Skip to content

Commit e05e08a

Browse files
authored
Update module doc
1 parent 2f5dd38 commit e05e08a

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

documentation/modules/post/windows/manage/priv_migrate.md

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ This module is a nice addition to the beginning of an autorun script for post-Me
1414
- **ANAME** - This option allows you to specify a system level process that the module attempts to migrate to first if the session has admin rights.
1515
- **NAME** - This option allows you to specify the user level process that the module attempts to migrate to first if the session has user rights or if admin migration fails through all of the default processes.
1616
- **KILL** - This option allows you to kill the original process after a successful migration. The default value is FALSE.
17+
- **NOFAIL** - This option allows you to specify whether or not the module will migrate the session into a user level process if admin level migration fails. If TRUE, this may downgrade priviliged shells. The default value is FALSE.
1718

1819
## Module Process
1920
Here is the process that the module follows:
@@ -22,11 +23,13 @@ Here is the process that the module follows:
2223
- If the session has admin rights, it attempts to migrate to a system owned process in the following order:
2324
- ANAME (Module option, if specified)
2425
- services.exe
25-
- winlogon.exe
2626
- wininit.exe
27+
- svchost.exe
2728
- lsm.exe
2829
- lsass.exe
29-
- If it is unable to migrate to one of these processes, it drops to user level migration.
30+
- winlogon.exe
31+
- The module will not migrate if the session has System rights and is already in one of the above target processes.
32+
- If it is unable to migrate to one of these processes, it drops to user level migration if NOFAIL is TRUE.
3033
- If the session has user rights, it attempts to migrate to a user owned process in the following order:
3134
- NAME (Module option, if specified)
3235
- explorer.exe

0 commit comments

Comments
 (0)