@@ -229768,78 +229768,6 @@
229768229768 "adapted_refname": "windows/x64/download_exec",
229769229769 "staged": false
229770229770 },
229771- "payload_cmd/windows/http/x64/encrypted_shell/reverse_tcp": {
229772- "name": "HTTP Fetch, Windows Command Shell, Encrypted Reverse TCP Stager",
229773- "fullname": "payload/cmd/windows/http/x64/encrypted_shell/reverse_tcp",
229774- "aliases": [],
229775- "rank": 300,
229776- "disclosure_date": null,
229777- "type": "payload",
229778- "author": [
229779- "Brendan Watters",
229780- "Matt Graeber",
229781- "Shelby Pace"
229782- ],
229783- "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage",
229784- "references": [],
229785- "platform": "Windows",
229786- "arch": "cmd",
229787- "rport": null,
229788- "autofilter_ports": null,
229789- "autofilter_services": null,
229790- "targets": null,
229791- "mod_time": "2026-03-31 15:41:36 +0000",
229792- "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb",
229793- "is_install_path": true,
229794- "ref_name": "cmd/windows/http/x64/encrypted_shell/reverse_tcp",
229795- "check": false,
229796- "post_auth": false,
229797- "default_credential": false,
229798- "notes": {},
229799- "session_types": false,
229800- "needs_cleanup": false,
229801- "payload_type": 8,
229802- "adapter_refname": "cmd/windows/http/x64",
229803- "adapted_refname": "windows/x64/encrypted_shell/reverse_tcp",
229804- "staged": true,
229805- "stage_refname": "windows/x64/encrypted_shell",
229806- "stager_refname": "windows/x64/encrypted_reverse_tcp"
229807- },
229808- "payload_cmd/windows/http/x64/encrypted_shell_reverse_tcp": {
229809- "name": "HTTP Fetch, Windows Encrypted Reverse Shell",
229810- "fullname": "payload/cmd/windows/http/x64/encrypted_shell_reverse_tcp",
229811- "aliases": [],
229812- "rank": 300,
229813- "disclosure_date": null,
229814- "type": "payload",
229815- "author": [
229816- "Brendan Watters",
229817- "Matt Graeber",
229818- "Shelby Pace"
229819- ],
229820- "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to attacker and spawn an encrypted command shell",
229821- "references": [],
229822- "platform": "Windows",
229823- "arch": "cmd",
229824- "rport": null,
229825- "autofilter_ports": null,
229826- "autofilter_services": null,
229827- "targets": null,
229828- "mod_time": "2026-03-31 15:41:36 +0000",
229829- "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb",
229830- "is_install_path": true,
229831- "ref_name": "cmd/windows/http/x64/encrypted_shell_reverse_tcp",
229832- "check": false,
229833- "post_auth": false,
229834- "default_credential": false,
229835- "notes": {},
229836- "session_types": false,
229837- "needs_cleanup": false,
229838- "payload_type": 8,
229839- "adapter_refname": "cmd/windows/http/x64",
229840- "adapted_refname": "windows/x64/encrypted_shell_reverse_tcp",
229841- "staged": false
229842- },
229843229771 "payload_cmd/windows/http/x64/exec": {
229844229772 "name": "HTTP Fetch, Windows x64 Execute Command",
229845229773 "fullname": "payload/cmd/windows/http/x64/exec",
@@ -241555,78 +241483,6 @@
241555241483 "adapted_refname": "windows/x64/download_exec",
241556241484 "staged": false
241557241485 },
241558- "payload_cmd/windows/https/x64/encrypted_shell/reverse_tcp": {
241559- "name": "HTTPS Fetch, Windows Command Shell, Encrypted Reverse TCP Stager",
241560- "fullname": "payload/cmd/windows/https/x64/encrypted_shell/reverse_tcp",
241561- "aliases": [],
241562- "rank": 300,
241563- "disclosure_date": null,
241564- "type": "payload",
241565- "author": [
241566- "Brendan Watters",
241567- "Matt Graeber",
241568- "Shelby Pace"
241569- ],
241570- "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage",
241571- "references": [],
