Last updated at Fri, 21 Jul 2017 19:13:57 GMT

Meterpreter for All The Platforms

This week is pretty exciting for us, since it's not every day we give out commit rights to the Rapid7 Metasploit repo. I'm very happy to report that Tim Wright has agreed to step up and help out with moving Meterpreter research and development forward, focusing mainly on the Java and Android implementations.

Many Metasploit users are familiar with Meterpreter for Windows, since it's the default payload for Microsoft systems and effectively the reference implementation. In fact, Metasploit contributor OJ Reeves will be talking about Meterpreter internals on Friday at AusCERT2014, so if you're in the area or otherwise attending, you should certainly check it out.

That said, many people also don't know that Meterpreter is more than just a Windows rootkit / backdoor / persistence agent for Windows.  It's a whole protocol and system for interacting with compromised machines, and has always been intended to be cross-platform. Today, we have versions written in POSIX, PHP, Python, and Java/Android. It's that last one that's been getting a lot of attention lately, primarily by community contributors mihi, Anwar, and of course the aforementioned Tim.

There are tons and tons of cool new features and boring old bugfixes just waiting to be committed in the many Meterpreters (Meterpreti?), so if you have ideas, or better, a willingness to run through test cases and documentation, or best, code to contribute to make those features a reality, I strongly urge you to get in touch with OJ, Tim, or really anyone from Rapid7, all of whom tend to hang out on the #metasploit channel on Freenode IRC.

New Modules

We have two new exploits this week: yet another Flash reverse engineered from yet another 0day found circulating in the wild, and another Yokogawa CS3000 module. Both are thanks to Juan Vazquez.

Exploit modules

If you're new to Metasploit, you can get started by downloading Metasploit for Linux or Windows, either the totally free Metasploit Community Edition, or the 14-day free trial of Metasploit Pro. If you're the sort to track bleeding-edge development code, then these modules are but an msfupdate command away. For readers who are already using Metasploit Community or Metasploit Pro, you'll be able to install the new hotness today via the Administration : Software Updates button.

For additional details on what's changed and what's current, please see Chris Doughty's most excellent release notes.