Fix Windows Meterpreter migrate config transports - #805
Merged
adfoster-r7 merged 1 commit intoJul 14, 2026
Conversation
Wrap migrated transport config entries in TLV_TYPE_C2 groups so metsrv can recreate transports after migration. Fail setup when no transport is created instead of continuing with a null transport.
Contributor
|
Before 🔴 Working 🟢 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This fixes Windows Meterpreter migration when migrating into an explicit PID from the 6.5 branch.
During migration, metsrv serializes the current transport configuration into a packet that is consumed by the newly injected Meterpreter instance. The 6.5 branch was writing transport TLVs directly into the top-level config packet instead of wrapping each transport in a TLV_TYPE_C2 group. The new metsrv instance reconstructs transports by enumerating top-level TLV_TYPE_C2 groups, so no transport was created after migration and the migrated session died.
This change mirrors the transport-list serialization pattern used elsewhere by writing each transport config into a group packet and adding that group as TLV_TYPE_C2. It also fails transport setup if no transport can be created, avoiding continuation with a null transport.
Related Issue: N/A
Breaking Changes
None
Reviewer Notes
The key change is in c/meterpreter/source/metsrv/server_setup.c.
config_create now serializes each transport into its own grouped C2 packet before adding it to the migration config. create_transports now treats failed transport creation, or a final null transport list, as setup failure.
Verification Steps
psto list processesTest Evidence
Testing Output
You can see I symlink x64 bins for testing. The first run allows me to migrate successfully. After that I remove the test bins, run the migrate test again and see it fail.
Environment
Field Details
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Operating System Windows Server 2019 target
────────────────────────────── ────────────────────────────
Target Software/Hardware Windows Meterpreter
────────────────────────────── ────────────────────────────
Docker Image / Vagrant Setup N/A
AI Usage Disclosure
AI was used to assist with reproduction analysis, root-cause investigation, patch implementation, and drafting this PR description.
Pre-Submission Checklist
(https://docs.metasploit.com/docs/development/maintainers/process/guidelines-for-accepting-modules-and-enhancements.html)