If you have an 32bit Meterpreter running on a 64 bit remote system you can migrate into 64 bit processes.

This isn't anything new and has been used by malware for ages but the thing that makes me think is how does it do this on Windows 10?

Usually running 32 bit code in a 64 bit processes would be achieved using Heaven's Gate but this has been made impossible in Windows 10, more about this on Alex Ionescu's blog post "Closing Heaven's Gate". http://www.alex-ionescu.com/?p=300


The migration works as follows:

  1. Client sends a request to the server to generate a new payload with specific architecture of the target process.

  2. Server generated the payload and sends it to the client.

  3. Client injects received payload into the target process, e.g. explorer.exe

  4. Client calls ExitThread() to close the old connection without terminating the process.

  5. New payload successfully connects to the server and awaits new commands.

Your Answer

