Resolve test failures for c2 branch

Author: adfoster-r7

.github/workflows/command_shell_acceptance.yml

@@ -27,7 +27,7 @@ on:
       metasploitPayloadsCommit:
         description: 'metasploit-payloads branch you want to test'
         required: true
-        default: 'master'
+        default: '6.5'
       mettleCommit:
         description: 'mettle branch you want to test'
         required: true

.github/workflows/meterpreter_acceptance.yml

@@ -27,11 +27,11 @@ on:
       metasploit_payloads_commit:
         description: 'metasploit-payloads branch you want to test'
         required: true
-        default: 'master'
+        default: '6.5'
       mettle_commit:
         description: 'mettle branch you want to test'
         required: true
-        default: 'master'
+        default: '6.5'
   push:
     branches-ignore:
       - gh-pages
@@ -61,7 +61,8 @@ jobs:
   build:
     uses: ./.github/workflows/shared_meterpreter_acceptance.yml
     with:
-      metasploit_payloads_commit: ${{ github.event.inputs.metasploit_payloads_commit }}
-      mettle_commit: ${{ github.event.inputs.mettle_commit }}
-      build_metasploit_payloads: ${{ contains(github.event.pull_request.labels.*.name, 'payload-testing-branch') }}
-      build_mettle: ${{ contains(github.event.pull_request.labels.*.name, 'payload-testing-mettle-branch') }}
+      metasploit_payloads_repo: adfoster-r7/metasploit-payloads
+      metasploit_payloads_commit: update-php-meterpreter-errors
+      mettle_commit: ${{ github.event.inputs.mettle_commit || '6.5' }}
+      build_metasploit_payloads: true
+      build_mettle: true

.github/workflows/shared_meterpreter_acceptance.yml

@@ -13,6 +13,11 @@ on:
         default: ''
         required: false
         type: string
+      metasploit_payloads_repo:
+        description: "metasploit-payloads repository to build with (e.g. a fork: myuser/metasploit-payloads)"
+        default: 'rapid7/metasploit-payloads'
+        required: false
+        type: string
       mettle_commit:
         description: "mettle commit to build with"
         default: ''
@@ -30,19 +35,19 @@ on:
         type: boolean
 
 jobs:
-  # Compile the Meterpreter payloads via docker if required, we can't always do this on the
-  # host environment (i.e. for macos). So it instead gets compiled first on a linux
-  # host, then the artifacts are copied back to the host later
+  # Compile Java Meterpreter and prepare PHP/Python payloads via docker if required, we can't
+  # always do this on the host environment (i.e. for macos). So it instead gets compiled first
+  # on a linux host, then the artifacts are copied back to the host later
   meterpreter_compilation:
-    name: Compile Meterpreter
+    name: Build Meterpreter Gem (optional)
     runs-on: ubuntu-latest
     if: ${{ inputs.build_metasploit_payloads }}
 
     steps:
       - name: Checkout metasploit-payloads
         uses: actions/checkout@v4
         with:
-          repository: rapid7/metasploit-payloads
+          repository: ${{ inputs.metasploit_payloads_repo }}
           path: metasploit-payloads
           ref: ${{ inputs.metasploit_payloads_commit }}
 
@@ -265,7 +270,7 @@ jobs:
         if: ${{ inputs.build_metasploit_payloads && matrix.meterpreter.name != 'mettle' }}
         uses: actions/checkout@v4
         with:
-          repository: rapid7/metasploit-payloads
+          repository: ${{ inputs.metasploit_payloads_repo }}
           path: metasploit-payloads
           ref: ${{ inputs.metasploit_payloads_commit }}
 

lib/msf/base/sessions/mettle_config.rb

@@ -135,7 +135,7 @@ def generate_config(opts = {})
         # Mettle reserves a fixed 8 KB slot in the binary for the config
         # block. Catch the overflow here with a useful message instead of
         # letting the gem's `to_binary` raise a generic "config block too
-        # large" — baked-in EXTENSIONS= is the usual culprit.
+        # large" -- baked-in EXTENSIONS= is the usual culprit.
         if opts[:config_block].length > MetasploitPayloads::Mettle::CONFIG_BLOCK_MAX
           raise ArgumentError, "Mettle config block (#{opts[:config_block].length} bytes) exceeds the #{MetasploitPayloads::Mettle::CONFIG_BLOCK_MAX}-byte embedded slot. " \
             "Drop EXTENSIONS= and `load <ext>` once the session is up."

lib/msf/core/handler/reverse_http.rb

@@ -287,14 +287,14 @@ def setup_handler
   #
   #   * query parameter   (profile: `parameter "name";`)
   #   * request header    (profile: `header    "name";`)
-  #   * trailing path seg (default — no placement directive)
+  #   * trailing path seg (default -- no placement directive)
   #
   # For the path case, the URI looks like `<base>/<id>`, where `<base>`
   # is the profile's per-verb `set uri` if defined, otherwise `LURI`
   # (each is registered as a separate mount point in `all_uris`).
   # Taking the last `/`-separated segment skips the base regardless of
   # which one was used. Profile authors should not put `/` in
-  # prepend/append directives — that would split the id across segments
+  # prepend/append directives -- that would split the id across segments
   # and defeat this scheme.
   #
   # If the profile applied `prepend` / `append` / `base64` / `base64url`
@@ -325,7 +325,7 @@ def find_resource_id(cli, request)
 
