Class: Msf::Sessions::PowerShell

Inherits:
CommandShell show all
Defined in:
lib/msf/base/sessions/powershell.rb

Instance Attribute Summary

Attributes inherited from CommandShell

#arch, #max_threads

Attributes included from Msf::Session::Interactive

#rstream

Attributes included from Rex::Ui::Interactive

#completed, #interacting, #next_session, #on_command_proc, #on_print_proc, #orig_suspend, #orig_usr1

Attributes included from Rex::Ui::Subscriber::Input

#user_input

Attributes included from Rex::Ui::Subscriber::Output

#user_output

Attributes included from Msf::Session

#alive, #db_record, #exploit, #exploit_datastore, #exploit_task, #exploit_uuid, #framework, #info, #machine_id, #payload_uuid, #routes, #sid, #sname, #target_host, #target_port, #username, #uuid, #via, #workspace

Attributes included from Framework::Offspring

#framework

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from CommandShell

#_interact, #_interact_stream, #binary_exists, #cleanup, #cmd_background, #cmd_background_help, #cmd_download, #cmd_download_help, #cmd_help, #cmd_help_help, #cmd_irb, #cmd_irb_help, #cmd_pry, #cmd_pry_help, #cmd_resource, #cmd_resource_help, #cmd_sessions, #cmd_sessions_help, #cmd_shell, #cmd_shell_help, #cmd_source, #cmd_source_help, #cmd_upload, #cmd_upload_help, #commands, #docs_dir, #execute_file, #file_exists, #initialize, #repr, #run_builtin_cmd, #run_single, #shell_close, #shell_init, #shell_read, #shell_write, #type

Methods included from Rex::Ui::Text::Resource

#load_resource

Methods included from Msf::Session::Scriptable

#execute_file, #execute_script, included, #legacy_script_to_post_module

Methods included from Msf::Session::Provider::SingleCommandShell

#set_shell_token_index, #shell_close, #shell_command_token, #shell_command_token_unix, #shell_command_token_win32, #shell_init, #shell_read, #shell_read_until_token, #shell_write

Methods included from Msf::Session::Basic

#_interact, #type

Methods included from Msf::Session::Interactive

#_interact, #_interact_complete, #_interrupt, #_suspend, #_usr1, #cleanup, #initialize, #interactive?, #kill, #run_cmd, #tunnel_local, #tunnel_peer, #user_want_abort?

Methods included from Rex::Ui::Interactive

#_interact, #_interact_complete, #_interrupt, #_local_fd, #_remote_fd, #_stream_read_local_write_remote, #_stream_read_remote_write_local, #_suspend, #detach, #handle_suspend, #handle_usr1, #interact, #interact_stream, #prompt, #prompt_yesno, #restore_suspend, #restore_usr1

Methods included from Rex::Ui::Subscriber

#copy_ui, #init_ui, #reset_ui

Methods included from Rex::Ui::Subscriber::Input

#gets

Methods included from Rex::Ui::Subscriber::Output

#flush, #print, #print_blank_line, #print_error, #print_good, #print_line, #print_status, #print_warning

Methods included from Msf::Session

#alive?, #cleanup, #dead?, #initialize, #inspect, #interactive?, #kill, #log_file_name, #log_source, #name, #name=, #register?, #session_host, #session_host=, #session_port, #session_port=, #session_type, #set_from_exploit, #set_via, #tunnel_local, #tunnel_peer, #tunnel_to_s, #type, #via_exploit, #via_payload

Constructor Details

This class inherits a constructor from Msf::Sessions::CommandShell

Class Method Details

.typeObject

Returns the type of session.


26
27
28
# File 'lib/msf/base/sessions/powershell.rb', line 26

def self.type
  "powershell"
end

Instance Method Details

#descObject

Returns the session description.


40
41
42
# File 'lib/msf/base/sessions/powershell.rb', line 40

def desc
  "Powershell session"
end

#platformObject

Returns the session platform.


33
34
35
# File 'lib/msf/base/sessions/powershell.rb', line 33

def platform
  "win"
end

#process_autoruns(datastore) ⇒ Object

Execute any specified auto-run scripts for this session


8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# File 'lib/msf/base/sessions/powershell.rb', line 8

def process_autoruns(datastore)

  # Read the username and hostname from the initial banner
  initial_output = shell_read(-1, 0.01)
  if initial_output =~ /running as user ([^\s]+) on ([^\s]+)/
    username = $1
    hostname = $2
    self.info = "#{username} @ #{hostname}"
  else
    self.info = initial_output.gsub(/[\r\n]/, ' ')
  end

  # Call our parent class's autoruns processing method
  super
end

#shell_command(cmd, timeout = 1800) ⇒ Object

Takes over the shell_command of the parent


47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
# File 'lib/msf/base/sessions/powershell.rb', line 47

def shell_command(cmd, timeout = 1800)
  # insert random marker
  strm = Rex::Text.rand_text_alpha(15)
  endm = Rex::Text.rand_text_alpha(15)

  # Send the shell channel's stdin.
  shell_write(";'#{strm}'\n" + cmd + "\n'#{endm}';\n")

  etime = ::Time.now.to_f + timeout

  buff = ""
  # Keep reading data until the marker has been received or the 30 minture timeout has occured
  while (::Time.now.to_f < etime)
    res = shell_read(-1, timeout)
    break unless res
    timeout = etime - ::Time.now.to_f

    buff << res
    if buff.include?(endm)
      # if you see the end marker, read the buffer from the start marker to the end and then display back to screen
      buff = buff.split(/#{strm}\r\n/)[-1]
      buff = buff.split(endm)[0]
      buff.gsub!(/(?<=\r\n)PS [^>]*>/, '')
      return buff
    end
  end
  buff
end