Fix #cd for Powershell Sessions #18021

zeroSteiner · 2023-05-23T20:16:41Z

Per PowerShell/PowerShell#10278 the .NET working directory is different from the Powershell one. Our Powershell Post API methods use a mix of Powershell and .NET methods. This means that after changing directory, methods that use .NET will fail when given relative paths because the current working directory is different. The proposed solution is to set the .NET working directory at the same time so they stay synchronized. With this in place, 3 tests will start to pass from the post/test/file module, leaving just one failure.

Also added is a method to escape Windows command literals that's more robust that what was added here which ended up breaking the cmd/windows/powershell_reverse_tcp payload when delivered via psexec.

Verification

New Output

msf6 post(test/file) > run

[!] SESSION may not be compatible with this module:
[!]  * incompatible session type: powershell
[*] Running against session -1
[*] Session type is powershell and platform is windows
[+] should write binary data
[+] should read the binary data we just wrote
[+] should delete binary files
[+] should append binary data
[+] should test for file existence
[+] should create text files
[+] should read the text we just wrote
[+] should append text files
[+] should delete text files
[+] should move files
[+] should test for directory existence
[+] should create directories
[+] should list the directory we just made
[+] should recursively delete the directory we just made
[-] FAILED: should delete a symbolic link target
[+] should not recurse into symbolic link directories
[-] Passed: 15; Failed: 1
[*] Post module execution completed

Old Output

msf6 post(test/file) > run

[!] SESSION may not be compatible with this module:
[!]  * incompatible session type: powershell
[*] Running against session -1
[*] Session type is powershell and platform is windows
[+] should write binary data
[+] should read the binary data we just wrote
[+] should delete binary files
[+] should append binary data
[+] should test for file existence
[+] should create text files
[+] should read the text we just wrote
[+] should append text files
[+] should delete text files
[+] should move files
[+] should test for directory existence
[-] FAILED: should create directories
[-] FAILED: should list the directory we just made
[+] should recursively delete the directory we just made
[-] FAILED: should delete a symbolic link target
[-] FAILED: should not recurse into symbolic link directories
[-] Passed: 12; Failed: 4
[*] Post module execution completed
msf6 post(test/file) >

See: PowerShell/PowerShell#10278

zeroSteiner · 2023-05-23T20:21:14Z

lib/msf/core/post/windows.rb

+  # @param [Boolean] spaces Whether or not to escape spaces. If the string is being passed to echo, set this to false
+  #   otherwise if it's an argument, set it to true.
+  # @return [String] The escaped string.
+  def self.escape_cmd_literal(string, spaces:)


spaces is optional here because sometimes they need to be escaped, and other times they do not.

This snippet demonstrates the issue. A small Python stub is used to print the arguments then one" "argument is passed to it showing that the space is kept but when passed to echo, the double quotes are kept.

Microsoft Windows [Version 10.0.17763.4377](c) 2018 Microsoft Corporation. All rights reserved. msflab\smcintyre@DC C:\Users\smcintyre>type args.py import sys; print(repr(sys.argv)) msflab\smcintyre@DC C:\Users\smcintyre>python args.py one" "argument ['args.py', 'one argument'] msflab\smcintyre@DC C:\Users\smcintyre>echo one" "argument one" "argument msflab\smcintyre@DC C:\Users\smcintyre>

Allowing the user to specify means the escaped value can be used in both contexts. Psexec should not escape spaces because the command is passed to echo.

jheysel-r7 · 2023-05-25T18:23:47Z

Before

msf6 post(test/file) > run

[!] SESSION may not be compatible with this module:
[!]  * incompatible session type: powershell
[*] Running against session 2
[*] Session type is powershell and platform is windows
[+] should write binary data
[+] should read the binary data we just wrote
[+] should delete binary files
[+] should append binary data
[+] should test for file existence
[+] should create text files
[+] should read the text we just wrote
[+] should append text files
[+] should delete text files
[+] should move files
[+] should test for directory existence
[-] FAILED: should create directories
[-] FAILED: should list the directory we just made
[+] should recursively delete the directory we just made
[-] failed to create the symbolic link
[-] FAILED: should delete a symbolic link target
[-] FAILED: should not recurse into symbolic link directories
[-] Passed: 12; Failed: 4
[*] Post module execution completed

After

msf6 post(test/file) > run

[!] SESSION may not be compatible with this module:
[!]  * incompatible session type: powershell
[*] Running against session -1
[*] Session type is powershell and platform is windows
[+] should test for directory existence
[+] should create directories
[+] should list the directory we just made
[+] should recursively delete the directory we just made
[+] should delete a symbolic link target
[+] should not recurse into symbolic link directories
[+] should write binary data
[+] should read the binary data we just wrote
[+] should delete binary files
[+] should append binary data
[+] should test for file existence
[+] should create text files
[+] should read the text we just wrote
[+] should append text files
[+] should delete text files
[+] should move files
[*] Passed: 16; Failed: 0
[*] Post module execution completed

Did some investigating but ultimately wasn't sure what was causing should not recurse into symbolic link directories to pass in my test but fail in yours, @zeroSteiner. I included some target/ session info below incase that helps future investigation.

system info of target

msf6 post(test/file) > sessions -l

Active sessions
===============

  Id  Name  Type                Information                         Connection
  --  ----  ----                -----------                         ----------
  1         powershell windows  DESKTOP-8ATHH6O$ @ DESKTOP-8ATHH6O  192.168.1.81:4444 -> 192.168.1.81:53271 (172.16.199.140)

msf6 post(test/file) > sessions -i 1
[*] Starting interaction with 1...