241572- "platform": "Windows",
241573- "arch": "cmd",
241574- "rport": null,
241575- "autofilter_ports": null,
241576- "autofilter_services": null,
241577- "targets": null,
241578- "mod_time": "2026-03-31 15:41:36 +0000",
241579- "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb",
241580- "is_install_path": true,
241581- "ref_name": "cmd/windows/https/x64/encrypted_shell/reverse_tcp",
241582- "check": false,
241583- "post_auth": false,
241584- "default_credential": false,
241585- "notes": {},
241586- "session_types": false,
241587- "needs_cleanup": false,
241588- "payload_type": 8,
241589- "adapter_refname": "cmd/windows/https/x64",
241590- "adapted_refname": "windows/x64/encrypted_shell/reverse_tcp",
241591- "staged": true,
241592- "stage_refname": "windows/x64/encrypted_shell",
241593- "stager_refname": "windows/x64/encrypted_reverse_tcp"
241594- },
241595- "payload_cmd/windows/https/x64/encrypted_shell_reverse_tcp": {
241596- "name": "HTTPS Fetch, Windows Encrypted Reverse Shell",
241597- "fullname": "payload/cmd/windows/https/x64/encrypted_shell_reverse_tcp",
241598- "aliases": [],
241599- "rank": 300,
241600- "disclosure_date": null,
241601- "type": "payload",
241602- "author": [
241603- "Brendan Watters",
241604- "Matt Graeber",
241605- "Shelby Pace"
241606- ],
241607- "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and spawn an encrypted command shell",
241608- "references": [],
241609- "platform": "Windows",
241610- "arch": "cmd",
241611- "rport": null,
241612- "autofilter_ports": null,
241613- "autofilter_services": null,
241614- "targets": null,
241615- "mod_time": "2026-03-31 15:41:36 +0000",
241616- "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb",
241617- "is_install_path": true,
241618- "ref_name": "cmd/windows/https/x64/encrypted_shell_reverse_tcp",
241619- "check": false,
241620- "post_auth": false,
241621- "default_credential": false,
241622- "notes": {},
241623- "session_types": false,
241624- "needs_cleanup": false,
241625- "payload_type": 8,
241626- "adapter_refname": "cmd/windows/https/x64",
241627- "adapted_refname": "windows/x64/encrypted_shell_reverse_tcp",
241628- "staged": false
241629- },
241630241486 "payload_cmd/windows/https/x64/exec": {
241631241487 "name": "HTTPS Fetch, Windows x64 Execute Command",
241632241488 "fullname": "payload/cmd/windows/https/x64/exec",
@@ -265517,78 +265373,6 @@
265517265373 "adapted_refname": "windows/x64/download_exec",
265518265374 "staged": false
265519265375 },
265520- "payload_cmd/windows/smb/x64/encrypted_shell/reverse_tcp": {
265521- "name": "SMB Fetch, Windows Command Shell, Encrypted Reverse TCP Stager",
265522- "fullname": "payload/cmd/windows/smb/x64/encrypted_shell/reverse_tcp",
265523- "aliases": [],
265524- "rank": 300,
265525- "disclosure_date": null,
265526- "type": "payload",
265527- "author": [
265528- "Spencer McIntyre",
265529- "Matt Graeber",
265530- "Shelby Pace"
265531- ],
265532- "description": "Fetch and execute an x64 payload from an SMB server.\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage",
265533- "references": [],
265534- "platform": "Windows",
265535- "arch": "cmd",
265536- "rport": null,
265537- "autofilter_ports": null,
265538- "autofilter_services": null,
265539- "targets": null,
265540- "mod_time": "2026-03-31 15:41:36 +0000",
265541- "path": "/modules/payloads/adapters/cmd/windows/smb/x64.rb",
265542- "is_install_path": true,
265543- "ref_name": "cmd/windows/smb/x64/encrypted_shell/reverse_tcp",
265544- "check": false,
265545- "post_auth": false,
265546- "default_credential": false,
265547- "notes": {},
265548- "session_types": false,
265549- "needs_cleanup": false,
265550- "payload_type": 8,
265551- "adapter_refname": "cmd/windows/smb/x64",
