8, 2026
sjanusz-r7
force-pushed
the
fix-exec-payload-size-crash
branch
2 times, most recently
from
May 8, 2026 15:39
15d30c7 to
6afe625
Compare
…tring usage Use rex-text to_hex_cstring keyword arg
sjanusz-r7
force-pushed
the
fix-exec-payload-size-crash
branch
from
May 8, 2026 15:41
6afe625 to
79b0fd6
Compare
adfoster-r7
approved these changes
May 8, 2026
2 tasks
sjanusz-r7
pushed a commit
that referenced
this pull request
May 20, 2026
Replaces all `Rex::Text.to_hex_cstring` calls in payload modules with the new `Metasm::Shellcode.define_data` and `Metasm::Shellcode.define_cstring` class methods, which emit full `db` directives (string-literal form for printable runs, hex tokens otherwise) and are a better home for assembly-source generation than rex-text. The 9 affected modules are: - modules/payloads/singles/linux/x64/exec.rb - modules/payloads/singles/linux/x64/set_hostname.rb - modules/payloads/singles/linux/x86/exec.rb - modules/payloads/singles/linux/x86/read_file.rb - modules/payloads/singles/osx/x64/shell_reverse_tcp.rb - modules/payloads/singles/windows/download_exec.rb - modules/payloads/singles/windows/messagebox.rb - modules/payloads/singles/windows/x64/download_exec.rb - modules/payloads/singles/windows/x64/messagebox.rb Surrounding heredoc templates have the `db ` prefix removed since the new methods include it. Where a `db` directive previously combined an interpolated byte list with an additional literal (e.g. a trailing sentinel byte or `"cmd /c "`), the directive is split into adjacent `db` lines, which assemble to the same contiguous bytes. Verified by re-running the `payload_cached_size_is_consistent` shared examples for each affected payload (30 examples, 0 failures), which were the tests originally fixed by #21424.
h00die
pushed a commit
to h00die/metasploit-framework
that referenced
this pull request
May 27, 2026
Replaces all `Rex::Text.to_hex_cstring` calls in payload modules with the new `Metasm::Shellcode.define_data` and `Metasm::Shellcode.define_cstring` class methods, which emit full `db` directives (string-literal form for printable runs, hex tokens otherwise) and are a better home for assembly-source generation than rex-text. The 9 affected modules are: - modules/payloads/singles/linux/x64/exec.rb - modules/payloads/singles/linux/x64/set_hostname.rb - modules/payloads/singles/linux/x86/exec.rb - modules/payloads/singles/linux/x86/read_file.rb - modules/payloads/singles/osx/x64/shell_reverse_tcp.rb - modules/payloads/singles/windows/download_exec.rb - modules/payloads/singles/windows/messagebox.rb - modules/payloads/singles/windows/x64/download_exec.rb - modules/payloads/singles/windows/x64/messagebox.rb Surrounding heredoc templates have the `db ` prefix removed since the new methods include it. Where a `db` directive previously combined an interpolated byte list with an additional literal (e.g. a trailing sentinel byte or `"cmd /c "`), the directive is split into adjacent `db` lines, which assemble to the same contiguous bytes. Verified by re-running the `payload_cached_size_is_consistent` shared examples for each affected payload (30 examples, 0 failures), which were the tests originally fixed by rapid7#21424.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR re-enables the recently-migrated CI payload cache size specs.
Follow on from #21411
This PR uses a custom rex-text branch from this PR: rapid7/rex-text#76
This PR fixes issues in modules that use custom copy-pasted logic for converting a string to hex.
This logic was causing issues when the string was empty. It was resulting in broken assembly:
can result in
Verification
bundle exec rspec spec/modules/payloads_spec.rb