Removing imports from the IAT in metsrv by dledda-r7 · Pull Request #810 · rapid7/metasploit-payloads

dledda-r7 · 2026-08-11T09:04:43Z

Removing imports ✂️

after removal

┌──(kali㉿kali)-[~/…/github/metasploit-payloads/c/meterpreter]
└─$ rabin2 -s output/metsrv.x64.dll              
nth paddr      vaddr      bind   type size lib          name                            demangled
―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――
1   0x00009d60 0x6c84a960 GLOBAL FUNC 0    server.dll   Ordinal_1
1   0x00031edc 0x6c8792dc NONE   FUNC 0    KERNEL32.dll imp.DeleteCriticalSection
2   0x00031ee4 0x6c8792e4 NONE   FUNC 0    KERNEL32.dll imp.EnterCriticalSection
3   0x00031eec 0x6c8792ec NONE   FUNC 0    KERNEL32.dll imp.ExitProcess
4   0x00031ef4 0x6c8792f4 NONE   FUNC 0    KERNEL32.dll imp.ExitThread
5   0x00031efc 0x6c8792fc NONE   FUNC 0    KERNEL32.dll imp.GetComputerNameW
6   0x00031f04 0x6c879304 NONE   FUNC 0    KERNEL32.dll imp.GetCurrentProcess
7   0x00031f0c 0x6c87930c NONE   FUNC 0    KERNEL32.dll imp.GetCurrentProcessId
8   0x00031f14 0x6c879314 NONE   FUNC 0    KERNEL32.dll imp.GetCurrentThreadId
9   0x00031f1c 0x6c87931c NONE   FUNC 0    KERNEL32.dll imp.GetLastError
10  0x00031f24 0x6c879324 NONE   FUNC 0    KERNEL32.dll imp.GetModuleHandleA
11  0x00031f2c 0x6c87932c NONE   FUNC 0    KERNEL32.dll imp.GetModuleHandleW
12  0x00031f34 0x6c879334 NONE   FUNC 0    KERNEL32.dll imp.GetProcAddress
13  0x00031f3c 0x6c87933c NONE   FUNC 0    KERNEL32.dll imp.GetProcessHeap
14  0x00031f44 0x6c879344 NONE   FUNC 0    KERNEL32.dll imp.GetSystemDirectoryW
15  0x00031f4c 0x6c87934c NONE   FUNC 0    KERNEL32.dll imp.GetSystemTimeAsFileTime
16  0x00031f54 0x6c879354 NONE   FUNC 0    KERNEL32.dll imp.GetTickCount
17  0x00031f5c 0x6c87935c NONE   FUNC 0    KERNEL32.dll imp.GetVersionExW
18  0x00031f64 0x6c879364 NONE   FUNC 0    KERNEL32.dll imp.GetVolumeInformationW
19  0x00031f6c 0x6c87936c NONE   FUNC 0    KERNEL32.dll imp.HeapAlloc
20  0x00031f74 0x6c879374 NONE   FUNC 0    KERNEL32.dll imp.HeapFree
21  0x00031f7c 0x6c87937c NONE   FUNC 0    KERNEL32.dll imp.InitializeCriticalSection
22  0x00031f84 0x6c879384 NONE   FUNC 0    KERNEL32.dll imp.LeaveCriticalSection
23  0x00031f8c 0x6c87938c NONE   FUNC 0    KERNEL32.dll imp.LoadLibraryA
24  0x00031f94 0x6c879394 NONE   FUNC 0    KERNEL32.dll imp.QueryPerformanceCounter
25  0x00031f9c 0x6c87939c NONE   FUNC 0    KERNEL32.dll imp.RtlAddFunctionTable
26  0x00031fa4 0x6c8793a4 NONE   FUNC 0    KERNEL32.dll imp.RtlCaptureContext
27  0x00031fac 0x6c8793ac NONE   FUNC 0    KERNEL32.dll imp.RtlLookupFunctionEntry
28  0x00031fb4 0x6c8793b4 NONE   FUNC 0    KERNEL32.dll imp.RtlVirtualUnwind
29  0x00031fbc 0x6c8793bc NONE   FUNC 0    KERNEL32.dll imp.SetLastError
30  0x00031fc4 0x6c8793c4 NONE   FUNC 0    KERNEL32.dll imp.SetUnhandledExceptionFilter
31  0x00031fcc 0x6c8793cc NONE   FUNC 0    KERNEL32.dll imp.Sleep
32  0x00031fd4 0x6c8793d4 NONE   FUNC 0    KERNEL32.dll imp.TerminateProcess
33  0x00031fdc 0x6c8793dc NONE   FUNC 0    KERNEL32.dll imp.TlsGetValue
34  0x00031fe4 0x6c8793e4 NONE   FUNC 0    KERNEL32.dll imp.UnhandledExceptionFilter
35  0x00031fec 0x6c8793ec NONE   FUNC 0    KERNEL32.dll imp.VirtualProtect
36  0x00031ff4 0x6c8793f4 NONE   FUNC 0    KERNEL32.dll imp.VirtualQuery
