powershell prompt hanging/freezes

[eqhaleel]

Attached is the picture portraying the issue

[1captainnemo1]

What happens when you use any other port , other than 443 ?
443 is the https port and it might take some time to offload the traffic on the channel.
Does the same issue occur on any other ports ?
If yes , try swapping the payload to "cmd.exe " from "powershell.exe" in line no. 37 ( char proc[] = "powershell.exe -WindowStyle Hidden"; to char proc[] = "cmd.exe" ) and see if you get a cmd prompt.
If successful, leverage the cmd prompt to powershell prompt by simply typing powershell.exe on the obtained rsh cmd prompt and import all the modules using import-module *
Let me know the results.

[eqhaleel]

The issue still persists on other ports i.e 80,8080..however when i swapped the powershell.exe to cmd.exe i got the cmd prompt but whenever i try to leverage that prompt to powershell it hangs. Furthermore,i realized that after executing the payload on the target,the prompt doesn't disapper and when i try to leverage the cmd to powershell it only appears in the prompt on the target system, attached are the pictures to buttress my point

[1captainnemo1]

Whats the version of powershell thats installed on the host machine ( the victim machine )?
Can you repro a fork, on the Win 10 machine, by going into cmd, and trying to invoke powershell from cmd , by typing powershell.exe or just powershell, and check if the ps prompt comes up on the win 10 machine or not.
That would narrow down the issue to a limited scope .

Also , in certain rare cases I have noticed that the ps prompt DOES NOT appear, but powershell will accept the commands, so when you obtain the reverseshell, try to type in any command like say ls , or get-command on the blank prompt on the parrot nc terminal and see if you are getting a response or not.

[1captainnemo1]

I repro-ed the issue at my end and its working perfectly.
Now , as the prompt does not disappear , and by the prompt, I assume that you are talking about the execution splash screen(black screen) , does that happen in both the cases, I mean , when the payload is cmd.exe and powershell.exe ? Or does the prompt freeze only when the process is defined as "powershell.exe" in the source code.
The executable splash screen will disappear after completion of 4 tasks, namely
1.. decoy fireup (calc.exe)
2. copy the executable in appdata
3. write a registry key
4. invoke the reverse connection.

in the above mentioned sequence.

Now the entire issue pivots around , the last step , where powershell , is being invoked.

I believe that you will face the same issue on the win 10 machine , when you try to leverage a simple cmd prompt to powershell prompt, by typing powershell.exe or powershell , on the cmd prompt.

In which case , i am inclined to believe that powershell might not be set up properly.
for example , the PATH system variable and the PSModulePath system variable , in sysdm.cpl , might not be set up correctly .
We will check that later. Please try the cmd to powershell invocation , directly on the target win 10 machine, and let me know the results.

[eqhaleel]

The process of execution of splash screen disappears when it is powershell.exe in the source code but i i changed the powershell to cmd.exe in the source the code the splash screen does not disappear

[eqhaleel]

Cmd to powershell invocation directly on the target machine is captured on the picture attached...it does invoke and the powershell version is 5.0

[1captainnemo1]

There are a few possibilities that comes to mind .
Firstly , the remote invocation freezing either points to an IdleTimeout on winrm
Let me ask you, is winrm service running on your system ?
to check that type in winrm qc on an admin cmd prompt and see if the command prompts for any change or simply states that the service is running .
If its running , run: winrm get winrm/config/winrs check the following
C:\WINDOWS\system32>winrm get winrm/config/winrs
Winrs
AllowRemoteShellAccess = true
IdleTimeout = 7200000
MaxConcurrentUsers = 2147483647
MaxShellRunTime = 2147483647
MaxProcessesPerShell = 2147483647
MaxMemoryPerShellMB = 2147483647
MaxShellsPerUser = 2147483647

Let me know the values.
The first one(AllowRemoteShellAccess) should be set to true

[eqhaleel]

the following are my values
AllowRemoteShellAccess = true
IdleTimeout = 7200000
MaxConcurrentUsers = 10
MaxShellRunTime = 2147483647
MaxProcessesPerShell = 25
MaxMemoryPerShellMB = 1024
MaxShellsPerUser = 30

[1captainnemo1]

There we go !!
Try upping the MaxMemoryPerShellMB to a higher value using
winrm set winrm/config/winrs @{MaxMemoryPerShellMB="VALUE"`}

Replace the VALUE with a higher number .

Do the same with MaxProcessesPerShell , spiking it with a higher number.
A reboot might be required or atleast winrm service restart.

Try it out and get back to me.

[nymaria225]

Thesame thing, it keeps hanging up at the powershell prompt

[1captainnemo1]

Please provide the Linux distro that you are using, along with the architecture.
uname -a should be enough.
I have not tested this on a parrot OS or Arch.
Also please provide the powershell version currently installed on the victim machine.
Go through the thread and let me know @nymaria225 , and if required I will take a look at either yours or @eqhaleel 's system through teamviewer.

[eqhaleel]

Linux parrot 5.1.0-parrot1-3t-amd64 #1 SMP Parrot 5.1.3-1parrot1.3t (2019-05-20) x86_64 GNU/Linux
and
powershell version is 5

[eqhaleel]

can i get your email?

[1captainnemo1]

Drop a comment on the official FB page
https://www.facebook.com/Hack-Athon-BOOK-of-Wisdom-1258144607678680
and we might discuss ways of looking at your setup there.

@nymaria225 , are you also running parrot OS

[eqhaleel]

im not on facebook,how about twitter or instagram?