6.5.0 prerelease build#21641

Draft

adfoster-r7 wants to merge 76 commits into

rapid7:masterfrom

adfoster-r7:6.5.0-prerelease-build

Commits on Jul 1, 2026

First pass of TLV-based configuration and MC2

OJ
authored and
smcintyre-r7
committed
"Working" C2 sessions with diff GET/POST uris

OJ
authored and
smcintyre-r7
committed
Payload wrapping support and more

OJ
authored and
smcintyre-r7
committed
Add C2 packet support to the stageless transition

OJ
authored and
smcintyre-r7
committed
Tidy and refactor of some C2 code

OJ
authored and
smcintyre-r7
committed
Wire in support for C2 profiles in the x64 payload

OJ
authored and
smcintyre-r7
committed
Small code tidy

OJ
authored and
smcintyre-r7
committed
Small fix for non-c2 profile payloads

OJ
authored and
smcintyre-r7
committed
C2 profile persistence and better UUID handling

OJ
authored and
smcintyre-r7
committed
Remove query string from POST request body

OJ
authored and
smcintyre-r7
committed
Change support for connection IDs in the HTTP server

OJ
authored and
smcintyre-r7
committed
Fix a failing test
smcintyre-r7
committed
Push CID finding into reverse_http

OJ
authored and
smcintyre-r7
committed
Fix C2 config timeout generation

OJ
authored and
smcintyre-r7
committed
Fix transport comment TLV generation/handling

OJ
authored and
smcintyre-r7
committed
Re-add the overridden body property in the HTTP packet

OJ
authored and
smcintyre-r7
committed
Prepends should not be reversed

OJ
authored and
smcintyre-r7
committed
Fixes as per discussion

OJ
authored and
smcintyre-r7
committed
Add C2 custom header support in responses

OJ
authored and
smcintyre-r7
committed
Revert previous change to cid extraction

OJ
authored and
smcintyre-r7
committed
Support encoding/decoding of data from C2 profile

OJ
authored and
smcintyre-r7
committed
Support escaped double-quote

OJ
authored and
smcintyre-r7
committed
Fix old payloads

zeroSteiner
authored and
smcintyre-r7
committed
Handle IPv6 addresses in the URL

zeroSteiner
authored and
smcintyre-r7
committed
Switch PROXY_HOST to PROXY_URL which is more accurate

zeroSteiner
authored and
smcintyre-r7
committed
Ensure slashes are where they need to be

zeroSteiner
authored and
smcintyre-r7
committed
Add C2 profile support to win https

OJ
authored and
smcintyre-r7
committed
Fix bug unwrapping bytes in post

OJ
authored and
smcintyre-r7
committed
Fix hex escape parasing in C2 profile string handling

OJ
authored and
smcintyre-r7
committed
Simplify prefix/suffix checks

OJ
authored and
smcintyre-r7
committed
Short-circuit on first match of directives

OJ
authored and
smcintyre-r7
committed
Fix base_uri mutation

OJ
authored and
smcintyre-r7
committed
Extract GET/POST TLV builders

OJ
authored and
smcintyre-r7
committed
Fix stale C2 profile configuration

OJ
authored and
smcintyre-r7
committed
Change MALLEABLEC2 option type to OptPath

dledda-r7
authored and
smcintyre-r7
committed
Change MALLEABLEC2 option type to OptPath

dledda-r7
authored and
smcintyre-r7
committed
Fix a staging-related URI problem
smcintyre-r7
committed
Support MC2 in python

OJ
authored and
smcintyre-r7
committed
Refactor config gen

OJ
authored and
smcintyre-r7
committed
Add support for HTTP/S PHP and TLV config

OJ
authored and
smcintyre-r7
committed
Remove emails from source

OJ
authored and
smcintyre-r7
committed
Config block support for mettle

OJ
authored and
smcintyre-r7
committed
Restore android stageless via TLV

OJ
authored and
smcintyre-r7
committed
Fix custom_headers emission, add C2 UUID for placement

OJ
authored and
smcintyre-r7
committed
Support mc2 in transport_* commands

OJ
authored and
smcintyre-r7
committed
Add stagless payloads for Java

OJ
authored and
smcintyre-r7
committed
Add debug output for incoming MC2 payloads

OJ
authored and
smcintyre-r7
committed
Fix MC2 payload gen

OJ
authored and
smcintyre-r7
committed
Fix mettle config generation

OJ
authored and
smcintyre-r7
committed
Wire MC2 into PHP payloads

OJ
authored and
smcintyre-r7
committed
Remove debug log and fix uuid loading in C2

OJ
authored and
smcintyre-r7
committed
Add IN/OUTBOUND encoding to correctly handle encoding

OJ
authored and
smcintyre-r7
committed
Wire MC2 into mettle

OJ
authored and
smcintyre-r7
committed
Correctly handle UUID encoding/decoding

OJ
authored and
smcintyre-r7
committed
Move to STRING instead of RAW for UUID prefix/suffix

OJ
authored and
smcintyre-r7
committed
Support stageless java payloads

OJ
authored and
smcintyre-r7
committed
Add support for stageless extension wiring

OJ
authored and
smcintyre-r7
committed
Add stageless extension support to mettle

OJ
authored and
smcintyre-r7
committed
Fallback to global UA if not present in profile

OJ
authored and
smcintyre-r7
committed
Fix connd_id to session map and C2 comment handling

OJ
authored and
smcintyre-r7
committed
Tolerate unsupported C2 blocks and split multi-URI directives

OJ
authored and
smcintyre-r7
committed
Add fetch-payload fix as per Diego's comments

OJ
authored and
smcintyre-r7
committed

Commits on Jul 7, 2026