PS C:\Windows\system32> whoami
nt authority\system
PS C:\Windows\system32> systeminfo

Host Name:                 DESKTOP-8ATHH6O
OS Name:                   Microsoft Windows 10 Pro
OS Version:                10.0.19045 N/A Build 19045
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free
Registered Owner:          Windows User
Registered Organization:
Product ID:                00331-10000-00001-AA073
Original Install Date:     9/28/2022, 8:31:33 AM
System Boot Time:          5/25/2023, 11:41:54 AM
System Manufacturer:       VMware, Inc.
System Model:              VMware7,1
System Type:               x64-based PC
Processor(s):              2 Processor(s) Installed.
                           [01]: Intel64 Family 6 Model 158 Stepping 10 GenuineIntel ~2592 Mhz
                           [02]: Intel64 Family 6 Model 158 Stepping 10 GenuineIntel ~2592 Mhz
BIOS Version:              VMware, Inc. VMW71.00V.18452719.B64.2108091906, 8/9/2021
Windows Directory:         C:\Windows
System Directory:          C:\Windows\system32
Boot Device:               \Device\HarddiskVolume1
System Locale:             en-us;English (United States)
Input Locale:              en-us;English (United States)
Time Zone:                 (UTC-05:00) Eastern Time (US & Canada)
Total Physical Memory:     8,703 MB
Available Physical Memory: 4,723 MB
Virtual Memory: Max Size:  10,111 MB
Virtual Memory: Available: 4,284 MB
Virtual Memory: In Use:    5,827 MB
Page File Location(s):     C:\pagefile.sys
Domain:                    WORKGROUP
Logon Server:              N/A
Hotfix(s):                 11 Hotfix(s) Installed.
                           [01]: KB5022502
                           [02]: KB4562830
                           [03]: KB4570334
                           [04]: KB4580325
                           [05]: KB4586864
                           [06]: KB5005716
                           [07]: KB5012170
                           [08]: KB5015684
                           [09]: KB5026361
                           [10]: KB5023794
                           [11]: KB5025315
Network Card(s):           2 NIC(s) Installed.
                           [01]: Intel(R) 82574L Gigabit Network Connection
                                 Connection Name: Ethernet0
                                 DHCP Enabled:    Yes
                                 DHCP Server:     172.16.199.254
                                 IP address(es)
                                 [01]: 172.16.199.140
                                 [02]: fe80::401:7a8:cd85:40f6
                           [02]: Bluetooth Device (Personal Area Network)
                                 Connection Name: Bluetooth Network Connection
                                 Status:          Media disconnected
Hyper-V Requirements:      A hypervisor has been detected. Features required for Hyper-V will not be displayed.

jheysel-r7 · 2023-05-25T18:41:01Z

Release Notes

The Powershell Post API methods use a mix of Powershell and .NET methods which have different ways of keeping track of the current working directory. This changes fixes the ambiguity by synchronizing the current working directory referenced by each set of methods.

zeroSteiner added 2 commits May 23, 2023 15:17

Add a function to escaple cmd.exe string literals

afb31b0

Sync the .NET working path for Powershell sessions

ed5d516

See: PowerShell/PowerShell#10278

zeroSteiner commented May 23, 2023

View reviewed changes

jheysel-r7 self-assigned this May 24, 2023

smcintyre-r7 mentioned this pull request May 25, 2023

Add in CVE-2023-29084 - Zoho ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection #18018

Merged

jheysel-r7 merged commit d825515 into rapid7:master May 25, 2023
30 checks passed

jheysel-r7 added rn-enhancement release notes enhancement enhancement labels May 25, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix #cd for Powershell Sessions #18021

Fix #cd for Powershell Sessions #18021

zeroSteiner commented May 23, 2023 •

edited by jheysel-r7

zeroSteiner May 23, 2023

jheysel-r7 commented May 25, 2023

jheysel-r7 commented May 25, 2023

Fix #cd for Powershell Sessions #18021

Fix #cd for Powershell Sessions #18021

Conversation

zeroSteiner commented May 23, 2023 • edited by jheysel-r7

Verification

New Output

Old Output

zeroSteiner May 23, 2023

Choose a reason for hiding this comment

jheysel-r7 commented May 25, 2023

Before

After

jheysel-r7 commented May 25, 2023

Release Notes

zeroSteiner commented May 23, 2023 •

edited by jheysel-r7