Skip to content

Commit d31846c

Browse files
p3nt4p3nt4
authored
Merge pull request #1 from bwatters-r7/land-7730
Please the rubocop gods (unless they are dumb)
2 parents 13ccfd7 + e646a8d commit d31846c

File tree

1 file changed

+76
-73
lines changed

1 file changed

+76
-73
lines changed

‎modules/post/windows/manage/run_as_psh.rb

Lines changed: 76 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -1,84 +1,87 @@
11
##
2-
# This module requires Metasploit: http://metasploit.com/download
3-
# Current source: https://github.com/rapid7/metasploit-framework
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
44
##
55

66
require 'msf/core'
77
require 'rex'
88
require 'msf/core/post/windows/powershell'
99

1010
class MetasploitModule < Msf::Post
11-
include Msf::Post::Windows::Powershell
12-
def initialize(info={})
13-
super( update_info( info,
14-
'Name' => 'Windows \'Run As\' Using Powershell',
15-
'Description' => %q{ This module will start a process as another user using powershell. },
16-
'License' => MSF_LICENSE,
17-
'Author' => [ 'p3nt4' ],
18-
'Platform' => [ 'win' ],
19-
'SessionTypes' => [ 'meterpreter' ]
20-
))
21-
register_options(
22-
[
23-
OptString.new('USER', [true, 'User to run executable as', nil]),
24-
OptString.new('PASS', [true, 'Password of user', nil]),
25-
OptString.new('DOMAIN', [false, 'Domain of user', '']),
26-
OptString.new('EXE', [true, 'Executable to run', 'cmd.exe']),
27-
OptString.new('ARGS', [false, 'Arguments', nil]),
28-
OptString.new('PATH', [true, 'Working Directory', 'C:\\']),
29-
OptBool.new('CHANNELIZE', [true, 'Chanelize output, required for reading output or interracting', true]),
30-
OptBool.new('INTERACTIVE', [true, 'Run interactively', true]),
31-
OptBool.new('HIDDEN', [true, 'Hide the window', true]),
32-
], self.class)
33-
end
11+
include Msf::Post::Windows::Powershell
12+
def initialize(info = {})
13+
super(
14+
update_info(
15+
info,
16+
'Name' => 'Windows \'Run As\' Using Powershell',
17+
'Description' => %q( This module will start a process as another user using powershell. ),
18+
'License' => MSF_LICENSE,
19+
'Author' => [ 'p3nt4' ],
20+
'Platform' => [ 'win' ],
21+
'SessionTypes' => [ 'meterpreter' ]
22+
)
23+
)
24+
register_options(
25+
[
26+
OptString.new('USER', [true, 'User to run executable as', nil]),
27+
OptString.new('PASS', [true, 'Password of user', nil]),
28+
OptString.new('DOMAIN', [false, 'Domain of user', '']),
29+
OptString.new('EXE', [true, 'Executable to run', 'cmd.exe']),
30+
OptString.new('ARGS', [false, 'Arguments', nil]),
31+
OptString.new('PATH', [true, 'Working Directory', 'C:\\']),
32+
OptBool.new('CHANNELIZE', [true, 'Chanelize output, required for reading output or interracting', true]),
33+
OptBool.new('INTERACTIVE', [true, 'Run interactively', true]),
34+
OptBool.new('HIDDEN', [true, 'Hide the window', true])
35+
], self.class)
36+
end
3437

