Land rapid7#8508, fix 32-bit to 64-bit process migration on AMD cpus

Author: Brent Cook

Gemfile.lock

@@ -15,7 +15,7 @@ PATH
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 1.2.29)
+      metasploit-payloads (= 1.2.32)
       metasploit_data_models
       metasploit_payloads-mettle (= 0.1.9)
       msgpack
@@ -195,7 +195,7 @@ GEM
       activemodel (~> 4.2.6)
       activesupport (~> 4.2.6)
       railties (~> 4.2.6)
-    metasploit-payloads (1.2.29)
+    metasploit-payloads (1.2.32)
     metasploit_data_models (2.0.14)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)

external/source/shellcode/windows/x86/src/migrate/executex64.asm

@@ -40,6 +40,9 @@ delta:
 	
 	call go_all_native						; perform the transition into native x64 and return here when done.
 	
+	mov ax, ds								; fixes an elusive bug on AMD CPUs, http://blog.rewolf.pl/blog/?p=1484
+	mov ss, ax								; found and fixed by ReWolf, incorporated by RaMMicHaeL
+	
 	add esp, (8+4+8)						; remove the 8 bytes we allocated + the return address which was never popped off + the qword pushed from native_x64
 	pop edi									; restore the clobbered registers
 	pop esi									;

external/source/vncdll/vncdll/inject.c

@@ -12,11 +12,14 @@
 #endif
 
 // see '/msf3/external/source/shellcode/x86/migrate/executex64.asm'
+// 03.06.2017: fixed an elusive bug on AMD CPUs, http://blog.rewolf.pl/blog/?p=1484
+//             found and fixed by ReWolf, incorporated by RaMMicHaeL
 BYTE migrate_executex64[] =	"\x55\x89\xE5\x56\x57\x8B\x75\x08\x8B\x4D\x0C\xE8\x00\x00\x00\x00"
-							"\x58\x83\xC0\x25\x83\xEC\x08\x89\xE2\xC7\x42\x04\x33\x00\x00\x00"
-							"\x89\x02\xE8\x09\x00\x00\x00\x83\xC4\x14\x5F\x5E\x5D\xC2\x08\x00"
-							"\x8B\x3C\x24\xFF\x2A\x48\x31\xC0\x57\xFF\xD6\x5F\x50\xC7\x44\x24"
-							"\x04\x23\x00\x00\x00\x89\x3C\x24\xFF\x2C\x24";
+							"\x58\x83\xC0\x2B\x83\xEC\x08\x89\xE2\xC7\x42\x04\x33\x00\x00\x00"
+							"\x89\x02\xE8\x0F\x00\x00\x00\x66\x8C\xD8\x66\x8E\xD0\x83\xC4\x14"
+							"\x5F\x5E\x5D\xC2\x08\x00\x8B\x3C\xE4\xFF\x2A\x48\x31\xC0\x57\xFF"
+							"\xD6\x5F\x50\xC7\x44\x24\x04\x23\x00\x00\x00\x89\x3C\x24\xFF\x2C"
+							"\x24";
 
 // see '/msf3/external/source/shellcode/x64/migrate/remotethread.asm'
 BYTE migrate_wownativex[] = "\xFC\x48\x89\xCE\x48\x89\xE7\x48\x83\xE4\xF0\xE8\xC8\x00\x00\x00"

metasploit-framework.gemspec

@@ -68,7 +68,7 @@ Gem::Specification.new do |spec|
   # are needed when there's no database
   spec.add_runtime_dependency 'metasploit-model'
   # Needed for Meterpreter
-  spec.add_runtime_dependency 'metasploit-payloads', '1.2.29'
+  spec.add_runtime_dependency 'metasploit-payloads', '1.2.32'
   # Needed for the next-generation POSIX Meterpreter
   spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.1.9'
   # Needed by msfgui and other rpc components