Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Add Powershell meterpreter bindings #89
This PR contains a bunch of extra features for the Powershell extension submitted in #87. The summary of changes in this PR include:
I decided to avoid including bindings for both ADSI and WMI functionality, because Powershell has much better facilities to do that directly out of the box.
I'll start by bulk-loading the extensions and setting up some handy aliases to reduce typing
Now we'll look at the User functionality
Same with the Elevate functionality:
We can enumerate processes too:
Check out file system mounts (which hopefully keens @mubix happy!):
Transport listing and addition is there too:
Bindings to extensions obviously rely on those extensions being loaded. If they aren't loaded, an exception is thrown with an error message that tells the user the extension is missing.
Kiwi bindings are present so we can pull creds:
Incognito does the same thing, has a few more handy things:
All this gear can be used as part of an initialisation script.
Generate the binary with the script like so:
Set up a handler, and fire off the binary as administrator (so that the cred snarfing can happen), then we'll check the value of the
A sample script might look like this:
And importing it does the following:
Finally, we can build .NET 2.0 assemblies, and import those. Let's say we have a crappy component that does this (now included in the source for testing purposes):
We can build and use this binary like so:
I'm sure that people can come up with some new and exciting use cases all by themselves! Have at it.
There might be more, but I can't think of any!
referenced this pull request
Mar 25, 2016
Refer to this link for build results (access rights to CI server needed):
@OJ, when I try to run the msfvenom command, I see
I have the payloads branch as well as the framework branch pulled locally, and I've pointed my framework Gemfile to the local copy of payloads. Could there be something else I'm missing?
That error is thrown when the extension doesn't exist. The best thing to do when testing this is to have both
This command will copy the DLL files from
Is that what you did?