From 0f3cd4911874303ef19f19520acee4ce067a6f65 Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Tue, 10 Feb 2026 15:04:51 -0500
Subject: [PATCH 1/2] Fix TCP server channel parameters

---
 .../base/sessions/ssh_command_shell_bind.rb   | 29 ++++++++++---------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/lib/msf/base/sessions/ssh_command_shell_bind.rb b/lib/msf/base/sessions/ssh_command_shell_bind.rb
index 1f4d8f946e0c2..0d02158f14800 100644
--- a/lib/msf/base/sessions/ssh_command_shell_bind.rb
+++ b/lib/msf/base/sessions/ssh_command_shell_bind.rb
@@ -141,14 +141,15 @@ def write(buf, length = nil)
     # Represents an SSH reverse port forward.
     # Will receive connection messages back from the SSH server,
     # whereupon a TcpClientChannel will be opened
+
     class TcpServerChannel
       include Rex::IO::StreamServer
 
-      def initialize(params, client, host, port)
+      attr_reader :params
+
+      def initialize(params, client)
         @params = params
         @client = client
-        @host = host
-        @port = port
         @channels = []
         @closed = false
         @mutex = Mutex.new
@@ -181,7 +182,7 @@ def closed?
 
       def close
         if !closed?
-          @closed = @client.stop_server_channel(@host, @port)
+          @closed = @client.stop_server_channel(@params.localhost, @params.localport)
         end
       end
 
@@ -305,21 +306,23 @@ def create_server_channel(params)
       timed_out = false
       @ssh_connection.send_global_request('tcpip-forward', :string, params.localhost, :long, params.localport) do |success, response|
         mutex.synchronize {
-          remote_port = params.localport
-          remote_port = response.read_long if remote_port == 0
+          if params.localport == 0
+            params.localport = response.read_long
+          end
+
           if success
             if timed_out
               # We're not using the port; clean it up
-              elog("Remote forwarding on #{params.localhost}:#{params.localport} succeeded after timeout. Stopping channel to clean up dangling port")
-              stop_server_channel(params.localhost, remote_port)
+              elog("Remote forwarding on #{Rex::Socket.to_authority(params.localhost, params.localport)} succeeded after timeout. Stopping channel to clean up dangling port")
+              stop_server_channel(params.localhost, params.localport)
             else
-              dlog("Remote forwarding from #{params.localhost} established on port #{remote_port}")
-              key = [params.localhost, remote_port]
-              msf_channel = TcpServerChannel.new(params, self, params.localhost, remote_port)
+              dlog("Remote forwarding from #{params.localhost} established on port #{params.localport}")
+              key = [params.localhost, params.localport]
+              msf_channel = TcpServerChannel.new(params, self)
               @server_channels[key] = msf_channel
             end
           else
-              elog("Remote forwarding failed on #{params.localhost}:#{params.localport}")
+            elog("Remote forwarding failed on #{Rex::Socket.to_authority(params.localhost, params.localport)}")
           end
           condition.signal
         }
@@ -364,7 +367,7 @@ def create_client_channel(params)
       condition = ConditionVariable.new
       opened = false
       ssh_channel = @ssh_connection.open_channel('direct-tcpip', :string, params.peerhost, :long, params.peerport, :string, params.localhost, :long, params.localport) do |_|
-        dlog("new direct-tcpip channel opened to #{Rex::Socket.is_ipv6?(params.peerhost) ? '[' + params.peerhost + ']' : params.peerhost}:#{params.peerport}")
+        dlog("new direct-tcpip channel opened to #{Rex::Socket.to_authority(params.peerhost, params.peerport)}")
         opened = true
         mutex.synchronize do
           condition.signal

From d569fc552d73b777e3e75a17f35502af0a78a32e Mon Sep 17 00:00:00 2001
From: Spencer McIntyre <zeroSteiner@gmail.com>
Date: Tue, 10 Feb 2026 16:12:11 -0500
Subject: [PATCH 2/2] Apply the #shutdown to the correct socket

---
 lib/msf/base/sessions/ssh_command_shell_bind.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/msf/base/sessions/ssh_command_shell_bind.rb b/lib/msf/base/sessions/ssh_command_shell_bind.rb
index 0d02158f14800..983bced50ee74 100644
--- a/lib/msf/base/sessions/ssh_command_shell_bind.rb
+++ b/lib/msf/base/sessions/ssh_command_shell_bind.rb
@@ -73,7 +73,7 @@ def initialize(client, cid, ssh_channel, params)
 
         ssh_channel.on_eof do |_ch|
           dlog('ssh_channel#on_eof shutting down the socket')
-          rsock.shutdown(Socket::SHUT_WR)
+          lsock.shutdown(Socket::SHUT_WR)
         end
 
         lsock.extend(SocketInterface)
@@ -313,7 +313,7 @@ def create_server_channel(params)
           if success
             if timed_out
               # We're not using the port; clean it up
-              elog("Remote forwarding on #{Rex::Socket.to_authority(params.localhost, params.localport)} succeeded after timeout. Stopping channel to clean up dangling port")
+              elog("Remote forwarding on #{Rex::Socket.to_authority(params.localhost, params.localport)} succeeded after timeout, stopping channel to clean up dangling port")
               stop_server_channel(params.localhost, params.localport)
             else
               dlog("Remote forwarding from #{params.localhost} established on port #{params.localport}")