1   0x00032004 0x6c879404 NONE   FUNC 0    msvcrt.dll   imp.__iob_func
2   0x0003200c 0x6c87940c NONE   FUNC 0    msvcrt.dll   imp._amsg_exit
3   0x00032014 0x6c879414 NONE   FUNC 0    msvcrt.dll   imp._errno
4   0x0003201c 0x6c87941c NONE   FUNC 0    msvcrt.dll   imp._initterm
5   0x00032024 0x6c879424 NONE   FUNC 0    msvcrt.dll   imp._lock
6   0x0003202c 0x6c87942c NONE   FUNC 0    msvcrt.dll   imp._snprintf_s
7   0x00032034 0x6c879434 NONE   FUNC 0    msvcrt.dll   imp._snwprintf_s
8   0x0003203c 0x6c87943c NONE   FUNC 0    msvcrt.dll   imp._strdup
9   0x00032044 0x6c879444 NONE   FUNC 0    msvcrt.dll   imp._time64
10  0x0003204c 0x6c87944c NONE   FUNC 0    msvcrt.dll   imp._unlock
11  0x00032054 0x6c879454 NONE   FUNC 0    msvcrt.dll   imp._vsnprintf
12  0x0003205c 0x6c87945c NONE   FUNC 0    msvcrt.dll   imp._wcsdup
13  0x00032064 0x6c879464 NONE   FUNC 0    msvcrt.dll   imp.abort
14  0x0003206c 0x6c87946c NONE   FUNC 0    msvcrt.dll   imp.atoi
15  0x00032074 0x6c879474 NONE   FUNC 0    msvcrt.dll   imp.atol
16  0x0003207c 0x6c87947c NONE   FUNC 0    msvcrt.dll   imp.calloc
17  0x00032084 0x6c879484 NONE   FUNC 0    msvcrt.dll   imp.free
18  0x0003208c 0x6c87948c NONE   FUNC 0    msvcrt.dll   imp.fwrite
19  0x00032094 0x6c879494 NONE   FUNC 0    msvcrt.dll   imp.malloc
20  0x0003209c 0x6c87949c NONE   FUNC 0    msvcrt.dll   imp.mbstowcs
21  0x000320a4 0x6c8794a4 NONE   FUNC 0    msvcrt.dll   imp.memcmp
22  0x000320ac 0x6c8794ac NONE   FUNC 0    msvcrt.dll   imp.memcpy
23  0x000320b4 0x6c8794b4 NONE   FUNC 0    msvcrt.dll   imp.memmove
24  0x000320bc 0x6c8794bc NONE   FUNC 0    msvcrt.dll   imp.memset
25  0x000320c4 0x6c8794c4 NONE   FUNC 0    msvcrt.dll   imp.rand
26  0x000320cc 0x6c8794cc NONE   FUNC 0    msvcrt.dll   imp.realloc
27  0x000320d4 0x6c8794d4 NONE   FUNC 0    msvcrt.dll   imp.signal
28  0x000320dc 0x6c8794dc NONE   FUNC 0    msvcrt.dll   imp.srand
29  0x000320e4 0x6c8794e4 NONE   FUNC 0    msvcrt.dll   imp.strchr
30  0x000320ec 0x6c8794ec NONE   FUNC 0    msvcrt.dll   imp.strcmp
31  0x000320f4 0x6c8794f4 NONE   FUNC 0    msvcrt.dll   imp.strlen
32  0x000320fc 0x6c8794fc NONE   FUNC 0    msvcrt.dll   imp.strncmp
33  0x00032104 0x6c879504 NONE   FUNC 0    msvcrt.dll   imp.strncpy_s
34  0x0003210c 0x6c87950c NONE   FUNC 0    msvcrt.dll   imp.strrchr
35  0x00032114 0x6c879514 NONE   FUNC 0    msvcrt.dll   imp.strstr
36  0x0003211c 0x6c87951c NONE   FUNC 0    msvcrt.dll   imp.vfprintf
37  0x00032124 0x6c879524 NONE   FUNC 0    msvcrt.dll   imp.wcscat_s
38  0x0003212c 0x6c87952c NONE   FUNC 0    msvcrt.dll   imp.wcschr
39  0x00032134 0x6c879534 NONE   FUNC 0    msvcrt.dll   imp.wcscmp
40  0x0003213c 0x6c87953c NONE   FUNC 0    msvcrt.dll   imp.wcscpy_s
41  0x00032144 0x6c879544 NONE   FUNC 0    msvcrt.dll   imp.wcslen
42  0x0003214c 0x6c87954c NONE   FUNC 0    msvcrt.dll   imp.wcsncmp
43  0x00032154 0x6c879554 NONE   FUNC 0    msvcrt.dll   imp.wcsncpy_s
44  0x0003215c 0x6c87955c NONE   FUNC 0    msvcrt.dll   imp.wcsstr
45  0x00032164 0x6c879564 NONE   FUNC 0    msvcrt.dll   imp.wcstombs
46  0x0003216c 0x6c87956c NONE   FUNC 0    msvcrt.dll   imp.wcstombs_s
                                                                                                                                                                                        
