Address @jhart-r7's comments
parent
7583ed4950
commit
b28343842f
|
@ -6,6 +6,8 @@ module Exploitation
|
||||||
module Powershell
|
module Powershell
|
||||||
|
|
||||||
class Function
|
class Function
|
||||||
|
FUNCTION_REGEX = Regexp.new(/\[(\w+\[\])\]\$(\w+)\s?=|\[(\w+)\]\$(\w+)\s?=|\[(\w+\[\])\]\s+?\$(\w+)\s+=|\[(\w+)\]\s+\$(\w+)\s?=/i)
|
||||||
|
PARAMETER_REGEX = Regexp.new(/param\s+\(|param\(/im)
|
||||||
attr_accessor :code, :name, :params
|
attr_accessor :code, :name, :params
|
||||||
|
|
||||||
include Output
|
include Output
|
||||||
|
@ -32,15 +34,13 @@ module Powershell
|
||||||
#
|
#
|
||||||
def populate_params
|
def populate_params
|
||||||
@params = []
|
@params = []
|
||||||
start = code.index(/param\s+\(|param\(/im)
|
start = code.index(PARAMETER_REGEX)
|
||||||
return unless start
|
return unless start
|
||||||
# Get start of our block
|
# Get start of our block
|
||||||
idx = scan_with_index('(',code[start..-1]).first.last + start
|
idx = scan_with_index('(',code[start..-1]).first.last + start
|
||||||
pclause = block_extract(idx)
|
pclause = block_extract(idx)
|
||||||
|
|
||||||
func_regex = /\[(\w+\[\])\]\$(\w+)\s?=|\[(\w+)\]\$(\w+)\s?=|\[(\w+\[\])\]\s+?\$(\w+)\s+=|\[(\w+)\]\s+\$(\w+)\s?=/i
|
matches = pclause.scan(FUNCTION_REGEX)
|
||||||
#func_regex = /\[(\w+\[\])\]\.?\$(\w+)\s?=|\[(\w+)\]\s?\$(\w+)\s?=/i
|
|
||||||
matches = pclause.scan(func_regex)
|
|
||||||
|
|
||||||
# Ignore assignment, create params with class and variable names
|
# Ignore assignment, create params with class and variable names
|
||||||
matches.each do |param|
|
matches.each do |param|
|
||||||
|
|
|
@ -8,6 +8,12 @@ module Exploitation
|
||||||
module Powershell
|
module Powershell
|
||||||
|
|
||||||
module Obfu
|
module Obfu
|
||||||
|
MULTI_LINE_COMMENTS_REGEX = Regexp.new(/<#(.*?)#>/m)
|
||||||
|
SINGLE_LINE_COMMENTS_REGEX = Regexp.new(/^\s*#(?!.*region)(.*$)/i)
|
||||||
|
WINDOWS_EOL_REGEX = Regexp.new(/[\r\n]+/)
|
||||||
|
UNIX_EOL_REGEX = Regexp.new(/[\n]+/)
|
||||||
|
WHITESPACE_REGEX = Regexp.new(/\s+/)
|
||||||
|
EMPTY_LINE_REGEX = Regexp.new(/^$|^\s+$/)
|
||||||
|
|
||||||
#
|
#
|
||||||
# Remove comments
|
# Remove comments
|
||||||
|
@ -15,9 +21,9 @@ module Powershell
|
||||||
# @return [String] code without comments
|
# @return [String] code without comments
|
||||||
def strip_comments
|
def strip_comments
|
||||||
# Multi line
|
# Multi line
|
||||||
code.gsub!(/<#(.*?)#>/m,'')
|
code.gsub!(MULTI_LINE_COMMENTS_REGEX,'')
|
||||||
# Single line
|
# Single line
|
||||||
code.gsub!(/^\s*#(?!.*region)(.*$)/i,'')
|
code.gsub!(SINGLE_LINE_COMMENTS_REGEX,'')
|
||||||
|
|
||||||
code
|
code
|
||||||
end
|
end
|
||||||
|
@ -28,9 +34,9 @@ module Powershell
|
||||||
# @return [String] code without empty lines
|
# @return [String] code without empty lines
|
||||||
def strip_empty_lines
|
def strip_empty_lines
|
||||||
# Windows EOL
|
# Windows EOL
|
||||||
code.gsub!(/[\r\n]+/,"\r\n")
|
code.gsub!(WINDOWS_EOL_REGEX,"\r\n")
|
||||||
# UNIX EOL
|
# UNIX EOL
|
||||||
code.gsub!(/[\n]+/,"\n")
|
code.gsub!(UNIX_EOL_REGEX,"\n")
|
||||||
|
|
||||||
code
|
code
|
||||||
end
|
end
|
||||||
|
@ -41,7 +47,7 @@ module Powershell
|
||||||
#
|
#
|
||||||
# @return [String] code with whitespace stripped
|
# @return [String] code with whitespace stripped
|
||||||
def strip_whitespace
|
def strip_whitespace
|
||||||
