@@ -29,62 +29,57 @@ def initialize(info={})
29
29
OptBool . new ( 'CHANNELIZE' , [ true , 'Chanelize output, required for reading output or interracting' , true ] ) ,
30
30
OptBool . new ( 'INTERACTIVE' , [ true , 'Run interactively' , true ] ) ,
31
31
OptBool . new ( 'HIDDEN' , [ true , 'Hide the window' , true ] ) ,
32
- #OptString.new('DUMMY', [false, 'Run in a dummy host process', '']),
33
32
] , self . class )
34
33
end
35
34
36
35
def run
37
- begin
38
- raise "Powershell is required" if !have_powershell?
39
- #Variable Setup
40
- user = datastore [ 'user' ]
41
- pass = datastore [ 'pass' ]
42
- domain = datastore [ 'domain' ]
43
- exe = datastore [ 'exe' ] . gsub ( "\\ " , "\\ \\ \\ \\ " )
44
- inter = datastore [ 'interactive' ]
45
- args = datastore [ 'args' ]
46
- path = datastore [ 'path' ] . gsub ( "\\ " , "\\ \\ \\ \\ " )
47
- #dummy=datastore['dummy']
48
- sessNo = datastore [ 'session' ]
49
- channelized = datastore [ 'channelize' ]
50
- hidden = datastore [ 'hidden' ]
51
- #Check if dession si interactive
52
- if ( !session . interacting and inter )
53
- print_error ( "Interactive mode can only be used in a meterpreter console" )
54
- print_error ( "Use 'run post/windows/manage/run_as_psh USER=x PASS=X EXE=X' or SET INTERACTIVE false" )
55
- raise 'Invalide console'
56
- end
57
- scr = "$pw = convertto-securestring '#{ pass } ' -asplaintext -force; "
58
- scr +="$pp = new-object -typename System.Management.Automation.PSCredential -argumentlist '#{ domain } \\ \\ #{ user } ',$pw; "
59
- scr +="Start-process '#{ exe } ' -WorkingDirectory '#{ path } ' -Credential $pp"
60
- if args and args !=''
61
- scr +=" -argumentlist '#{ args } ' "
62
- end
63
- if hidden
64
- print_status ( "Hidden mode may not work on older powershell versions, if it fails, try HIDDEN=false" )
65
- scr += " -WindowStyle hidden"
66
- end
67
- scr = " -c \" #{ scr } \" "
68
- p = client . sys . process . execute ( "powershell.exe" , scr ,
69
- 'Channelized' => channelized ,
70
- 'Desktop' => false ,
71
- 'Session' => false ,
72
- 'Hidden' => true ,
73
- 'Interactive' => inter ,
74
- 'InMemory' => nil ,
75
- 'UseThreadToken' => false )
76
- print_status ( "Process #{ p . pid } created." )
77
- print_status ( "Channel #{ p . channel . cid } created." ) if ( p . channel )
78
- if ( inter and p . channel )
79
- client . console . interact_with_channel ( p . channel )
80
- elsif p . channel
81
- data = p . channel . read ( )
82
- print_line ( data ) if data
83
- end
84
- rescue ::Interrupt
85
- raise $!
86
- rescue ::Exception => e
87
- raise e
36
+ raise "Powershell is required" if !have_powershell?
37
+ #Variable Setup
38
+ user = datastore [ 'user' ]
39
+ pass = datastore [ 'pass' ]
40
+ domain = datastore [ 'domain' ]
41
+ exe = datastore [ 'exe' ] . gsub ( "\\ " , "\\ \\ \\ \\ " )
42
+ inter = datastore [ 'interactive' ]
43
+ args = datastore [ 'args' ]
44
+ path = datastore [ 'path' ] . gsub ( "\\ " , "\\ \\ \\ \\ " )
45
+ sessNo = datastore [ 'session' ]
46
+ channelized = datastore [ 'channelize' ]
47
+ hidden = datastore [ 'hidden' ]
48
+ #Check if session si interactive
49
+ if ( !session . interacting and inter )
50
+ print_error ( "Interactive mode can only be used in a meterpreter console" )
51
+ print_error ( "Use 'run post/windows/manage/run_as_psh USER=x PASS=X EXE=X' or 'SET INTERACTIVE false'" )
52
+ raise 'Invalide console'
53
+ end
54
+ #Prepare powershell script
55
+ scr = "$pw = convertto-securestring '#{ pass } ' -asplaintext -force; "
56
+ scr << "$pp = new-object -typename System.Management.Automation.PSCredential -argumentlist '#{ domain } \\ \\ #{ user } ',$pw; "
57
+ scr << "Start-process '#{ exe } ' -WorkingDirectory '#{ path } ' -Credential $pp"
58
+ if args and args !=''
59
+ scr << " -argumentlist '#{ args } ' "
60
+ end
61
+ if hidden
62
+ print_status ( "Hidden mode may not work on older powershell versions, if it fails, try HIDDEN=false" )
63
+ scr << " -WindowStyle hidden"
64
+ end
65
+ scr = " -c \" #{ scr } \" "
66
+ #Execute script
67
+ p = client . sys . process . execute ( "powershell.exe" , scr ,
68
+ 'Channelized' => channelized ,
69
+ 'Desktop' => false ,
70
+ 'Session' => false ,
71
+ 'Hidden' => true ,
72
+ 'Interactive' => inter ,
73
+ 'InMemory' => false ,
74
+ 'UseThreadToken' => false )
75
+ print_status ( "Process #{ p . pid } created." )
76
+ print_status ( "Channel #{ p . channel . cid } created." ) if ( p . channel )
77
+ #Process output
78
+ if ( inter and p . channel )
79
+ client . console . interact_with_channel ( p . channel )
80
+ elsif p . channel
81
+ data = p . channel . read ( )
82
+ print_line ( data ) if data
88
83
end
89
84
end
90
85
end
0 commit comments