Metasploit Pro Version 4.22.8-2025080401 Release Notes

Software release date: August 4, 2025 | Release notes published: August 4, 2025

New module content (1)

#20189 - This adds a new module that streamlines the exploitation of ESC9, ESC10 and ESC16. It handles manipulating a target account over LDAP and then using that account to issue a certificate as an elevated user.

Modules which have either been enhanced, or renamed:

#20149 - This updates the existing auxiliary/gather/ldap_esc_vulnerable_cert_finder module to support checking for templates that are vulnerable to ESC9, ESC10 and ESC16.

Pro: Enables a new MetaModule for Active Directory Certificate Services (AD CS) exploitation. This MetaModule only requires valid domain credentials to perform the verification of exploitation - such as issuing certificates to perform configurable actions like obtaining Kerberos tickets or establishing LDAP sessions.
#20421 - This enhances the get_nonce function in the auxiliary/scanner/http/wp_ultimate_member_sorting_sqli module. Previously the get_nonce function required the HTTP response code to be 200 before it parsed and extracted nonce. However, the nonce script is also present for 404 and 403 status codes - which this update now takes into account.

#20428 - Fixes payload space in exploits/windows/misc/achat_bof. Previously, due to insufficient payload space, the module has been reported as unreliable. This fixes the issue by increasing payload space.