code.gsub!(/\s+/,' ')
|
code.gsub!(WHITESPACE_REGEX,' ')
|
||||||
|
|
||||||
code
|
code
|
||||||
end
|
end
|
||||||
|
@ -84,7 +90,7 @@ module Powershell
|
||||||
subs.each do |modifier|
|
subs.each do |modifier|
|
||||||
self.send(modifier)
|
self.send(modifier)
|
||||||
end
|
end
|
||||||
code.gsub!(/^$|^\s+$/,'')
|
code.gsub!(EMPTY_LINE_REGEX,'')
|
||||||
|
|
||||||
code
|
code
|
||||||
end
|
end
|
||||||
|
|
|
@ -125,7 +125,7 @@ module Powershell
|
||||||
end
|
end
|
||||||
|
|
||||||
#
|
#
|
||||||
# Extract block of code between inside brackets/parens
|
# Extract block of code inside brackets/parenthesis
|
||||||
#
|
#
|
||||||
# Attempts to match the bracket at idx, handling nesting manually
|
# Attempts to match the bracket at idx, handling nesting manually
|
||||||
# Once the balanced matching bracket is found, all script content
|
# Once the balanced matching bracket is found, all script content
|
||||||
|
|
|
@ -18,9 +18,9 @@ module Powershell
|
||||||
# @param target [String] Location to save the file
|
# @param target [String] Location to save the file
|
||||||
#
|
#
|
||||||
# @return [String] Powershell code to download a file
|
# @return [String] Powershell code to download a file
|
||||||
def self.download(src,target=nil)
|
def self.download(src, target)
|
||||||
target ||= '$pwd\\' << src.split('/').last
|
target ||= '$pwd\\' << src.split('/').last
|
||||||
return %Q^(new-object System.Net.WebClient).Downloadfile("#{src}", "#{target}")^
|
return %Q^(new-object System.Net.WebClient).DownloadFile("#{src}", "#{target}")^
|
||||||
end
|
end
|
||||||
|
|
||||||
#
|
#
|
||||||
|
@ -53,7 +53,7 @@ module Powershell
|
||||||
#
|
#
|
||||||
# @return [String] Powershell code to identify the PID of a file
|
# @return [String] Powershell code to identify the PID of a file
|
||||||
# lock owner
|
# lock owner
|
||||||
def self.who_locked_file?(filename)
|
def self.who_locked_file(filename)
|
||||||
return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
|
return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
|
@ -7,7 +7,7 @@ describe Rex::Exploitation::Powershell::PshMethods do
|
||||||
|
|
||||||
describe "::download" do
|
describe "::download" do
|
||||||
it 'should return some powershell' do
|
it 'should return some powershell' do
|
||||||
script = Rex::Exploitation::Powershell::PshMethods.download('a')
|
script = Rex::Exploitation::Powershell::PshMethods.download('a','b')
|
||||||
script.should be
|
script.should be
|
||||||
script.include?('WebClient').should be_true
|
script.include?('WebClient').should be_true
|
||||||
end
|
end
|
||||||
|
@ -26,9 +26,9 @@ describe Rex::Exploitation::Powershell::PshMethods do
|
||||||
script.include?('AsPlainText').should be_true
|
script.include?('AsPlainText').should be_true
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
describe "::who_locked_file?" do
|
describe "::who_locked_file" do
|
||||||
it 'should return some powershell' do
|
it 'should return some powershell' do
|
||||||
script = Rex::Exploitation::Powershell::PshMethods.who_locked_file?('a')
|
script = Rex::Exploitation::Powershell::PshMethods.who_locked_file('a')
|
||||||
script.should be
|
script.should be
|
||||||
script.include?('Get-Process').should be_true
|
script.include?('Get-Process').should be_true
|
||||||
end
|
end
|
||||||
|
|
Loading…
Reference in New Issue