Extension Encryption by xHector1337 · Pull Request #791 · rapid7/metasploit-payloads

xHector1337 · 2026-02-02T15:02:21Z

Extension Encryption: Encryption Manager

This PR creates the basic encryption manager, and start wiring decryption logic inside metsrv.

Coverage:

Initialization of Extension Encryption Manager inside the server setup
Insertion of an extension if flagged as ENCRYPTABLE and if it was load by ReflectiveLoader
Decryption of extension if command handler is within extension mem space
Decryption of scheduler event handler if handler is within extension mem space

At the moment the default CryptographicManager is the a "debug" manager that will just force metsrv to rewrite the same bytes to the extension memory space, this chained with a testing extension loaded with the ENCRYPTABLE flag set to true will be used as first PoC to ensure writing the memory will not cause any issue for extension loaded with ReflectiveLoader.

…mand handling

… setup

… files

…r handling

…extension-encryption/manager

…tion/manager Collaboration Extension Encryption

…_process_inline

…the scheduler and command_process_inline

…actor add function

dledda-r7 · 2026-03-05T12:05:55Z

Side note for future me: BEFORE LANDING

Pass every function to use the win api

…tion/manager-2 Fix base address, refactor add function

xHector1337 · 2026-03-22T06:46:03Z

[2500] [LOAD EXTENSION] Adding command ID to response: 1072
[2500] [LOAD EXTENSION] Adding command ID to response: 1071
[2500] [LOAD EXTENSION] Adding command ID to response: 1077
[2500] [LOAD EXTENSION] Adding command ID to response: 1069
[2500] [LOAD EXTENSION] Adding command ID to response: 1068
[2500] [LOAD EXTENSION] Adding command ID to response: 1067
[2500] [LOAD EXTENSION] Adding command ID to response: 1012
[2500] [LOAD EXTENSION] Adding command ID to response: 1013
[2500] [LOAD EXTENSION] Adding command ID to response: 1015
[2500] [LOAD EXTENSION] Adding command ID to response: 1010
[2500] [LOAD EXTENSION] Adding command ID to response: 1005
[2500] [LOAD EXTENSION] Adding command ID to response: 1007
[2500] [LOAD EXTENSION] Adding command ID to response: 1006
[2500] [LOAD EXTENSION] Adding command ID to response: 1016
[2500] [LOAD EXTENSION] Adding command ID to response: 1014
[2500] [LOAD EXTENSION] Adding command ID to response: 1004
[2500] [LOAD EXTENSION] Adding command ID to response: 1003
[2500] [LOAD EXTENSION] Adding command ID to response: 1011
[2500] [LOAD EXTENSION] Adding command ID to response: 1001
[2500] [LOAD EXTENSION] Adding command ID to response: 1008
[2500] [LOAD EXTENSION] Adding command ID to response: 1009
[2500] [LOAD EXTENSION] Adding command ID to response: 1031
[2500] [LOAD EXTENSION] Adding command ID to response: 1030
[2500] [LOAD EXTENSION] Adding command ID to response: 1029
[2500] [LOAD EXTENSION] Adding command ID to response: 1028
[2500] [LOAD EXTENSION] Adding command ID to response: 4
[2500] [extension_encryption][extension_encryption_add] Adding extension
[2500] [extension_encryption][extension_encryption_add] .text section of the extension is found!
[2500] [extension_encryption][extension_encryption_add] lpExtensionStatus->bEncryptable: 1
[2500] [extension_encryption][extension_encryption_add] lpExtensionStatus->bEncrypted: 0
[2500] [extension_encryption][extension_encryption_add] lpExtensionStatus->lpLoc: 00000000008D1000
[2500] [extension_encryption][extension_encryption_add] lpExtensionStatus->dwSize: 323376
[2500] [extension_encryption][extension_encryption_add] lpExtensionStatus->dwLastUsedTime: 326078
[2500] [extension_encryption][extension_encryption_add] Added extension text section at 00000000008D1000 of size 323376
[2500] [extension_encryption][extension_encryption_add] Function exiting

DebugString: "[27e8] [DISPATCH] Packet type for 1072 is 0"
DebugString: "[27e8] [DISPATCH] executing request handler 1072"
DebugString: "[27e8] [DISPATCH] Calling extensionFindDecrypt for command 1072"
DebugString: "[27e8] [extension_encryption][extension_encryption_get] Getting extension."
DebugString: "[27e8] [extension_encryption][extension_encryption_get] Function exiting."
DebugString: "[27e8] [COMMAND] Decryption successful for command 1072"

Copilot

Pull request overview

Adds an “Extension Encryption Manager” to metsrv and wires it into extension load and dispatch paths so extensions flagged as encryptable can be tracked and (de)crypted around handler execution.