┌──(kali㉿kali)-[~/…/github/metasploit-payloads/c/meterpreter]
└─$

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

dledda-r7 · 2026-08-11T09:37:19Z

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

neither copilot want to review my code :sadness:

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

c/meterpreter/source/metsrv/server_setup.c:388

Important: Problem: this still calls GetUserObjectInformationA/GetThreadDesktop directly rather than via met_api->win_api.* like the rest of the PR. Impact: leaves user32 imports in the IAT and contradicts the stated goal of removing imports. Fix: route both calls through met_api->win_api.user32 wrappers.

			GetUserObjectInformationA(met_api->win_api.user32.GetProcessWindowStation(), UOI_NAME, &stationName, 256, NULL);
			remote->orig_station_name = _strdup(stationName);
			remote->curr_station_name = _strdup(stationName);
			GetUserObjectInformationA(GetThreadDesktop(GetCurrentThreadId()), UOI_NAME, &desktopName, 256, NULL);

c/meterpreter/source/metsrv/winapi.c:219

Suggestion: Problem: the forwarder-resolution comment claims support for ".#Ordinal" forwarders, but the implementation always re-hashes the substring after '.' and will not resolve ordinals. Impact: the comment is misleading and makes future maintenance/debugging harder. Fix: either implement ordinal parsing or adjust the comment to match current behavior.

            // Forwarder detection: if the RVA falls inside the export directory,
            // the "address" is actually a forwarder string of the form
            // "TargetDll.TargetFunction" (or ".#Ordinal"). We must resolve it in
            // the target DLL rather than returning the string as a function.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

dledda-r7 · 2026-08-11T13:09:16Z

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

skills issues

…lity

…t command

github-project-automation Bot added this to Metasploit Kanban Aug 11, 2026

github-project-automation Bot moved this to Todo in Metasploit Kanban Aug 11, 2026

dledda-r7 requested a balanced review from Copilot August 11, 2026 09:35

Copilot started reviewing on behalf of dledda-r7 August 11, 2026 09:36 View session

Copilot AI reviewed Aug 11, 2026

dledda-r7 requested a balanced review from Copilot August 11, 2026 09:37

Copilot started reviewing on behalf of dledda-r7 August 11, 2026 09:38 View session

Copilot AI reviewed Aug 11, 2026

dledda-r7 requested a lite review from Copilot August 11, 2026 09:43

Copilot started reviewing on behalf of dledda-r7 August 11, 2026 09:43 View session

Copilot AI reviewed Aug 11, 2026

View reviewed changes

Comment thread c/meterpreter/source/metsrv/packet_encryption.c

adfoster-r7 requested a balanced review from Copilot August 11, 2026 10:53

Copilot started reviewing on behalf of adfoster-r7 August 11, 2026 10:54 View session

Copilot AI reviewed Aug 11, 2026

msutovsky-r7 self-assigned this Aug 11, 2026

dledda-r7 added 3 commits August 17, 2026 12:04

feat(metsrv): removing some imports from IAT, improving GetProcAddressH

94095be

feat(metsrv): refactor CryptAcquireContext calls for better compatibi…

48ba529

…lity

feat(metsrv): remove IAT imports on metsrv

854a95d

dledda-r7 force-pushed the feat/remove-imports-metsrv-3 branch from 6af3280 to 854a95d Compare August 17, 2026 11:39

fix: update exit logic to avoid segment fault during migration or exi…

99d0f59

…t command

msutovsky-r7 approved these changes Aug 24, 2026

View reviewed changes

github-project-automation Bot moved this from Todo to In Progress in Metasploit Kanban Aug 24, 2026

msutovsky-r7 merged commit 10a007a into rapid7:master Aug 25, 2026
31 checks passed

github-project-automation Bot moved this from In Progress to Done in Metasploit Kanban Aug 25, 2026

Navigation Menu

Uh oh!

Removing imports from the IAT in metsrv - #810

Removing imports from the IAT in metsrv#810
msutovsky-r7 merged 4 commits into
rapid7:masterfrom
dledda-r7:feat/remove-imports-metsrv-3

dledda-r7 commented Aug 11, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

dledda-r7 commented Aug 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

dledda-r7 commented Aug 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

dledda-r7 commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

dledda-r7 commented Aug 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

dledda-r7 commented Aug 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dledda-r7 commented Aug 11, 2026 •

edited

Loading