rapid7/meterpreter — pull request #93 by jvazquez-r7 (2014-07-31 19:31:43+00:00)
Title: Linux migrate

This pull request tries to add support to migrate meterpreter on Linux. In oder to do it uses:

* ptrace in order to modify and redirect execution on the target process.
* unix domain sockets in order to share the socked (fd) used by the session with the new host process.

- Notes

* Some modern distributions don't allow you to ptrace any process any more, even if it's running with your same privileges. On these systems, it's possible to migrate to a child process still.
* On linux there isn't "CreateRemoteThread". At this moment the new host process is used to execute the meterpreter code, so its original code isn't executed anymore once execution control has been given to meterpreter. Using clone (LWP) (or fork and a new child procees), could help to mitigate it, and allow the original process to execute its original code too. It's definitely on my TODO, not in this pull request. Othen than it, this pull request tries to mimic the WIndows migrate behaviour.

In a while will do pull request to the metasploit-framework which should be helpful to test the meterpreter binaries with these changes. Will update it.