Add more yarddoc to Rex::Exploitation::Powershell

encode_code doesn't use eof
no need to unicode encode in gzip as this is handled by encode_code
bug/bundler_fix
Meatballs 2014-04-23 01:07:54 +01:00
parent 88fe619c48
commit 647936e291
No known key found for this signature in database
GPG Key ID: 5380EAF01F2F8B38
2 changed files with 72 additions and 10 deletions

View File

@ -89,7 +89,7 @@ module Exploit::Powershell
psh.send(mod_method)
end
psh.encode_code(eof)
psh.encode_code
end
#

View File

@ -10,10 +10,18 @@ module Powershell
module Output
#
# To String
#
# @return [String] Code
def to_s
code
end
#
# Returns code size
#
# @return [Integer] Code size
def size
code.size
end
@ -21,6 +29,7 @@ module Powershell
#
# Return code with numbered lines
#
# @return [String] Powershell code with line numbers
def to_s_lineno
numbered = ''
code.split(/\r\n|\n/).each_with_index do |line,idx|
@ -30,8 +39,12 @@ module Powershell
end
#
# Return a zlib compressed powershell code
# Return a zlib compressed powershell code wrapped in decode stub
#
# @param eof [String] End of file identifier to append to code
#
# @return [String] Zlib compressed powershell code wrapped in
# decompression stub
def deflate_code(eof = nil)
# Compress using the Deflate algorithm
compressed_stream = ::Zlib::Deflate.deflate(code,
@ -65,14 +78,18 @@ module Powershell
#
# Return Base64 encoded powershell code
#
def encode_code(eof = nil)
# @return [String] Base64 encoded powershell code
def encode_code
@code = Rex::Text.encode_base64(Rex::Text.to_unicode(code))
end
#
# Return a gzip compressed powershell code
# Return a gzip compressed powershell code wrapped in decoder stub
#
# @param eof [String] End of file identifier to append to code
#
# @return [String] Gzip compressed powershell code wrapped in
# decompression stub
def gzip_code(eof = nil)
# Compress using the Deflate algorithm
compressed_stream = Rex::Text.gzip(code)
@ -96,15 +113,18 @@ module Powershell
#if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
psh_expression << "echo '#{eof}';" if eof
# Convert expression to unicode
unicode_expression = Rex::Text.to_unicode(psh_expression)
@code = psh_expression
end
#
# Compresses script contents with gzip or deflate
# Compresses script contents with gzip (default) or deflate
#
# @param eof [String] End of file identifier to append to code
# @param gzip [Boolean] Whether to use gzip compression or deflate
# @parma in_place [Boolean] Whether to update the current script
# code or just return the output.
#
# @return [String] Compressed code wrapped in decompression stub
def compress_code(eof = nil, gzip = true, in_place = true)
code = gzip ? gzip_code(eof) : deflate_code(eof)
@code = code if in_place
@ -115,9 +135,9 @@ module Powershell
# Reverse the compression process
# Try gzip, inflate if that fails
#
# @return [String] Decompressed powershell code
def decompress_code
# Decode base64 and convert to ascii
raw = Rex::Text.decode_base64(code)
ascii_expression = Rex::Text.to_ascii(raw)
# Extract substring with payload
encoded_stream = ascii_expression.scan(/FromBase64String\('(.*)'/).flatten.first
@ -355,6 +375,10 @@ module Powershell
@name = name.strip.gsub(/\s|,/,'')
end
#
# To String
#
# @return [String] Powershell param
def to_s
"[#{klass}]$#{name}"
end
@ -373,10 +397,18 @@ module Powershell
populate_params
end
#
# To String
#
# @return [String] Powershell function
def to_s
"function #{name} #{code}"
end
#
# Identify the parameters from the code and
# store as Param in @params
#
def populate_params
@params = []
start = code.index(/param\s+\(|param\(/im)
@ -446,6 +478,11 @@ module Powershell
#
# Convert binary to byte array, read from file if able
#
# @param input_data [String] Path to powershell file or powershell
# code string
# @param var_name [String] Byte array variable name
#
# @return [String] input_data as a powershell byte array
def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
code = code.unpack('C*')
@ -462,6 +499,10 @@ module Powershell
return psh << lines.join("") + "\r\n"
end
#
# ?? RageLtMan
#
# @param dir [String] ?
def self.psp_funcs(dir)
scripts = Dir.glob(File.expand_path(dir) + '/**/*').select {|e| e =~ /ps1$|psm1$/}
functions = scripts.map {|s| puts s; Script.new(s).functions}
@ -471,6 +512,7 @@ module Powershell
#
# Return list of code modifier methods
#
# @return [Array] Code modifiers
def self.code_modifiers
self.instance_methods.select {|m| m =~ /^(strip|sub)/}
end
@ -485,6 +527,10 @@ module Powershell
#
# Download file via .NET WebClient
#
# @param src [String] URL to the file
# @param target [String] Location to save the file
#
# @return [String] Powershell code to download a file
def self.download(src,target=nil)
target ||= '$pwd\\' << src.split('/').last
return %Q^(new-object System.Net.WebClient).Downloadfile("#{src}", "#{target}")^
@ -493,6 +539,11 @@ module Powershell
#
# Uninstall app, or anything named like app
#
# @param app [String] Name of application
# @param fuzzy [Boolean] Whether to apply a fuzzy match (-like) to
# the application name
#
# @return [String] Powershell code to uninstall an application
def self.uninstall(app,fuzzy=true)
match = fuzzy ? '-like' : '-eq'
return %Q^$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name #{match} "#{app}" }; $app.Uninstall()^
@ -501,6 +552,9 @@ module Powershell
#
# Create secure string from plaintext
#
# @param str [String] String to create as a SecureString
#
# @return [String] Powershell code to create a SecureString
def self.secure_string(str)
return %Q^ConvertTo-SecureString -string '#{str}' -AsPlainText -Force$^
end
@ -508,6 +562,10 @@ module Powershell
#
# Find PID of file lock owner
#
# @param filename [String] Filename
#
# @return [String] Powershell code to identify the PID of a file
# lock owner
def self.who_locked_file?(filename)
return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
end
@ -515,6 +573,10 @@ module Powershell
#
# Return last time of login
#
# @param user [String] Username
#
# @return [String] Powershell code to return the last time of a user
# login
def self.get_last_login(user)
return %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^
end