Changes:

Add extension_encryption.{c,h} implementing a global extension encryption manager (debug + RC4 managers) and routines to add/find/(de)crypt extensions.
Initialize the manager during server setup; register encryptable, reflectively-loaded extensions during core_loadlib.
Attempt decryption before running extension handlers in the command dispatcher and scheduler; periodically encrypt unused extensions.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
c/meterpreter/workspace/metsrv/metsrv.vcxproj	Adds new extension encryption source/header to the build.
c/meterpreter/workspace/metsrv/metsrv.vcxproj.filters	Adds new files to Visual Studio filters.
c/meterpreter/source/metsrv/server_setup.c	Initializes the Extension Encryption Manager during server setup.
c/meterpreter/source/metsrv/remote_dispatch.c	Registers encryptable, reflectively-loaded extensions with the manager.
c/meterpreter/source/metsrv/base.c	Attempts extension decryption before handler execution; triggers “encrypt unused” after command handling.
c/meterpreter/source/metsrv/scheduler.c	Attempts extension decryption before scheduled routine execution.
c/meterpreter/source/metsrv/extension_encryption.h	Declares manager/status structs and public APIs.
c/meterpreter/source/metsrv/extension_encryption.c	Implements manager initialization, extension tracking, and (de)cryption routines.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-16T15:38:38Z

+					if (!extensionFindDecryptVal || extensionFindDecryptVal == EXTENSION_ENCRYPTION_EXTENSION_NOT_ENCRYPTABLE) {
+						dprintf("[COMMAND] Decryption successful for command %u", commandId);
+					}
+					else {
+						dprintf("[COMMAND] Decryption failed for command %u", commandId);
+						//break;
+					}
 					serverContinue = command->request.inline_handler(remote, packet, &result) && serverContinue;
 					dprintf("[DISPATCH] executed %u, continue %s", commandId, serverContinue ? "yes" : "no");
 				}
 				else
 				{
 					dprintf("[DISPATCH] executing request handler %u", commandId);
+					dprintf("[DISPATCH] Calling extensionFindDecrypt for command %u", commandId);
+					extensionFindDecryptVal = extensionFindDecrypt(command->request.handler);
+					if (!extensionFindDecryptVal || extensionFindDecryptVal == EXTENSION_ENCRYPTION_EXTENSION_NOT_ENCRYPTABLE) {
+						dprintf("[COMMAND] Decryption successful for command %u", commandId);
+					}
+					else {
+						dprintf("[COMMAND] Decryption failed for command %u", commandId);
+						//break;
+					}
 					result = command->request.handler(remote, packet);


If extensionFindDecrypt() reports a decryption failure, the handler is still invoked. For handlers located inside an encrypted extension, this risks executing encrypted bytes (crash/undefined behavior). Consider short-circuiting the dispatch when decryption fails (except for "not encryptable" / "not found" cases), and avoid logging "Decryption successful" unless the return code indicates success.

Suggested change

if (!extensionFindDecryptVal || extensionFindDecryptVal == EXTENSION_ENCRYPTION_EXTENSION_NOT_ENCRYPTABLE) {

dprintf("[COMMAND] Decryption successful for command %u", commandId);

}

else {

dprintf("[COMMAND] Decryption failed for command %u", commandId);

//break;

}

serverContinue = command->request.inline_handler(remote, packet, &result) && serverContinue;

dprintf("[DISPATCH] executed %u, continue %s", commandId, serverContinue ? "yes" : "no");

}

else

{

dprintf("[DISPATCH] executing request handler %u", commandId);

dprintf("[DISPATCH] Calling extensionFindDecrypt for command %u", commandId);

extensionFindDecryptVal = extensionFindDecrypt(command->request.handler);

if (!extensionFindDecryptVal || extensionFindDecryptVal == EXTENSION_ENCRYPTION_EXTENSION_NOT_ENCRYPTABLE) {

dprintf("[COMMAND] Decryption successful for command %u", commandId);

}

else {

dprintf("[COMMAND] Decryption failed for command %u", commandId);

//break;

