Metasploit Framework 6.5 Released

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://rapid7.com/blog/post/pt-metasploit-framework-6-5-released
• Blog Title: Metasploit Framework 6.5 Released
• Suggested Section: Generic Hacking / Metasploit Framework and payload delivery; Windows Hardening / NTLM relay and Active Directory RBCD or Shadow Credentials; Linux Post-Exploitation / fileless memfd execution; AI Security / AI MCP Security

🎯 Content Summary

Metasploit Framework 6.5

Released on July 30, 2026, Metasploit Framework 6.5 incorporates 422 modules added over the preceding two years and introduces major offensive-security capabilities: Malleable C2 profiles for Meterpreter, a Model Context Protocol server for policy-controlled AI integration, HTTP-to-SMB/LDAP NTLM relay, automated NTLMRelay2Self privilege escalation, fileless and size-constrained Linux Fetch payloads, architecture-aware payload delivery, randomized Windows block...

🔧 Technical Details

Malleable Meterpreter C2: Configure an HTTP(S) Meterpreter payload with MALLEABLEC2=/path/to/profile to transform supported URIs, headers, user agents, and other traffic properties so C2 resembles legitimate web activity. Stageless payloads apply the profile immediately, while staged payloads apply it only after downloading the full Meterpreter stage. This can undermine detections that depend on fixed Meterpreter network indicators.

Policy-gated AI operation of offensive tooling: Expose Metasploit to an LLM through msfmcpd, but separate passive intelligence access from high-impact actions. Leave host, service, credential, module, job, and session queries enabled while requiring explicit authorization for module checks, module execution, session termination, and writes to interactive sessions. A reusable workflow is reconnaissance with msf_host_info/msf_service_info, module selection with 🤖 Agent Actions

Updated src/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md.

Added:

• Metasploit 6.5 http_to_smb / http_to_ldap relay coverage
• The LDAP NTLMv1-only nuance from module code
• sessions -u follow-up note
• A technical ntlm_relay_2_self section with real prerequisites and chain details
• References to the Rapid7 release post and the relevant Metasploit source files

I skipped the other release items because they were either already covered in HackTricks (MCP abuse, memfd/fileless execution, RBCD/Shadow Credentials basics) or were mostly tool-release features rather than new standalone techniques.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://rapid7.com/blog/post/pt-metasploit-framework-6-5-released

Content Categories: Based on the analysis, this content was categorized under "Generic Hacking / Metasploit Framework and payload delivery; Windows Hardening / NTLM relay and Active Directory RBCD or Shadow Credentials; Linux Post-Exploitation / fileless memfd execution; AI Security / AI MCP Security".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0