265552- "adapted_refname": "windows/x64/encrypted_shell/reverse_tcp",
265553- "staged": true,
265554- "stage_refname": "windows/x64/encrypted_shell",
265555- "stager_refname": "windows/x64/encrypted_reverse_tcp"
265556- },
265557- "payload_cmd/windows/smb/x64/encrypted_shell_reverse_tcp": {
265558- "name": "SMB Fetch, Windows Encrypted Reverse Shell",
265559- "fullname": "payload/cmd/windows/smb/x64/encrypted_shell_reverse_tcp",
265560- "aliases": [],
265561- "rank": 300,
265562- "disclosure_date": null,
265563- "type": "payload",
265564- "author": [
265565- "Spencer McIntyre",
265566- "Matt Graeber",
265567- "Shelby Pace"
265568- ],
265569- "description": "Fetch and execute an x64 payload from an SMB server.\nConnect back to attacker and spawn an encrypted command shell",
265570- "references": [],
265571- "platform": "Windows",
265572- "arch": "cmd",
265573- "rport": null,
265574- "autofilter_ports": null,
265575- "autofilter_services": null,
265576- "targets": null,
265577- "mod_time": "2026-03-31 15:41:36 +0000",
265578- "path": "/modules/payloads/adapters/cmd/windows/smb/x64.rb",
265579- "is_install_path": true,
265580- "ref_name": "cmd/windows/smb/x64/encrypted_shell_reverse_tcp",
265581- "check": false,
265582- "post_auth": false,
265583- "default_credential": false,
265584- "notes": {},
265585- "session_types": false,
265586- "needs_cleanup": false,
265587- "payload_type": 8,
265588- "adapter_refname": "cmd/windows/smb/x64",
265589- "adapted_refname": "windows/x64/encrypted_shell_reverse_tcp",
265590- "staged": false
265591- },
265592265376 "payload_cmd/windows/smb/x64/exec": {
265593265377 "name": "SMB Fetch, Windows x64 Execute Command",
265594265378 "fullname": "payload/cmd/windows/smb/x64/exec",
@@ -268558,78 +268342,6 @@
268558268342 "adapted_refname": "windows/x64/download_exec",
268559268343 "staged": false
268560268344 },
268561- "payload_cmd/windows/tftp/x64/encrypted_shell/reverse_tcp": {
268562- "name": "TFTP Fetch, Windows Command Shell, Encrypted Reverse TCP Stager",
268563- "fullname": "payload/cmd/windows/tftp/x64/encrypted_shell/reverse_tcp",
268564- "aliases": [],
268565- "rank": 300,
268566- "disclosure_date": null,
268567- "type": "payload",
268568- "author": [
268569- "Brendan Watters",
268570- "Matt Graeber",
268571- "Shelby Pace"
268572- ],
268573- "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage",
268574- "references": [],
268575- "platform": "Windows",
268576- "arch": "cmd",
268577- "rport": null,
268578- "autofilter_ports": null,
268579- "autofilter_services": null,
268580- "targets": null,
268581- "mod_time": "2026-03-31 15:41:36 +0000",
268582- "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb",
268583- "is_install_path": true,
268584- "ref_name": "cmd/windows/tftp/x64/encrypted_shell/reverse_tcp",
268585- "check": false,
268586- "post_auth": false,
268587- "default_credential": false,
268588- "notes": {},
268589- "session_types": false,
268590- "needs_cleanup": false,
268591- "payload_type": 8,
268592- "adapter_refname": "cmd/windows/tftp/x64",
268593- "adapted_refname": "windows/x64/encrypted_shell/reverse_tcp",
268594- "staged": true,
268595- "stage_refname": "windows/x64/encrypted_shell",
268596- "stager_refname": "windows/x64/encrypted_reverse_tcp"
268597- },
268598- "payload_cmd/windows/tftp/x64/encrypted_shell_reverse_tcp": {
268599- "name": "TFTP Fetch, Windows Encrypted Reverse Shell",
268600- "fullname": "payload/cmd/windows/tftp/x64/encrypted_shell_reverse_tcp",
268601- "aliases": [],
268602- "rank": 300,
268603- "disclosure_date": null,
268604- "type": "payload",
268605- "author": [
268606- "Brendan Watters",
268607- "Matt Graeber",
268608- "Shelby Pace"
268609- ],
