Repository navigation
Enable psexec PowerShell delivery for Windows AArch64 payloads - #21857
Merged
bwatters-r7 merged 1 commit intoSep 3, 2026
Merged
bwatters-r7 merged 1 commit into
bwatters-r7 merged 1 commit into
Conversation
rex-powershell 0.1.105 taught run_hidden_psh how to route to the native ARM64 powershell.exe on Windows-on-ARM, so the psexec PowerShell target and the Automatic branch no longer have to detour AArch64 payloads through Native upload. Require rex-powershell >= 0.1.105, add ARCH_AARCH64 to the PowerShell target, and drop the AArch64-only fallback in Automatic. Native upload remains available for oversize AArch64 payloads. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
TestingPsExec PowerShell Delivery Test MatrixModule: All sessions opened successfully as
Full session outputs |
bwatters-r7
moved this from In Progress
to What about Second Review?
in Metasploit Kanban
dledda-r7
approved these changes
Sep 3, 2026
github-project-automation
Bot
moved this from What about Second Review?
to In Progress
in Metasploit Kanban
Contributor
Release NotesBumps rex-powershell to 1.0.5, which added AARCH64 support for powershell injection techniques MSIL, net, old, and reflect. This PR also enhances `exploit/windows/smb' by allowing those options for payload delivery on AARCH64 Windows systems. |
Contributor
Author
|
Thank you so much for landing this, @bwatters-r7 and @dledda-r7. It means the world to me. 🙏 |
Contributor
|
@vinicius-batistella if you are interested, adding AARCH64 support to the Fetch payloads would be nice- it is not as technical as what you've worked on before since it is going to involve creating some adapted payloads to join the existing aarch64 binaries to the fetch stagers, but it would be a neat feature to add. I can write up a quick issue outlining what needs to be done if you are interested? |
Contributor
Author
|
@bwatters-r7, sure thing. It'd be a pleasure. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #21779 and rapid7/rex-powershell#49 (
rex-powershell0.1.105).#21779 wired AArch64 into psexec Native upload (drop an EXE) and left the PowerShell target on x86/x64 only, because
run_hidden_pshcould not pick the ARM64powershell.exe. That gem now routes WoA hosts viaPROCESSOR_ARCHITECTURE/PROCESSOR_ARCHITEW6432.This PR:
rex-powershell >= 0.1.105.ARCH_AARCH64to the PowerShell target.powershell.exeis on the share, Automatic now selects PowerShell for AArch64 the same way it does for x86/x64.Native upload is unchanged and still available for payloads that do not fit the 8192-byte AArch64 template.
Verification
Windows 11 ARM64 VM (build 26200), local admin,
windows/aarch64/shell_reverse_tcp.Automatic (
target 0)Before this change, Automatic with the same payload printed
Selecting native target.Explicit PowerShell (
target 1)Same payload/options,
set target 1: command length 4914, same SCM timeout message, session 2 opened.Test plan
windows/aarch64/shell_reverse_tcpselects PowerShell and opens a SYSTEM session on Windows 11 ARM64.target 1) with the same payload also opens a session.powershell.exeis present (unchanged control flow).Made with Cursor