2.2 KiB
General
Auto Migration is a technique that can be used to automatically migrate a payload or meterpreter session to a new process in order to evade detection and maintain a stable connection. This can be useful for avoiding antivirus software and other security controls, as well as for ensuring that the meterpreter session remains active and stable. To use Auto Migration in Metasploit, you can use the migrate command with the -k option, specifying the process ID of the target process that you want to migrate to. This will cause the payload or meterpreter session to migrate to the new process whenever the current process is terminated. Auto Migration can be a useful technique for maintaining access to a compromised system, but it is important to use it with caution and only when it is necessary for the success of the engagement.
Migrating a process in Metasploit is important for a number of reasons:
-
Why migrate: Migrating to another process is often necessary in order to maintain access to a compromised system. If the process that the Metasploit payload is running in is terminated, the payload will also be terminated and the connection to the target system will be lost. By migrating to another process, the payload can continue to run and the connection can be maintained.
-
Better stable process: Migrating to a more stable process can also help to ensure that the payload continues to run smoothly. Some processes may be more prone to termination or may not have the necessary permissions to run certain commands. Migrating to a more stable process can help to avoid these issues.
-
Get the right version: In some cases, it may be necessary to migrate to a process that is compatible with the architecture of the payload. For example, if the payload is a 32-bit executable, it may need to be migrated to a 32-bit process in order to run correctly.
-
Evade AV: Migrating to a new process can also help to evade antivirus (AV) software. Some AV programs monitor certain processes and will trigger an alert if they detect suspicious activity. By migrating to a new process, the payload can avoid being detected by AV software.
Command
# Windows
set AutoRunScript post/windows/manage/migrate