Metasploit Framework has received an update, version 6.4.142, introducing new modules and enhancements. Among the additions is a module that allows for the upgrade of existing SMB sessions to Meterpreter sessions, a capability that can be initiated via the command `sessions -u session_id` or by loading the `windows/manage/smb_to_meterpreter` module. This feature, developed by Dean Welch, leverages PsExec to facilitate the session elevation.
The update also includes a new exploit module for Peyara Remote Mouse version 1.0.1, targeting an unauthenticated remote code execution vulnerability. This module, contributed by tmrswrr, is located at `windows/misc/peyara_remote_mouse_rce`. Additionally, a new command execution payload for the LoongArch64 Linux architecture has been added, found at `linux/loongarch64/exec`.
Enhancements were made to the MCP server's HTTP transport, with authentication support now enabled by default, a change introduced by zeroSteiner. This update also addresses two bugs. One fix, also by zeroSteiner, resolves a crash that occurred when the `scanner/discovery/udp_sweep` module was run in Windows environments. Another bug fix, by adfoster-r7, corrects an issue where debug information for SSH sessions incorrectly displayed `localuser @` instead of `ssh_user @ ssh_ip`.
Users can update their Metasploit Framework installation to the latest version by running `msfupdate`. Further details regarding the changes since the previous release are available on GitHub, with specific pull requests and full diffs for versions 6.4.141 through 6.4.142. For those who prefer not to use Git, nightly installers for the open-source version and the commercial Metasploit Pro edition are also available. The latest Metasploit documentation can be accessed on the official docsite.
