@@ -41,9 +41,9 @@ def initialize(info={})
41
41
OptString . new ( 'ASSEMBLIES' , [
42
42
false ,
43
43
'Any assemblies outside the defaults' ,
44
- "mscorlib.dll, System.dll, System.Xml.dll, System.Data.dll, System.Net.dll "
44
+ "mscorlib.dll, System.dll, System.Xml.dll, System.Data.dll"
45
45
] ) ,
46
- OptString . new ( 'OUTPUT_TARGET' , [ true , 'Name and path of the generated binary, default random, omit extension' ] ) ,
46
+ OptString . new ( 'OUTPUT_TARGET' , [ false , 'Name and path of the generated binary, default random, omit extension' ] ) ,
47
47
OptString . new ( 'COMPILER_OPTS' , [ false , 'Options to pass to compiler' , '/optimize' ] ) ,
48
48
OptString . new ( 'CODE_PROVIDER' , [ true , 'Code provider to use' , 'Microsoft.CSharp.CSharpCodeProvider' ] ) ,
49
49
@@ -55,7 +55,7 @@ def initialize(info={})
55
55
56
56
end
57
57
58
- def exploit
58
+ def run
59
59
60
60
# Make sure we meet the requirements before running the script
61
61
if !( session . type == "meterpreter" || have_powershell? )
@@ -82,18 +82,22 @@ def exploit
82
82
net_com_opts [ :cert ] = datastore [ 'CERT_PATH' ]
83
83
84
84
begin
85
- script = ::File . read ( datastore [ 'SOURCE_FILE' ] )
85
+ net_com_opts [ :harness ] = ::File . read ( datastore [ 'SOURCE_FILE' ] )
86
+ script = dot_net_compiler ( net_com_opts )
87
+ if datastore [ 'Powershell::Post::dry_run' ]
88
+ print_good ( "Compiler code:\n #{ script } " )
89
+ return
90
+ end
86
91
rescue => e
87
92
print_error ( e )
88
93
return
89
94
end
90
95
91
96
vprint_good ( "Writing to #{ net_com_opts [ :target ] } " )
92
-
93
97
# Compress
94
98
print_status ( 'Compressing script contents:' )
95
99
compressed_script = compress_script ( script , eof )
96
-
100
+ =begin
97
101
# If the compressed size is > 8100 bytes, launch stager
98
102
if (compressed_script.size > 8100)
99
103
print_error(" - Compressed size: #{compressed_script.size}")
@@ -107,9 +111,10 @@ def exploit
107
111
print_good(" - Compressed size: #{compressed_script.size}")
108
112
script = compressed_script
109
113
end
110
-
114
+ =end
111
115
# Execute the powershell script
112
116
print_status ( 'Executing the script.' )
117
+ #psh_exec(script,false,true)
113
118
cmd_out , running_pids , open_channels = execute_script ( script , true )
114
119
get_ps_output ( cmd_out , eof )
115
120
vprint_good ( "Cleaning up #{ running_pids . join ( ', ' ) } " )
@@ -119,7 +124,7 @@ def exploit
119
124
# Check for result
120
125
begin
121
126
size = session . fs . file . stat ( net_com_opts [ :target ] . gsub ( '\\' , '\\\\' ) ) . size
122
- vprint_good ( "File #{ net_com_opts [ :target ] . gsub ( '\\' , '\\\\' ) } found, #{ size } kb" )
127
+ print_good ( "File #{ net_com_opts [ :target ] . gsub ( '\\' , '\\\\' ) } found, #{ size } kb" )
123
128
rescue
124
129
print_error ( "File #{ net_com_opts [ :target ] . gsub ( '\\' , '\\\\' ) } not found" )
125
130
return
0 commit comments