Metasploit mailing list archives

Meterpreter script to auto-migrate


From: hdm at metasploit.com (H D Moore)
Date: Sat, 13 Dec 2008 10:46:13 -0600

On Saturday 13 December 2008, natron wrote:
I think this may be a combination of two bugs, one is known and
labeled in the code, but I think the other one is new.

1) When I run it with AutoRunScript it hangs on the
client.sys.process.execute call.  Is it possible that something with
the client object isn't set up until you do an "interact -i #"?  It
works almost 100% of the time for me within a session.  If that's it,
would it be possible to manually set up the client object somehow?

A migrate in the AutoRunScript before the session is setup may break some 
of the initialization code, I opened ticket #266 to track it.

2) Regarding the migrate code, it was apparently never intended to be
ultra reliable.  The code for it is located in
http://metasploit.com/svn/framework3/trunk/lib/rex/post/meterpreter/cli
ent_core.rb. It uses a hardcoded library for injection and contains the
following:

I'm betting that whatever's hardcoded in that block doesn't work in
all environments.

This *should* be exactly the same as the injection block used by 
dllinjection payloads themselves. There is a chance that we updated the 
payload and forgot to update this stub, I am looking into it now.

-HD



Current thread: