Skip to content

Commit 0e666d5

Browse files
David MaloneyDavid Maloney
authored andcommitted
gaurd against arch mismatch
this will not work from an x86 proc on an x64 machine, so guard against that. MSP-12358
1 parent 9308da7 commit 0e666d5

File tree

1 file changed

+13
-0
lines changed

1 file changed

+13
-0
lines changed

modules/post/windows/gather/credentials/domain_hashdump.rb

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,9 @@ def preconditions_met?
9797
print_error "This module requires UAC to be bypassed first"
9898
status = false
9999
end
100+
unless session_compat?
101+
status = false
102+
end
100103
return status
101104
end
102105

@@ -105,6 +108,16 @@ def repair_ntds(path='')
105108
cmd_exec("esentutl", arguments)
106109
end
107110

111+
def session_compat?
112+
if sysinfo['Architecture'] =~ /x64/ && session.platform =~ /x86/
113+
print_error "You are running 32-bit Meterpreter on a 64 bit system"
114+
print_error "Try migrating to a 64-bit process and try again"
115+
false
116+
else
117+
true
118+
end
119+
end
120+
108121
def vss_method
109122
id = create_shadowcopy("#{expand_path("%SystemDrive%")}\\")
110123
sc_details = get_sc_details(id)

0 commit comments

Comments
 (0)