268610- "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and spawn an encrypted command shell",
268611- "references": [],
268612- "platform": "Windows",
268613- "arch": "cmd",
268614- "rport": null,
268615- "autofilter_ports": null,
268616- "autofilter_services": null,
268617- "targets": null,
268618- "mod_time": "2026-03-31 15:41:36 +0000",
268619- "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb",
268620- "is_install_path": true,
268621- "ref_name": "cmd/windows/tftp/x64/encrypted_shell_reverse_tcp",
268622- "check": false,
268623- "post_auth": false,
268624- "default_credential": false,
268625- "notes": {},
268626- "session_types": false,
268627- "needs_cleanup": false,
268628- "payload_type": 8,
268629- "adapter_refname": "cmd/windows/tftp/x64",
268630- "adapted_refname": "windows/x64/encrypted_shell_reverse_tcp",
268631- "staged": false
268632- },
268633268345 "payload_cmd/windows/tftp/x64/exec": {
268634268346 "name": "TFTP Fetch, Windows x64 Execute Command",
268635268347 "fullname": "payload/cmd/windows/tftp/x64/exec",
@@ -289172,72 +288884,6 @@
289172288884 "payload_type": 1,
289173288885 "staged": false
289174288886 },
289175- "payload_windows/x64/encrypted_shell/reverse_tcp": {
289176- "name": "Windows Command Shell, Encrypted Reverse TCP Stager",
289177- "fullname": "payload/windows/x64/encrypted_shell/reverse_tcp",
289178- "aliases": [],
289179- "rank": 300,
289180- "disclosure_date": null,
289181- "type": "payload",
289182- "author": [
289183- "Matt Graeber",
289184- "Shelby Pace"
289185- ],
289186- "description": "Spawn a piped command shell (staged).\n\nConnect to MSF and read in stage",
289187- "references": [],
289188- "platform": "Windows",
289189- "arch": "x64",
289190- "rport": null,
289191- "autofilter_ports": null,
289192- "autofilter_services": null,
289193- "targets": null,
289194- "mod_time": "2026-03-31 11:39:58 +0000",
289195- "path": "/modules/payloads/stagers/windows/x64/encrypted_reverse_tcp.rb",
289196- "is_install_path": true,
289197- "ref_name": "windows/x64/encrypted_shell/reverse_tcp",
289198- "check": false,
289199- "post_auth": false,
289200- "default_credential": false,
289201- "notes": {},
289202- "session_types": false,
289203- "needs_cleanup": false,
289204- "payload_type": 2,
289205- "staged": true,
289206- "stage_refname": "windows/x64/encrypted_shell",
289207- "stager_refname": "windows/x64/encrypted_reverse_tcp"
289208- },
289209- "payload_windows/x64/encrypted_shell_reverse_tcp": {
289210- "name": "Windows Encrypted Reverse Shell",
289211- "fullname": "payload/windows/x64/encrypted_shell_reverse_tcp",
289212- "aliases": [],
289213- "rank": 300,
289214- "disclosure_date": null,
289215- "type": "payload",
289216- "author": [
289217- "Matt Graeber",
289218- "Shelby Pace"
289219- ],
289220- "description": "Connect back to attacker and spawn an encrypted command shell",
289221- "references": [],
289222- "platform": "Windows",
289223- "arch": "x64",
289224- "rport": null,
289225- "autofilter_ports": null,
289226- "autofilter_services": null,
289227- "targets": null,
289228- "mod_time": "2026-03-31 11:39:58 +0000",
289229- "path": "/modules/payloads/singles/windows/x64/encrypted_shell_reverse_tcp.rb",
289230- "is_install_path": true,
289231- "ref_name": "windows/x64/encrypted_shell_reverse_tcp",
289232- "check": false,
289233- "post_auth": false,
289234- "default_credential": false,
289235- "notes": {},
289236- "session_types": false,
289237- "needs_cleanup": false,
289238- "payload_type": 1,
289239- "staged": false
289240- },
289241288887 "payload_windows/x64/exec": {
289242288888 "name": "Windows x64 Execute Command",
289243288889 "fullname": "payload/windows/x64/exec",
0 commit comments