   # Reverse the prepend/append + base64 transforms the profile applied
   # to the id on the payload side. If a declared wrapper is missing from
-  # the candidate, leave the candidate alone — this is not a payload
+  # the candidate, leave the candidate alone -- this is not a payload
   # request, and `process_uri_resource` will return nil for it.
   def unwrap_profile_uuid(candidate, placement)
     prefix = placement.prepend.map{|d| d.args[0]}.join('')
@@ -357,8 +357,8 @@ def add_response_headers(req, resp)
 
   # Return the live meterpreter session whose passive dispatcher is
   # registered for this bare conn_id, or nil if none matches. Used so
-  # MC2 traffic — which Rex routes to on_request because the profile
-  # URI prefix outranks the session's /<conn_id> mount — can still be
+  # MC2 traffic -- which Rex routes to on_request because the profile
+  # URI prefix outranks the session's /<conn_id> mount -- can still be
   # delivered to the right session instead of triggering a fresh
   # "orphaned attach" on every poll.
   def session_for_conn_id(bare_conn_id)

lib/msf/core/payload/java/meterpreter_loader.rb

@@ -18,7 +18,7 @@ module Payload::Java::MeterpreterLoader
   include Msf::Sessions::MeterpreterOptions::Java
 
   # Resource path the stageless StagelessMain bootstrap reads. Deliberately
-  # innocuous — no meterpreter/metasploit markers in the name.
+  # innocuous -- no meterpreter/metasploit markers in the name.
   STAGELESS_CONFIG_RESOURCE = 'META-INF/data'.freeze
   STAGELESS_MAIN_CLASS = 'com.metasploit.meterpreter.StagelessMain'.freeze
 
@@ -44,7 +44,7 @@ def stage_payload(opts={})
   #
   # When opts[:stageless] is set, returns a self-contained jar with the
   # TLV config embedded as a resource and Main-Class pinned to
-  # StagelessMain — ready to run under `java -jar`.
+  # StagelessMain -- ready to run under `java -jar`.
   #
   def stage_meterpreter(opts={})
     met = MetasploitPayloads.read('meterpreter', 'meterpreter.jar')

lib/msf/core/payload/macho.rb

@@ -5,6 +5,7 @@
 class Msf::Payload::MachO
 
   def initialize(data)
+    @raw_data = data.dup
     @macho = MachO::MachOFile.new_from_bin(data)
   end
 
@@ -59,7 +60,12 @@ def to_dylib(name)
   # See: https://developer.apple.com/forums/thread/702351
   # See: https://github.com/apple-oss-distributions/Security/blob/e4ea024c9bbd3bfda30ec6df270bfb4c7438d1a9/SecurityTool/sharedTool/codesign.c#L323
   def sign
-    raw_data = @macho.serialize
+    # Use the original binary data rather than @macho.serialize. On Linux,
+    # ruby-macho's serialize can reorder or drop sections for newer macOS
+    # load commands (LC_DYLD_CHAINED_FIXUPS, LC_DYLD_EXPORTS_TRIE), which
+    # causes the LC_CODE_SIGNATURE.dataoff to point to the wrong location
+    # in the reconstructed output.
+    raw_data = @raw_data.dup
     code_signature_index = @macho[:LC_CODE_SIGNATURE][0].dataoff
     code_signature = raw_data[code_signature_index..]
     s_magic, s_length, s_count, code_indexes = code_signature.unpack("N3a*")

lib/msf/core/payload/malleable_c2.rb

@@ -115,7 +115,7 @@ def tokenize(text)
           # blank line
           next
         elsif scanner.scan(/#[^\n]*/)
-          # comment — anchorless so it matches indented comments too
+          # comment -- anchorless so it matches indented comments too
           # (the prior `\s+` rule has already eaten any leading
           # whitespace by the time we get here)
           next
@@ -450,7 +450,7 @@ def parse(file)
           profile.sets << parse_set
         elsif block_ahead?
           # Any `name { ... }` is a block. We keep the ones we understand
-          # (http-get/http-post/etc.) and harmlessly retain the rest —
+          # (http-get/http-post/etc.) and harmlessly retain the rest --
           # unsupported CS blocks like dns-beacon/process-inject/post-ex
           # are parsed for structure and simply ignored by to_tlv.
           profile.sections << parse_section

lib/rex/proto/http/request.rb

@@ -219,7 +219,7 @@ def to_s
 
   #
   # Returns a hijacked version of the body that shoves the request's query string in as a
-  # replacement in cases where there is no body. YOLO! ¯\_(ツ)_/¯
+  # replacement in cases where there is no body. YOLO! (shrug)
   #
   def body
     str = super || ''

lib/rex/proto/http/server.rb

@@ -294,7 +294,7 @@ def dispatch_request(cli, request)
       p = resources[request.resource]
       # This branch is reached when resource_id is nil (e.g. fetch-payload
       # adapters have no find_resource_id), so the matched resource is the
-      # request resource itself — not resource_id, which would nil-deref.
+      # request resource itself -- not resource_id, which would nil-deref.
       len = request.resource.length
       root = request.resource
     else