metasploit_payloads-mettle 1.0.47 → 1.0.48.pre.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e854a80f5734f828b0a73b8d78c5300b3dfe22923ac282c97cab824b73cf28bd
-  data.tar.gz: c4ded9252cab3c19cdcd1275b4dc82c0d2546f134f587515e73356b288e9073f
+  metadata.gz: 9300e087f6aeb5624418edca451f73c44c5eb0e8d9725ccd24bb3da9f11565c8
+  data.tar.gz: 6928973f689d58601acadd0b530e9e248fb77700fc0bf0c00dc271861adf6183
 SHA512:
-  metadata.gz: e825e5bad4aa1a8ce2593d72757190ab62139175d316cf57ea257a1d18b6d380df94a1056997ace6b6af0c0d95e865ef9eb28b799b3411cc5cfe76ea020254ab
-  data.tar.gz: 4712b32f64aa373eaaf16975b672fe5292817f3b7d7822432f3d605c62b75f7b85cd12f07f0705d8a1c84ff7f87e0c4e5386076600ca84e372a41133b2ac29f4
+  metadata.gz: 7cf43fbd94e0bdaec4540f1497c0ff4997dd05d1275f191689bb8dd137a44c01ed72e8d89c2c4b0fb5102cb659b3301624183a4123dc7eee84eb257b4d0d1330
+  data.tar.gz: accb75cd4baf1b8b6bbcc7b622ac60acfb729a08224ff8ebcd3fbecc75e311881af352f9b2aa003c0485bc171282a183fa89360f2c2960fee34efc2f00819d25

data/lib/metasploit_payloads/mettle/version.rb

@@ -1,7 +1,7 @@
 # -*- coding:binary -*-
 module MetasploitPayloads
   class Mettle
-    VERSION = '1.0.47'
+    VERSION = '1.0.48.pre.2'
 
     def self.version
       VERSION

data/lib/metasploit_payloads/mettle.rb

@@ -16,6 +16,8 @@ module MetasploitPayloads
 
     CMDLINE_MAX = 2000
     CMDLINE_SIG = 'DEFAULT_OPTS'.freeze
+    CONFIG_BLOCK_MAX = 8192
+    CONFIG_BLOCK_SIG = 'CONFIG_BLOCK'.freeze
     #
     # Config is a hash. Valid keys are:
     #  :uri to connect to
@@ -36,6 +38,9 @@ module MetasploitPayloads
     def to_binary(format=:process_image)
       bin = self.class.read(@platform, format)
       unless @config.empty?
+        if @config[:config_block]
+          bin = add_config_block(bin, @config[:config_block])
+        end
         params = generate_argv
         bin = add_args(bin, params)
       end
@@ -47,6 +52,10 @@ module MetasploitPayloads
     def generate_argv
       cmd_line = 'mettle '
       @config.each do |opt, val|
+        # :config_block is embedded into the binary via add_config_block (a
+        # TLV blob parsed natively); it is not a command-line option.
+        next if opt == :config_block
+
         cmd_line << "-#{short_opt(opt)} \"#{val}\" "
       end
       if cmd_line.length > CMDLINE_MAX
@@ -77,6 +86,20 @@ module MetasploitPayloads
       end
     end
 
+    # Layout in the binary: [length:4 BE][config_bytes][zero padding] within
+    # the CONFIG_BLOCK_MAX-byte slot. Carrying the length explicitly avoids
+    # a trailing-null ambiguity — the XOR-encoded config can legitimately
+    # end in 0x00, which would otherwise be eaten by a backward scan.
+    def add_config_block(bin, config_bytes)
+      usable = CONFIG_BLOCK_MAX - 4
+      if config_bytes.length > usable
+        raise Mettle::Error, 'mettle config block too large', caller
+      end
+      payload = [config_bytes.length].pack('N') + config_bytes
+      padded = payload + "\x00" * (CONFIG_BLOCK_MAX - payload.length)
+      bin.sub(CONFIG_BLOCK_SIG + "\x00" * (CONFIG_BLOCK_MAX - CONFIG_BLOCK_SIG.length), padded)
+    end
+
     def add_args(bin, params)
       if params[8] != "\x00"
         bin.sub(CMDLINE_SIG +  ' ' * (CMDLINE_MAX - CMDLINE_SIG.length), params)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit_payloads-mettle
 version: !ruby/object:Gem::Version
-  version: 1.0.47
+  version: 1.0.48.pre.2
 platform: ruby
 authors:
 - Adam Cammack
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-02 00:00:00.000000000 Z
+date: 2026-07-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -141,9 +141,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
 rubygems_version: 3.3.27
 signing_key: