Skip to content

Update PHP Meterpreter errors#802

Merged
dledda-r7 merged 1 commit into
rapid7:6.5from
adfoster-r7:update-php-meterpreter-errors
Jul 8, 2026
Merged

Update PHP Meterpreter errors#802
dledda-r7 merged 1 commit into
rapid7:6.5from
adfoster-r7:update-php-meterpreter-errors

Conversation

@adfoster-r7

@adfoster-r7 adfoster-r7 commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Update PHP Meterpreter to resolve the following errors:

1) Meterpreter php stageless php/meterpreter_reverse_tcp linux post/test/socket_channels linux/php meterpreter successfully opens a session for the "php/meterpreter_reverse_tcp" payload and passes the "post/test/socket_channels" tests
     Got 2 failures from failure aggregation block "\"php/meterpreter_reverse_tcp\" payload and passes the \"post/test/socket_channels\" tests".

...

     1.1) Failure/Error: expect(test_line).to_not include('FAILED', '[-] FAILED', '[-] Exception', '[-] '), "Unexpected error: #{test_line}"
            Unexpected error: [-] FAILED: [TCP-Client] Propagates close events from the peer
          # ./vendor/bundle/ruby/3.4.0/gems/rspec-expectations-3.13.5/lib/rspec/expectations/failure_aggregator.rb:69:in 'RSpec::Expectations::FailureAggregator#call'
          # ./vendor/bundle/ruby/3.4.0/gems/rspec-support-3.13.6/lib/rspec/support.rb:119:in 'RSpec::Support.notify_failure'

...

     1.2) Failure/Error: expect(test_line).to_not include('FAILED', '[-] FAILED', '[-] Exception', '[-] '), "Unexpected error: #{test_line}"
            Unexpected error: [-] FAILED: [TCP-Server] Propagates close events from the peer
          # ./vendor/bundle/ruby/3.4.0/gems/rspec-expectations-
  • Resolve an existing OSX/freebsd error when listing host processes:
ec2-user@freebsd:~ $ ps ax -w -o pid,user,cmd --no-header
ps: cmd: keyword not found
ps: illegal option -- -
usage: ps [--libxo] [-aCcdefHhjlmrSTuvwXxZ] [-O fmt | -o fmt]
          [-G gid[,gid...]] [-J jid[,jid...]] [-M core] [-N system]
          [-p pid[,pid...]] [-t tty[,tty...]] [-U user[,user...]]
          [-D up | down | both]
       ps [--libxo] -L

Testing

Before 🔴

PHP test errors

After 🟢

It's gone green on CI here:

image

@adfoster-r7 adfoster-r7 force-pushed the update-php-meterpreter-errors branch 3 times, most recently from cf992a7 to 600fb24 Compare July 7, 2026 21:57
@adfoster-r7 adfoster-r7 requested a review from Copilot July 7, 2026 22:43

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the PHP Meterpreter implementation to improve channel/socket close handling (to address acceptance-test failures), makes process enumeration more portable across ps variants, and adjusts the CI reusable-workflow invocation to test PR heads.

Changes:

  • Adjusts dead-channel notification to write back on the active transport socket instead of relying on a global C2 socket.
  • Updates read() to treat empty reads as peer-closed (EOF) for both sockets and streams.
  • Makes stdapi_sys_process_get_processes ps invocation portable and updates the GitHub Actions workflow to use a versioned reusable workflow and pass PR head repo/commit.

Impact Analysis:

  • Blast radius: Medium—affects PHP Meterpreter core I/O and channel lifecycle behavior (all PHP sessions using TCP transport; HTTP behavior is potentially impacted where _socket is absent).
  • Data and contract effects: No schema changes, but changes the conditions under which EOF is surfaced as false and when channel-close TLVs are emitted; may affect interoperability with Metasploit channel semantics on disconnect paths.
  • Rollback and test focus: Low rollback friction (single-file logic changes), but validate: TCP client/server close propagation, partial-packet reads, and any scenarios where the current transport is HTTP (no _socket) while channels are active.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File Description
php/meterpreter/meterpreter.php Refactors dead-channel handling to use an explicit C2 socket and tightens EOF detection in socket/stream reads.
php/meterpreter/ext_server_stdapi.php Updates ps output formatting to suppress headers portably and use POSIX command.
.github/workflows/metasploit-framework-meterpreter_acceptance.yml Pins reusable workflow version and passes payloads repo/commit for PR head testing.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread php/meterpreter/meterpreter.php Outdated
Comment thread php/meterpreter/meterpreter.php
Comment thread php/meterpreter/meterpreter.php
Comment thread php/meterpreter/meterpreter.php Outdated
@adfoster-r7 adfoster-r7 force-pushed the update-php-meterpreter-errors branch from 190183b to 77848bb Compare July 8, 2026 08:48
Comment thread php/meterpreter/ext_server_stdapi.php Outdated
# Use empty column-name syntax (pid=,user=,command=) to suppress the
# header portably on both Linux procps-ng and macOS/BSD ps.
# 'command' is the POSIX name; Linux also accepts 'cmd' but macOS does not.
$output = my_cmd("ps ax -w -o pid=,user=,command= 2>/dev/null");

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

old on OSX:

$ ps ax -w -o pid,user,cmd --no-header             
ps: cmd: keyword not found
ps: illegal option -- -
usage: ps [-AaCcEefhjlMmrSTvwXx] [-O fmt | -o fmt] [-G gid[,gid...]]
          [-u]
          [-p pid[,pid...]] [-t tty[,tty...]] [-U user[,user...]]
       ps [-L]

new on OSX:

$ ps ax -w -o pid=,user=,command= 
    1 root             /sbin/launchd
  120 root             /usr/libexec/logd
  121 root             /usr/libexec/smd

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like this didn't support freebsd still, updated

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

Comment thread php/meterpreter/meterpreter.php
Comment thread php/meterpreter/meterpreter.php
Comment thread php/meterpreter/meterpreter.php

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Comment thread php/meterpreter/meterpreter.php
Comment thread php/meterpreter/meterpreter.php Outdated

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comment thread php/meterpreter/meterpreter.php
@adfoster-r7 adfoster-r7 force-pushed the update-php-meterpreter-errors branch from d7211e0 to 8c23409 Compare July 8, 2026 11:12
@dledda-r7 dledda-r7 merged commit 5411624 into rapid7:6.5 Jul 8, 2026
5 of 28 checks passed
smcintyre-r7 pushed a commit that referenced this pull request Jul 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants