Skip to content

Commit cf29a51

Browse files
author
RageLtMan
committed
Upstream Msf namespace PSH decompressor & decoder
Present convenience interfaces in Msf::Exploit::Powershell ns for decoding and decompressing PSH strings built with Rex::Powershell or compatible implementations.
1 parent 18d95b6 commit cf29a51

File tree

1 file changed

+27
-0
lines changed

1 file changed

+27
-0
lines changed

lib/msf/core/exploit/powershell.rb

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ def make_subs(script, subs)
5454

5555
script
5656
end
57+
5758
#
5859
# Return an encoded powershell script
5960
# Will invoke PSH modifiers as enabled
@@ -71,6 +72,21 @@ def encode_script(script_in, eof = nil)
7172
Rex::Powershell::Command.encode_script(script_in, eof, opts)
7273
end
7374

75+
#
76+
# Return an decoded powershell script
77+
#
78+
# @param script_in [String] Encoded contents
79+
#
80+
# @return [String] Decoded script
81+
def decode_script(script_in)
82+
if script_in.to_s.match( /[A-Za-z0-9+\/]+={0,3}/)[0] == script_in.to_s and
83+
script_in.to_s.length % 4 == 0
84+
return Rex::Powershell::Command.decode_script(script_in)
85+
else
86+
return script_in
87+
end
88+
end
89+
7490
#
7591
# Return a gzip compressed powershell script
7692
# Will invoke PSH modifiers as enabled
@@ -89,6 +105,17 @@ def compress_script(script_in, eof=nil)
89105
Rex::Powershell::Command.compress_script(script_in, eof, opts)
90106
end
91107

108+
#
109+
# Return a decompressed powershell sript
110+
#
111+
# @param script_in [String] Compressed contents with decompression stub
112+
#
113+
# @return [String] Decompressed script
114+
def decompress_script(script_in)
115+
return script_in if script_in.match(/FromBase64String/).nil?
116+
Rex::Powershell::Command.decompress_script(script_in)
117+
end
118+
92119
#
93120
# Generate a powershell command line, options are passed on to
94121
# generate_psh_args

0 commit comments

Comments
 (0)