Skip to content

Commit cc99aaa

Browse files
authored
Corrected as per reviews
1 parent 7093fa3 commit cc99aaa

File tree

1 file changed

+47
-52
lines changed

1 file changed

+47
-52
lines changed

modules/post/windows/manage/run_as_psh.rb

Lines changed: 47 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -29,62 +29,57 @@ def initialize(info={})
2929
OptBool.new('CHANNELIZE', [true, 'Chanelize output, required for reading output or interracting', true]),
3030
OptBool.new('INTERACTIVE', [true, 'Run interactively', true]),
3131
OptBool.new('HIDDEN', [true, 'Hide the window', true]),
32-
#OptString.new('DUMMY', [false, 'Run in a dummy host process', '']),
3332
], self.class)
3433
end
3534

3635
def run
37-
begin
38-
raise "Powershell is required" if !have_powershell?
39-
#Variable Setup
40-
user=datastore['user']
41-
pass=datastore['pass']
42-
domain = datastore['domain']
43-
exe=datastore['exe'].gsub("\\","\\\\\\\\")
44-
inter=datastore['interactive']
45-
args=datastore['args']
46-
path=datastore['path'].gsub("\\","\\\\\\\\")
47-
#dummy=datastore['dummy']
48-
sessNo=datastore['session']
49-
channelized = datastore['channelize']
50-
hidden = datastore['hidden']
51-
#Check if dession si interactive
52-
if (!session.interacting and inter)
53-
print_error("Interactive mode can only be used in a meterpreter console")
54-
print_error("Use 'run post/windows/manage/run_as_psh USER=x PASS=X EXE=X' or SET INTERACTIVE false")
55-
raise 'Invalide console'
56-
end
57-
scr="$pw = convertto-securestring '#{pass}' -asplaintext -force; "
58-
scr+="$pp = new-object -typename System.Management.Automation.PSCredential -argumentlist '#{domain}\\\\#{user}',$pw; "
59-
scr+="Start-process '#{exe}' -WorkingDirectory '#{path}' -Credential $pp"
60-
if args and args!=''
61-
scr+=" -argumentlist '#{args}' "
62-
end
63-
if hidden
64-
print_status("Hidden mode may not work on older powershell versions, if it fails, try HIDDEN=false")
65-
scr+= " -WindowStyle hidden"
66-
end
67-
scr=" -c \"#{scr}\""
68-
p = client.sys.process.execute("powershell.exe", scr,
69-
'Channelized' => channelized,
70-
'Desktop' => false,
71-
'Session' => false,
72-
'Hidden' => true,
73-
'Interactive' => inter,
74-
'InMemory' => nil,
75-
'UseThreadToken' => false)
76-
print_status("Process #{p.pid} created.")
77-
print_status("Channel #{p.channel.cid} created.") if (p.channel)
78-
if (inter and p.channel)
79-
client.console.interact_with_channel(p.channel)
80-
elsif p.channel
81-
data = p.channel.read()
82-
print_line(data) if data
83-
end
84-
rescue ::Interrupt
85-
raise $!
86-
rescue ::Exception => e
87-
raise e
36+
raise "Powershell is required" if !have_powershell?
37+
#Variable Setup
38+
user = datastore['user']
39+
pass = datastore['pass']
40+
domain = datastore['domain']
41+
exe = datastore['exe'].gsub("\\","\\\\\\\\")
42+
inter = datastore['interactive']
43+
args = datastore['args']
44+
path = datastore['path'].gsub("\\","\\\\\\\\")
45+
sessNo = datastore['session']
46+
channelized = datastore['channelize']
47+
hidden = datastore['hidden']
48+
#Check if session si interactive
49+
if (!session.interacting and inter)
50+
print_error("Interactive mode can only be used in a meterpreter console")
51+
print_error("Use 'run post/windows/manage/run_as_psh USER=x PASS=X EXE=X' or 'SET INTERACTIVE false'")
52+
raise 'Invalide console'
53+
end
54+
#Prepare powershell script
55+
scr = "$pw = convertto-securestring '#{pass}' -asplaintext -force; "
56+
scr << "$pp = new-object -typename System.Management.Automation.PSCredential -argumentlist '#{domain}\\\\#{user}',$pw; "
57+
scr << "Start-process '#{exe}' -WorkingDirectory '#{path}' -Credential $pp"
58+
if args and args!=''
59+
scr << " -argumentlist '#{args}' "
60+
end
61+
if hidden
62+
print_status("Hidden mode may not work on older powershell versions, if it fails, try HIDDEN=false")
63+
scr << " -WindowStyle hidden"
64+
end
65+
scr = " -c \"#{scr}\""
66+
#Execute script
67+
p = client.sys.process.execute("powershell.exe", scr,
68+
'Channelized' => channelized,
69+
'Desktop' => false,
70+
'Session' => false,
71+
'Hidden' => true,
72+
'Interactive' => inter,
73+
'InMemory' => false,
74+
'UseThreadToken' => false)
75+
print_status("Process #{p.pid} created.")
76+
print_status("Channel #{p.channel.cid} created.") if (p.channel)
77+
#Process output
78+
if (inter and p.channel)
79+
client.console.interact_with_channel(p.channel)
80+
elsif p.channel
81+
data = p.channel.read()
82+
print_line(data) if data
8883
end
8984
end
9085
end

0 commit comments

Comments
 (0)