Add Windows AARCH64 support to fetch payloads
@vinicius-batistella if you are interested, let me know and I'll assign this to you.
Summary
We recently added binary aarch64 payloads. Let's add them to the Fetch Payloads.
Basic example
Functionally, this is pretty straight-forward. Inside https://github.com/rapid7/metasploit-framework/tree/master/modules/payloads/adapters/cmd/windows are folders for each transport protocol, and inside each transport protocol folder are payload adapter files connecting the transport Fetch command stager to the binary architecture. This sounds daunting, but there are already x86 and x64 adapters in there, and it is just a matter of copying them and changing a couple lines to point to AARCH64 rather than x64. Testing all of the permutations of fetch transports and binary payloads once support is added will probably take a lot longer than adding support.
For example, the AARCH64 HTTP payload would be:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
module MetasploitModule
include Msf::Payload::Adapter::Fetch::HTTP
include Msf::Payload::Adapter::Fetch::WindowsOptions
def initialize(info = {})
super(
update_info(
info,
'Name' => 'HTTP Fetch',
'Description' => 'Fetch and execute an AARCH64 payload from an HTTP server.',
'Author' => 'Brendan Watters',
'Platform' => 'win',
'Arch' => ARCH_CMD,
'License' => MSF_LICENSE,
'AdaptedArch' => ARCH_AARCH64,
'AdaptedPlatform' => 'win'
)
)
deregister_options('FETCH_COMMAND')
register_options(
[
Msf::OptEnum.new('FETCH_COMMAND', [true, 'Command to fetch payload', 'CERTUTIL', %w[CURL CERTUTIL]])
]
)
end
endI think I only changed 2 lines?
Motivation
Increase support for AARCH64 Windows.
Source: rapid7/metasploit-framework