35-
def run
36-
raise "Powershell is required" if !have_powershell?
37-
#Variable Setup
38-
user = datastore['user']
39-
pass = datastore['pass']
40-
domain = datastore['domain']
41-
exe = datastore['exe'].gsub("\\","\\\\\\\\")
42-
inter = datastore['interactive']
43-
args = datastore['args']
44-
path = datastore['path'].gsub("\\","\\\\\\\\")
45-
channelized = datastore['channelize']
46-
hidden = datastore['hidden']
47-
#Check if session is interactive
48-
if (!session.interacting and inter)
49-
print_error("Interactive mode can only be used in a meterpreter console")
50-
print_error("Use 'run post/windows/manage/run_as_psh USER=x PASS=X EXE=X' or 'SET INTERACTIVE false'")
51-
raise 'Invalide console'
52-
end
53-
#Prepare powershell script
54-
scr = "$pw = convertto-securestring '#{pass}' -asplaintext -force; "
55-
scr << "$pp = new-object -typename System.Management.Automation.PSCredential -argumentlist '#{domain}\\\\#{user}',$pw; "
56-
scr << "Start-process '#{exe}' -WorkingDirectory '#{path}' -Credential $pp"
57-
if args and args!=''
58-
scr << " -argumentlist '#{args}' "
59-
end
60-
if hidden
61-
print_status("Hidden mode may not work on older powershell versions, if it fails, try HIDDEN=false")
62-
scr << " -WindowStyle hidden"
63-
end
64-
scr = " -c \"#{scr}\""
65-
#Execute script
66-
p = client.sys.process.execute("powershell.exe", scr,
67-
'Channelized' => channelized,
68-
'Desktop' => false,
69-
'Session' => false,
70-
'Hidden' => true,
71-
'Interactive' => inter,
72-
'InMemory' => false,
73-
'UseThreadToken' => false)
74-
print_status("Process #{p.pid} created.")
75-
print_status("Channel #{p.channel.cid} created.") if (p.channel)
76-
#Process output
77-
if (inter and p.channel)
78-
client.console.interact_with_channel(p.channel)
79-
elsif p.channel
80-
data = p.channel.read()
81-
print_line(data) if data
82-
end
38+
def run
39+
raise "Powershell is required" if !have_powershell?
40+
# Variable Setup
41+
user = datastore['user']
42+
pass = datastore['pass']
43+
domain = datastore['domain']
44+
exe = datastore['exe'].gsub("\\", "\\\\\\\\")
45+
inter = datastore['interactive']
46+
args = datastore['args']
47+
path = datastore['path'].gsub("\\", "\\\\\\\\")
48+
channelized = datastore['channelize']
49+
hidden = datastore['hidden']
50+
# Check if session is interactive
51+
if (!session.interacting and inter)
52+
print_error("Interactive mode can only be used in a meterpreter console")
53+
print_error("Use 'run post/windows/manage/run_as_psh USER=x PASS=X EXE=X' or 'SET INTERACTIVE false'")
54+
raise 'Invalide console'
55+
end
56+
# Prepare powershell script
57+
scr = "$pw = convertto-securestring '#{pass}' -asplaintext -force; "
58+
scr << "$pp = new-object -typename System.Management.Automation.PSCredential -argumentlist '#{domain}\\\\#{user}',$pw; "
59+
scr << "Start-process '#{exe}' -WorkingDirectory '#{path}' -Credential $pp"
60+
if (args and args != '')
61+
scr << " -argumentlist '#{args}' "
62+
end
63+
if hidden
64+
print_status("Hidden mode may not work on older powershell versions, if it fails, try HIDDEN=false")
65+
scr << " -WindowStyle hidden"
66+
end
67+
scr = " -c \"#{scr}\""
68+
# Execute script
69+
p = client.sys.process.execute("powershell.exe", scr,
70+
'Channelized' => channelized,
71+
'Desktop' => false,
72+
'Session' => false,
73+
'Hidden' => true,
74+
'Interactive' => inter,
75+
'InMemory' => false,
76+
'UseThreadToken' => false)
77+
print_status("Process #{p.pid} created.")
78+
print_status("Channel #{p.channel.cid} created.") if (p.channel)
79+
# Process output
80+
if (inter and p.channel)
81+
client.console.interact_with_channel(p.channel)
82+
elsif p.channel
83+
data = p.channel.read()
84+
print_line(data) if data
8385
end
86+
end
8487
end

0 commit comments

Comments
 (0)