}

result = command->request.handler(remote, packet);

if (!extensionFindDecryptVal) {

dprintf("[COMMAND] Decryption successful for command %u", commandId);

serverContinue = command->request.inline_handler(remote, packet, &result) && serverContinue;

dprintf("[DISPATCH] executed %u, continue %s", commandId, serverContinue ? "yes" : "no");

}

else if (extensionFindDecryptVal == EXTENSION_ENCRYPTION_EXTENSION_NOT_ENCRYPTABLE

|| extensionFindDecryptVal == EXTENSION_ENCRYPTION_EXTENSION_NOT_FOUND) {

dprintf("[COMMAND] Decryption not required for command %u", commandId);

serverContinue = command->request.inline_handler(remote, packet, &result) && serverContinue;

dprintf("[DISPATCH] executed %u, continue %s", commandId, serverContinue ? "yes" : "no");

}

else {

dprintf("[COMMAND] Decryption failed for command %u with error %u", commandId, extensionFindDecryptVal);

result = extensionFindDecryptVal;

}

}

else

{

dprintf("[DISPATCH] executing request handler %u", commandId);

dprintf("[DISPATCH] Calling extensionFindDecrypt for command %u", commandId);

extensionFindDecryptVal = extensionFindDecrypt(command->request.handler);

if (!extensionFindDecryptVal) {

dprintf("[COMMAND] Decryption successful for command %u", commandId);

result = command->request.handler(remote, packet);

}

else if (extensionFindDecryptVal == EXTENSION_ENCRYPTION_EXTENSION_NOT_ENCRYPTABLE

|| extensionFindDecryptVal == EXTENSION_ENCRYPTION_EXTENSION_NOT_FOUND) {

dprintf("[COMMAND] Decryption not required for command %u", commandId);

result = command->request.handler(remote, packet);

}

else {

dprintf("[COMMAND] Decryption failed for command %u with error %u", commandId, extensionFindDecryptVal);

result = extensionFindDecryptVal;

}

… in extension encryption functions

…function

…in extension encryption, sync rc4 stream

…duler threads

…tion/manager-2 some other fixes

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Suppressed comments (3)

c/meterpreter/source/metsrv/extension_encryption.c:501

Important: Problem: when the second decryption buffer allocation fails, the read buffer is freed here without clearing its pointer and common cleanup frees it again; Impact: this error path can corrupt the process heap or terminate metsrv; Fix: set the pointer to NULL after the first free.

			if (lpTempBufferRead != NULL) {
				HeapFree(hHeap, 0, lpTempBufferRead);
			}

c/meterpreter/source/metsrv/extension_encryption.c:536

Critical: Problem: decrypted executable bytes are written and invoked without flushing the instruction cache; Impact: Windows permits the processor to execute stale encrypted instructions, causing intermittent illegal-instruction crashes when a handler runs; Fix: call FlushInstructionCache for the rewritten section and fail decryption if it does not succeed before marking the extension decrypted.

			ret = met_api->win_api.kernel32.WriteProcessMemory(GetCurrentProcess(), (unsigned char*)ExtensionLoc + i, lpTempBufferWrite, diff, &ByteCounter);
			if (!ret || ByteCounter != diff) {
				dprintf("[extension_encryption][extension_encryption_decrypt] WriteProcessMemory failed with error 0x%x", GetLastError());
				bError = TRUE;
				break;

c/meterpreter/source/metsrv/remote_dispatch.c:432

Important: Problem: this registers the module even when the preceding load_extension call failed and ignores add failure; Impact: failed extensions can enter the encryption scan, while successfully loaded encryptable extensions can be reported as successful without ever being protected; Fix: call add only after res == ERROR_SUCCESS, propagate registration failure, and roll back the loaded extension if encryption registration is mandatory.

			if (flags & LOAD_LIBRARY_EXTENSION_ENCRYPTABLE && bLibLoadedReflectivly) {
				ExtensionEncryptionManager* encryptionManager = GetExtensionEncryptionManager();
				if(encryptionManager) {
					encryptionManager->add(lpLibraryLocation);
				}

