Using latest meterpreter with metasploit

[markji]

I am not sue whether this is the right place to ask this question. If it is not, I am sorry, and would appreciate if you point me to the right forum.

As far as I understand, metasploit currently uses binaries that were built from a rather old meterpeter commit (meterpreter commit 51b1a6d1dce9f617ab5fe0f27796e2217d9a9ca6 according to https://github.com/rapid7/meterpreter_bins/blob/master/meterpreter_bins.gemspec).

I would appreciate your help on understanding how can I make metasploit work with a more recent version of meterpreter.

Thank you,
Mark

[bcook-r7]

Hi Mark,

The latest meterpreter binaries are no longer being built in the meterpreter_bins gem. A new gem called 'metasploit-payloads' replaces it. If you use the latest version of metasploit-framework, you should already have it as a side-effect of running 'bundle install'. See rapid7/meterpreter#110 (comment) for discussion of the rationale for the new gem, which includes other binaries as well.

I will add a note to metasploit_bins' repo to redirect to the new repo. Thanks.

• Brent

[markji]

Hi Brent,

thanks for your reply.

I am still missing something and cannot get the latest metasploit to work with the latest meterpreter.

I downloaded the latest meterpreter repository and built using make.bat under VS2013 console. I then copied the output DLLs (including the metsrv DLLs) to the relevant directory under metasploit-payloads, overwriting the original DLLs that came with metasploit.

Is that all I should do?
Because it seems meterpreter now does not work. Debugging it, it seems it is infinitely looping between the transport, unable to connect. Needless to say, it works perfectly under the same settings and configuration when the original metsrv DLL is use.

Thanks again for your help.

[OJ]

@markji There's a lot of churn at the moment in the Meterpreter binaries. It's super important to make sure that your version of MSF is in sync with Meterpreter. If you have old binaries and a new MSF, or new binaries and an old MSF, it'll break.

Are you using Kali? Are you using MSF from git master? Ultimately, if you've installed a version from somewhere or are using something like Kali, then manually updating the meterpreter binaries will cause you grief. Either do it all from your distro/install or do it all from git. Between the two is no-mans-land.

[bcook-r7]

First, I do not recommend that you overwrite files in the gem. Instead, simply copy the DLLs to data/meterpreter under the framework directory. In the metasploit-payloads repository, there is a simple 'make install' that does this as well. The framework will automatically prefer files under data/meterpreter. If you want to switch back, just delete data/meterpreter/*.dll from your framework tree.

Second, it would be helpful to mention the version of the metasploit-payloads gem you have installed. The latest version of metasploit-framework has the following line in metasploit-framework.gemspec:

spec.add_runtime_dependency 'metasploit-payloads', '0.0.7'

If your copy of metasploit-framework does not show 0.0.7, binaries built from the current HEAD for the meterpreter repository will not be compatible with your copy of framework, and you should update framework.

At some point, when I can convince all of the developers to start using the metasploit-payloads repo for development, we will be able to tag the source that a particular gem version was built from :)