Skip to content

Commit f70c63f

Browse files
author
Matt Graeber
committed
Invoke-WmiCommand is now PSv2 compatible
This bug fix addresses issue PowerShellMafia#96. As much as a hate dropping files to disk, this was the easiest way to preserve objects in PSv2+. If someone want to implement the [de]serialization themselves and keep everything in memory, please submit a PR.
1 parent f6e032c commit f70c63f

File tree

1 file changed

+19
-6
lines changed

1 file changed

+19
-6
lines changed

CodeExecution/Invoke-WmiCommand.ps1

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -265,7 +265,7 @@ the output of your payload back. :P
265265
}
266266

267267
$PowerShellPath = $Result.sValue
268-
Write-Verbose "Full PowerShell path: $PowerShellPath"
268+
Write-Verbose "[$Computer] Full PowerShell path: $PowerShellPath"
269269

270270
$EncodedPayload = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($Payload))
271271

@@ -296,11 +296,18 @@ the output of your payload back. :P
296296
if (($Result.ReturnValue -eq 0) -and ($Result.sValue)) {
297297
$Payload = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($Result.sValue))
298298

299-
$SerilizedPayloadResult = Invoke-Expression ($Payload) | % {
300-
[Management.Automation.PSSerializer]::Serialize($_, 4)
301-
}
299+
$TempSerializedResultPath = [IO.Path]::GetTempFileName()
300+
301+
$PayloadResult = Invoke-Expression ($Payload)
302+
303+
Export-Clixml -InputObject $PayloadResult -Path $TempSerializedResultPath
304+
305+
$SerilizedPayloadText = [IO.File]::ReadAllText($TempSerializedResultPath)
306+
307+
$null = Invoke-WmiMethod @WmiMethodArgs -Name 'SetStringValue' -ArgumentList $Hive, $RegistryKeyPath, $SerilizedPayloadText, $RegistryResultValueName
308+
309+
Remove-Item -Path $SerilizedPayloadResult -Force
302310

303-
$null = Invoke-WmiMethod @WmiMethodArgs -Name 'SetStringValue' -ArgumentList $Hive, $RegistryKeyPath, $SerilizedPayloadResult, $RegistryResultValueName
304311
$null = Invoke-WmiMethod @WmiMethodArgs -Name 'DeleteValue' -ArgumentList $Hive, $RegistryKeyPath, $RegistryPayloadValueName
305312
}
306313
}
@@ -329,7 +336,13 @@ the output of your payload back. :P
329336
Write-Verbose "[$Computer] Payload results successfully retrieved from: $RegistryHive\$RegistryKeyPath\$RegistryResultValueName"
330337

331338
$SerilizedPayloadResult = $Result.sValue
332-
$PayloadResult = [Management.Automation.PSSerializer]::Deserialize($SerilizedPayloadResult)
339+
340+
$TempSerializedResultPath = [IO.Path]::GetTempFileName()
341+
342+
Out-File -InputObject $SerilizedPayloadResult -FilePath $TempSerializedResultPath
343+
$PayloadResult = Import-Clixml -Path $TempSerializedResultPath
344+
345+
Remove-Item -Path $TempSerializedResultPath
333346

334347
$FinalResult = New-Object PSObject -Property @{
335348
PSComputerName = $Computer

0 commit comments

Comments
 (0)