module

FTP Fetch, DNS TXT Record Payload Download and Execution

Disclosed	Created
N/A	Jul 10, 2026

Disclosed

N/A

Created

Jul 10, 2026

Description

Fetch and execute an x86 payload from an FTP server.

Performs a TXT query against a series of DNS record(s) and executes the returned x86 shellcode. The DNSZONE
option is used as the base name to iterate over. The payload will first request the TXT contents of the a
hostname, followed by b, then c, etc. until there are no more records. For each record that is returned, exactly
255 bytes from it are copied into a buffer that is eventually executed. This buffer should be encoded using
x86/alpha_mixed with the BufferRegister option set to EDI.

Authors

Brendan Watters
corelanc0d3r [email protected]

Platform

Windows

Architectures

cmd

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use payload/cmd/windows/ftp/x86/dns_txt_query_exec
    msf payload(dns_txt_query_exec) > show actions
        ...actions...
    msf payload(dns_txt_query_exec) > set ACTION < action-name >
    msf payload(dns_txt_query_exec) > show options
        ...show and set options...
    msf payload(dns_txt_query_exec) > run

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report