Block Api ROR13 IV randomization by dledda-r7 · Pull Request #21306 · rapid7/metasploit-framework

dledda-r7 · 2026-04-15T11:59:25Z

This PR updates the usage of Rex::Text.block_api_hash to take in account IV randomization.

The way it works is simple, the BlockApi and BlockApi_x64 will generate, per-run, a random IV (32 bit value) and will patch on-the-fly the asm_block_api output and will pass the iv to the Rex::Text.block_api_hash to have the updated hash

There also some other fix here and there and slight edge-cases covered, like handling how the migration stub generation works and also the exitfunk handling using a helper

dledda-r7 · 2026-04-15T13:05:03Z

I will put it in draft for now, there is more stuff to do on this

…api randomization

dledda-r7 · 2026-04-16T08:33:37Z

i'm unsure in what is the problem with CI, updating the cache size i am getting this that looks wrong:

[*] Single Updated: windows/x64/pingback_reverse_tcp CacheSize on disk at /home/kali/Documents/github/metasploit-framework/modules/payloads/singles/windows/x64/pingback_reverse_tcp.rb from 425 to :dynamic...
[*] Stager Updated: windows/x64/custom/bind_ipv6_tcp_uuid CacheSize on disk at /home/kali/Documents/github/metasploit-framework/modules/payloads/stagers/windows/x64/bind_ipv6_tcp_uuid.rb from 526 to :dynamic...
[*] Stager Updated: windows/x64/custom/bind_tcp_uuid CacheSize on disk at /home/kali/Documents/github/metasploit-framework/modules/payloads/stagers/windows/x64/bind_tcp_uuid.rb from 524 to :dynamic...
[*] Stager Updated: windows/x64/custom/reverse_http CacheSize on disk at /home/kali/Documents/github/metasploit-framework/modules/payloads/stagers/windows/x64/reverse_http.rb from 607 to :dynamic...
[*] Stager Updated: windows/x64/custom/reverse_https CacheSize on disk at /home/kali/Documents/github/metasploit-framework/modules/payloads/stagers/windows/x64/reverse_https.rb from 638 to :dynamic...
[*] Stager Updated: windows/x64/custom/reverse_tcp_uuid CacheSize on disk at /home/kali/Documents/github/metasploit-framework/modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb from 491 to :dynamic...
[*] Stager Updated: windows/x64/custom/reverse_winhttp CacheSize on disk at /home/kali/Documents/github/metasploit-framework/modules/payloads/stagers/windows/x64/reverse_winhttp.rb from 751 to :dynamic...
[*] Stager Updated: windows/x64/custom/reverse_winhttps CacheSize on disk at /home/kali/Documents/github/metasploit-framework/modules/payloads/stagers/windows/x64/reverse_winhttps.rb from 787 to :dynamic...

…s payloads

smcintyre-r7

We should be able to remove all the instances where you initialize the value by calling #block_api_iv.

Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>

…ethods

…load methods

Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>

dledda-r7 · 2026-04-20T13:20:59Z

With Rex::Text.block_api_hash being pretty well consolidated in framework now, we could update the return type to natively be an integer. It never really made sense to have it return the hexadecimal string.

The only missing is this one, will do asap

smcintyre-r7

Tested 32-bit and 64-bit stagers both with and without PrependMigrate. Code all looks good, and the API with how opts is handled is optimized for the most common use case where the IV is entirely handled by the library, but allows the caller to control it if necessary.

I think we're ready to land this now.

smcintyre-r7 · 2026-04-21T16:59:46Z

Release Notes

This updates the Block API shellcode to use a random IV when calculating the ROR13 hash of methods which it calls. The result is the removal of a static piece of data that could have been previously signatured.

dledda-r7 assigned smcintyre-r7 Apr 15, 2026

smcintyre-r7 added this to Metasploit Kanban Apr 15, 2026

github-project-automation Bot moved this to Todo in Metasploit Kanban Apr 15, 2026

smcintyre-r7 reviewed Apr 15, 2026

View reviewed changes

Comment thread lib/msf/core/payload/windows.rb

dledda-r7 marked this pull request as draft April 15, 2026 13:04

dledda-r7 added 8 commits April 16, 2026 04:24

feat: block api randomization for windows/x64/reverse_tcp

ab0fdf9

feat: block api randomization for x64 payloads

a54f29f

feat: block api randomization for x86 payloads

8a63392

feat: block api iv randomization in PrependMigrate

3233e3c

feat: refactor exit function handling to use helper method for block …

1f8bb3b

…api randomization

docs: adding small comment to call out block api randomization

b8f8366

feat: change exitfunc_helper to be accessible

2be47db

feat: refactor exit function handling to use block_api_hash

340a724

dledda-r7 force-pushed the feat/block-api-randomization branch from 942db86 to 340a724 Compare April 16, 2026 08:25

dledda-r7 added 2 commits April 16, 2026 08:37

feat: update register usage for block API calls to use r10d in variou…

a50041b

…s payloads

fix: updated cache size after blockapi changes

953d034

dledda-r7 marked this pull request as ready for review April 16, 2026 12:52

dledda-r7 added payload rn-payload-enhancement release notes for enhanced payloads labels Apr 16, 2026

smcintyre-r7 requested changes Apr 16, 2026

View reviewed changes

github-project-automation Bot moved this from Todo to Waiting on Contributor in Metasploit Kanban Apr 16, 2026

dledda-r7 and others added 5 commits April 17, 2026 11:23

Update lib/msf/core/payload/windows/x64/block_api_x64.rb

2af3bbf

Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>

Apply suggestion from @smcintyre-r7

b3ef4db

Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>

Apply suggestion from @smcintyre-r7

9d81fe0

Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>

refactor: remove redundant block_api_iv calls in payload generation m…

82c8028

…ethods

feat: enhance block_api_iv handling with warnings and options for pay…

679d2a9

…load methods

smcintyre-r7 requested changes Apr 17, 2026

View reviewed changes

Comment thread lib/msf/core/payload/windows/x64/block_api_x64.rb

Comment thread lib/msf/core/payload/windows/x64/block_api_x64.rb

Comment thread lib/msf/core/payload/windows/x64/block_api_x64.rb Outdated

Update lib/msf/core/payload/windows/x64/block_api_x64.rb

2c58825

Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>

dledda-r7 and others added 2 commits April 20, 2026 15:19

Update lib/msf/core/payload/windows/x64/block_api_x64.rb

5622bd2

Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>

Update lib/msf/core/payload/windows/x64/block_api_x64.rb

46553b5

Co-authored-by: Spencer McIntyre <58950994+smcintyre-r7@users.noreply.github.com>

smcintyre-r7 reviewed Apr 20, 2026

View reviewed changes

Comment thread lib/msf/core/payload/windows/block_api.rb

fix: block_api.rb update

e404228

smcintyre-r7 approved these changes Apr 21, 2026

View reviewed changes

github-project-automation Bot moved this from Waiting on Contributor to In Progress in Metasploit Kanban Apr 21, 2026

smcintyre-r7 merged commit 6a00ea3 into rapid7:master Apr 21, 2026
48 checks passed

github-project-automation Bot moved this from In Progress to Done in Metasploit Kanban Apr 21, 2026

Conversation

dledda-r7 commented Apr 15, 2026

Uh oh!

Uh oh!

dledda-r7 commented Apr 15, 2026

Uh oh!

dledda-r7 commented Apr 16, 2026

Uh oh!

smcintyre-r7 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dledda-r7 commented Apr 20, 2026

Uh oh!

Uh oh!

smcintyre-r7 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

smcintyre-r7 commented Apr 21, 2026

Release Notes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants