6.5 pre5 resolve windows bug#803
Draft
adfoster-r7 wants to merge 1 commit into
Draft
Conversation
There was a problem hiding this comment.
Pull request overview
This PR targets a Windows-specific stability/correctness issue in Meterpreter’s channel/socket handling, and makes the build Rake tasks fail fast when underlying commands fail.
Changes:
- Make
win_compileandjava_compileabort the Rake run whenmake.bat/mvnfails. - Fix
channel_writeto sendTLV_TYPE_LENGTHas the actual buffer length (instead of the channel id). - Add additional TCP/channel debug logging and mitigate a TCP client close race by nulling the channel pointer before teardown.
Impact Analysis:
- Blast radius: high; the
channel_writeTLV payload is part of the core Meterpreter wire contract and affects any consumer interpreting write acknowledgements, plus TCP channel teardown on Windows (direct) and any features built atop it (transitive). - Data and contract effects:
TLV_TYPE_LENGTHnow correctly represents byte length, changing on-the-wire semantics from incorrect to correct; this should fix downstream parsing/logic that relies onTLV_TYPE_LENGTHfor writes. - Rollback and test focus: rollback is straightforward (code-only), but validation should focus on Windows TCP channel open/write/close flows, write completion callbacks that consume
TLV_TYPE_LENGTH, and repeated connect/disconnect scenarios that previously reproduced the race.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| gem/Rakefile | Abort Rake tasks when Windows/Java build commands fail. |
| c/meterpreter/source/metsrv/channel.c | Fix TLV_TYPE_LENGTH in channel_write and add channel-close debug logging. |
| c/meterpreter/source/extensions/stdapi/server/net/socket/tcp.c | Add logging and reduce a channel teardown race by nulling ctx->channel earlier. |
| c/meterpreter/source/extensions/stdapi/server/net/socket/tcp_server.c | Add additional server-side socket/channel debug logging. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
adfoster-r7
force-pushed
the
6.5-pre5-resolve-windows-bug
branch
from
bfd4b61 to
67c91da
Compare
adfoster-r7
force-pushed
the
6.5-pre5-resolve-windows-bug
branch
from
67c91da to
ba7256a
Compare
| TcpClientContext *ctx = (TcpClientContext *)context; | ||
|
|
||
| dprintf( "[TCP] tcp_channel_client_close. channel=0x%08X, ctx=0x%08X", channel, ctx ); | ||
| dprintf("[TCP] tcp_channel_client_close. channel=0x%08X id=%u ctx=0x%08X", channel, met_api->channel.get_id(channel), ctx); |
Comment on lines
+198
to
+202
| // race where the framework sends core_channel_close concurrently, | ||
| // channel_destroy fires with ctx=NULL (skipping the ctx->channel=NULL | ||
| // assignment in tcp_channel_client_close), and free_socket_context | ||
| // subsequently calls channel_close on a dangling/recycled pointer. | ||
| ctx->channel = NULL; |
adfoster-r7
force-pushed
the
6.5-pre5-resolve-windows-bug
branch
2 times, most recently
from
9aff7cf to
535842d
Compare
Comment on lines
+228
to
+229
| dprintf("[TCP] tcp_channel_client_local_notify. [closed] chan=%p fd=%u read=0x%.8x", | ||
| (void*)chan, (DWORD)ctx->fd, dwBytesRead); |
| } | ||
|
|
||
| dprintf("[TCP-SERVER] free_tcp_server_context. ctx=0x%08X", ctx); | ||
| dprintf("[TCP-SERVER] free_tcp_server_context. ctx=0x%08X channel=0x%08X id=%u fd=%u", ctx, ctx->channel, ctx->channel ? met_api->channel.get_id(ctx->channel) : 0, (DWORD)ctx->fd); |
adfoster-r7
force-pushed
the
6.5-pre5-resolve-windows-bug
branch
from
535842d to
181a8b6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.