From a6a98085b026de7bca85a897af45561d21d41a4a Mon Sep 17 00:00:00 2001 From: vinicius-batistella Date: Mon, 31 Aug 2026 23:54:17 -0300 Subject: [PATCH] Wire AArch64 through psexec's PowerShell delivery path rex-powershell 0.1.105 taught run_hidden_psh how to route to the native ARM64 powershell.exe on Windows-on-ARM, so the psexec PowerShell target and the Automatic branch no longer have to detour AArch64 payloads through Native upload. Require rex-powershell >= 0.1.105, add ARCH_AARCH64 to the PowerShell target, and drop the AArch64-only fallback in Automatic. Native upload remains available for oversize AArch64 payloads. Co-authored-by: Cursor --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- modules/exploits/windows/smb/psexec.rb | 12 ++---------- 3 files changed, 5 insertions(+), 13 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 9b0075c2fb4d9..c3807d929f7a7 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -104,7 +104,7 @@ PATH rex-mime rex-nop rex-ole - rex-powershell + rex-powershell (>= 0.1.105) rex-random_identifier rex-registry rex-rop_builder @@ -538,7 +538,7 @@ GEM rex-arch rex-ole (0.1.9) rex-text - rex-powershell (0.1.103) + rex-powershell (0.1.105) bigdecimal rex-random_identifier rex-text diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 7f5e5d60fe48d..9fa200ff053f7 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -171,7 +171,7 @@ Gem::Specification.new do |spec| # Library for Generating Randomized strings valid as Identifiers such as variable names spec.add_runtime_dependency 'rex-random_identifier' # library for creating Powershell scripts for exploitation purposes - spec.add_runtime_dependency 'rex-powershell' + spec.add_runtime_dependency 'rex-powershell', '>= 0.1.105' # Library for processing and creating Zip compatbile archives spec.add_runtime_dependency 'rex-zip' # Library for parsing offline Windows Registry files diff --git a/modules/exploits/windows/smb/psexec.rb b/modules/exploits/windows/smb/psexec.rb index 329797828f0dd..4206c165d4894 100644 --- a/modules/exploits/windows/smb/psexec.rb +++ b/modules/exploits/windows/smb/psexec.rb @@ -66,11 +66,8 @@ def initialize(info = {}) }, 'Platform' => 'win', 'Targets' => [ - # PowerShell isn't offered for AArch64: the PowerShell shellcode-injection - # wrapper (rex-powershell) only knows how to spawn x86/x64 powershell.exe, - # so it can't be used to run AArch64 shellcode. [ 'Automatic', { 'Arch' => [ARCH_X86, ARCH_X64, ARCH_AARCH64] } ], - [ 'PowerShell', { 'Arch' => [ARCH_X86, ARCH_X64] } ], + [ 'PowerShell', { 'Arch' => [ARCH_X86, ARCH_X64, ARCH_AARCH64] } ], [ 'Native upload', { # upload a service executable 'Arch' => [ARCH_X86, ARCH_X64, ARCH_AARCH64], # service executables place the payload within a segment, 1GiB is a practical max in many cases. @@ -159,12 +156,7 @@ def exploit case target.name when 'Automatic' - # The PowerShell delivery path can only launch x86/x64 powershell.exe, so - # an AArch64 payload has to go straight to the native upload technique. - if payload_instance.arch.include?(ARCH_AARCH64) - print_status('Selecting native target') - native_upload_with_workaround(smbshare) - elsif powershell_installed?(smbshare, datastore['PSH_PATH']) + if powershell_installed?(smbshare, datastore['PSH_PATH']) print_status('Selecting PowerShell target') execute_powershell_payload else