-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix #15804, fix powershell read_file on Windows Server 2012 #15808
Conversation
@@ -1,5 +1,3 @@ | |||
# Powerfun - Written by Ben Turner & Dave Hardy |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Removing this seems to bypass windows defender on Windows 10
# Read the username and hostname from the initial banner | ||
initial_output = shell_read(-1, 0.01) | ||
initial_output = shell_read(-1, 2) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This fixes the session info
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for fixing this @timwr ! I just left a comment about other payloads that seem to be affected by this change and might need to be fixed too.
We had to deal with older TLS in baseline builder. See https://github.com/rapid7/metasploit-baseline-builder/blob/master/scripts/installs/chocolatey.ps1 |
Sorry for the delay on this! I really couldn't figure out how to get the SSL connection working on Windows 7. However I was able to fix it for Windows Server 2012: 970e7cb |
Thanks for updating this @timwr ! I verified it works with all payloads against windows Server 2012. On windows 7, the Note that
|
Release NotesThis fixes a compatibility issue with Powershell |
Fix #15804 by using the old style powershell syntax (New-Object).
Verification
cmd/windows/powershell_reverse_tcp
session on Windows Server 2012 and Windows 7cmd/windows/powershell_reverse_tcp_ssl
session on Windows 10