Skip to content

Commit 33a06fa

Browse files
author
RageLtMan
committed
Remove use_single_quotes option from Msf namespace
Internally wrapped lines of powershell built by :cmd_psh_payload in the Rex namespace require being able to place wrapping quotes in different logical places for :generate_psh_command_line and :run_hidden_psh methods. Using single quotes in the Arguments parameter of the hidden PSH runner and double quotes after the -Command flag maintains allows us to wrap the outer command in double quotes, while properly ecaping and wrapping the arguments parameter for PSH execution in single quotes. This isn't ideal, in a perfect world we'd be escaping all nested quotes and escape chars of any type valid for PSH. However, that would require more manual testing than anyone has time for (now).
1 parent 1a3fe02 commit 33a06fa

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

lib/msf/core/exploit/powershell.rb

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ def initialize(info = {})
1818
OptBool.new('Powershell::noninteractive', [true, 'Execute powershell without interaction', true]),
1919
OptBool.new('Powershell::encode_final_payload', [true, 'Encode final payload for -EncodedCommand', false]),
2020
OptBool.new('Powershell::encode_inner_payload', [true, 'Encode inner payload for -EncodedCommand', false]),
21-
OptBool.new('Powershell::use_single_quotes', [true, 'Wraps the -Command argument in single quotes', false]),
2221
OptBool.new('Powershell::no_equals', [true, 'Pad base64 until no "=" remains', false]),
2322
OptEnum.new('Powershell::method', [true, 'Payload delivery method', 'reflection', %w[net reflection old msil]])
2423
]
@@ -223,7 +222,7 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
223222
# @return [String] Powershell command line with payload
224223
def cmd_psh_payload(pay, payload_arch, opts = {})
225224
%i[persist prepend_sleep exec_in_place encode_final_payload encode_inner_payload
226-
remove_comspec noninteractive use_single_quotes no_equals method].map do |opt|
225+
remove_comspec noninteractive no_equals method].map do |opt|
227226
opts[opt] ||= datastore["Powershell::#{opt}"]
228227
end
229228

0 commit comments

Comments
 (0)