…ction Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

xHector1337 and others added 10 commits February 2, 2026 11:29

Add extension encryption manager

1554bc2

feat: extension encryption manager, wiring to library loading and com…

72214ad

…mand handling

fix: minor fixes in extension_encryption.c

b796d8b

feat: integrate Extension Encryption Manager into server setup

f7a0384

fix: streamline Extension Encryption Manager initialization in server…

e772f2e

… setup

fix: correct indentation for extension encryption includes in project…

a2b09b1

… files

fix: update extension count handling in extension encryption manager

24288ca

feat: enhance command processing with extension decryption support

094c1fe

feat: add get method to Extension Encryption Manager and improve erro…

f787835

…r handling

Add extension encryption manager

df37b63

xHector1337 force-pushed the add-extension-encryption-manager branch from b7248da to df37b63 Compare February 4, 2026 14:39

xHector1337 and others added 7 commits February 4, 2026 19:03

Merge branch 'add-extension-encryption-manager' into collab/feat/add-…

e37cf9c

…extension-encryption/manager

Merge pull request #2 from dledda-r7/collab/feat/add-extension-encryp…

7e2b157

…tion/manager Collaboration Extension Encryption

bug fix

14db760

revert the usage of GetTickCount in extension_encryption_encrypt

53441ce

add extensionFindDecrypt function

628ca94

add additional checks into extensionFindDecrypt and use it in command…

7559689

…_process_inline

modify the scheduler to make it work with extension encryption

3511b2f

dledda-r7 reviewed Feb 10, 2026

View reviewed changes

Comment thread c/meterpreter/source/metsrv/scheduler.c Outdated

dledda-r7 reviewed Feb 10, 2026

View reviewed changes

Comment thread c/meterpreter/source/metsrv/extension_encryption.h

dledda-r7 reviewed Feb 10, 2026

View reviewed changes

Comment thread c/meterpreter/source/metsrv/extension_encryption.c

xHector1337 and others added 6 commits February 11, 2026 18:57

bug fix in extension_encryption_add

985727e

store CryptographicManagerType in ExtensionEncryptionManager

f82a4e7

use extension_encrypt_unused in the command handler

6141c1d

define a new error type for extensionFindDecrypt and implement it on …

524575c

…the scheduler and command_process_inline

update extension_encryption.c

699fee0

fix: using correct base address for extension encryption manager, ref…

41918bd

…actor add function

Merge pull request #3 from dledda-r7/collab/feat/add-extension-encryp…

b900afd

…tion/manager-2 Fix base address, refactor add function

xHector1337 marked this pull request as ready for review March 22, 2026 06:46

dledda-r7 requested a review from Copilot April 16, 2026 15:31

Copilot started reviewing on behalf of dledda-r7 April 16, 2026 15:31 View session

Copilot AI reviewed Apr 16, 2026

View reviewed changes

dledda-r7 and others added 8 commits April 16, 2026 11:43

fix: ensure proper handling of encryption status and error conditions…

ca3b916

… in extension encryption functions

fix: add null check for ExtensionEncryptionManager in unused encrypt …

9ab8ab1

…function

fix: enhance cryptographic manager initialization and error handling …

2e03b92

…in extension encryption, sync rc4 stream

fix: improve decryption error handling in command processing and sche…

5187695

…duler threads

Merge pull request #4 from dledda-r7/collab/feat/add-extension-encryp…

845714c

…tion/manager-2 some other fixes

bug fixes

8d71c52

Merge branch 'master' into add-extension-encryption-manager

0ce6b62

fix: update extension encryptions post 6.5 merge for embedded extensions

ac1ab02

dledda-r7 requested a balanced review from Copilot August 10, 2026 09:02

Copilot started reviewing on behalf of dledda-r7 August 10, 2026 09:03 View session

Copilot AI reviewed Aug 10, 2026

View reviewed changes

Comment thread c/meterpreter/source/metsrv/extension_encryption.c

Comment thread c/meterpreter/source/metsrv/extension_encryption.c

Comment thread c/meterpreter/source/metsrv/extension_encryption.c

fix: set freed tmp buffer to NULL in extension_encryption encrypt fun…

13973bc

…ction Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

dledda-r7 reviewed Aug 10, 2026

View reviewed changes

Comment thread c/meterpreter/source/metsrv/scheduler.c

dledda-r7 reviewed Aug 10, 2026

View reviewed changes

Comment thread c/meterpreter/source/metsrv/scheduler.c Outdated

fix: fix scheduler logic for extension decryption

b381af1

Uh oh!

Conversation

xHector1337 commented Feb 2, 2026 • edited by dledda-r7 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Extension Encryption: Encryption Manager

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dledda-r7 commented Mar 5, 2026

Uh oh!

xHector1337 commented Mar 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

xHector1337 commented Feb 2, 2026 •

edited by dledda-r7

Loading