Address @jhart-r7's comments

bug/bundler_fix
Meatballs 2014-07-20 21:00:34 +01:00
parent 7583ed4950
commit b28343842f
5 changed files with 23 additions and 17 deletions

View File

@ -6,6 +6,8 @@ module Exploitation
module Powershell module Powershell
class Function class Function
FUNCTION_REGEX = Regexp.new(/\[(\w+\[\])\]\$(\w+)\s?=|\[(\w+)\]\$(\w+)\s?=|\[(\w+\[\])\]\s+?\$(\w+)\s+=|\[(\w+)\]\s+\$(\w+)\s?=/i)
PARAMETER_REGEX = Regexp.new(/param\s+\(|param\(/im)
attr_accessor :code, :name, :params attr_accessor :code, :name, :params
include Output include Output
@ -32,15 +34,13 @@ module Powershell
# #
def populate_params def populate_params
@params = [] @params = []
start = code.index(/param\s+\(|param\(/im) start = code.index(PARAMETER_REGEX)
return unless start return unless start
# Get start of our block # Get start of our block
idx = scan_with_index('(',code[start..-1]).first.last + start idx = scan_with_index('(',code[start..-1]).first.last + start
pclause = block_extract(idx) pclause = block_extract(idx)
func_regex = /\[(\w+\[\])\]\$(\w+)\s?=|\[(\w+)\]\$(\w+)\s?=|\[(\w+\[\])\]\s+?\$(\w+)\s+=|\[(\w+)\]\s+\$(\w+)\s?=/i matches = pclause.scan(FUNCTION_REGEX)
#func_regex = /\[(\w+\[\])\]\.?\$(\w+)\s?=|\[(\w+)\]\s?\$(\w+)\s?=/i
matches = pclause.scan(func_regex)
# Ignore assignment, create params with class and variable names # Ignore assignment, create params with class and variable names
matches.each do |param| matches.each do |param|

View File

@ -8,6 +8,12 @@ module Exploitation
module Powershell module Powershell
module Obfu module Obfu
MULTI_LINE_COMMENTS_REGEX = Regexp.new(/<#(.*?)#>/m)
SINGLE_LINE_COMMENTS_REGEX = Regexp.new(/^\s*#(?!.*region)(.*$)/i)
WINDOWS_EOL_REGEX = Regexp.new(/[\r\n]+/)
UNIX_EOL_REGEX = Regexp.new(/[\n]+/)
WHITESPACE_REGEX = Regexp.new(/\s+/)
EMPTY_LINE_REGEX = Regexp.new(/^$|^\s+$/)
# #
# Remove comments # Remove comments
@ -15,9 +21,9 @@ module Powershell
# @return [String] code without comments # @return [String] code without comments
def strip_comments def strip_comments
# Multi line # Multi line
code.gsub!(/<#(.*?)#>/m,'') code.gsub!(MULTI_LINE_COMMENTS_REGEX,'')
# Single line # Single line
code.gsub!(/^\s*#(?!.*region)(.*$)/i,'') code.gsub!(SINGLE_LINE_COMMENTS_REGEX,'')
code code
end end
@ -28,9 +34,9 @@ module Powershell
# @return [String] code without empty lines # @return [String] code without empty lines
def strip_empty_lines def strip_empty_lines
# Windows EOL # Windows EOL
code.gsub!(/[\r\n]+/,"\r\n") code.gsub!(WINDOWS_EOL_REGEX,"\r\n")
# UNIX EOL # UNIX EOL
code.gsub!(/[\n]+/,"\n") code.gsub!(UNIX_EOL_REGEX,"\n")
code code
end end
@ -41,7 +47,7 @@ module Powershell
# #
# @return [String] code with whitespace stripped # @return [String] code with whitespace stripped
def strip_whitespace def strip_whitespace
code.gsub!(/\s+/,' ') code.gsub!(WHITESPACE_REGEX,' ')
code code
end end
@ -84,7 +90,7 @@ module Powershell
subs.each do |modifier| subs.each do |modifier|
self.send(modifier) self.send(modifier)
end end
code.gsub!(/^$|^\s+$/,'') code.gsub!(EMPTY_LINE_REGEX,'')
code code
end end

View File

@ -125,7 +125,7 @@ module Powershell
end end
# #
# Extract block of code between inside brackets/parens # Extract block of code inside brackets/parenthesis
# #
# Attempts to match the bracket at idx, handling nesting manually # Attempts to match the bracket at idx, handling nesting manually
# Once the balanced matching bracket is found, all script content # Once the balanced matching bracket is found, all script content

View File

@ -18,9 +18,9 @@ module Powershell
# @param target [String] Location to save the file # @param target [String] Location to save the file
# #
# @return [String] Powershell code to download a file # @return [String] Powershell code to download a file
def self.download(src,target=nil) def self.download(src, target)
target ||= '$pwd\\' << src.split('/').last target ||= '$pwd\\' << src.split('/').last
return %Q^(new-object System.Net.WebClient).Downloadfile("#{src}", "#{target}")^ return %Q^(new-object System.Net.WebClient).DownloadFile("#{src}", "#{target}")^
end end
# #
@ -53,7 +53,7 @@ module Powershell
# #
# @return [String] Powershell code to identify the PID of a file # @return [String] Powershell code to identify the PID of a file
# lock owner # lock owner
def self.who_locked_file?(filename) def self.who_locked_file(filename)
return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^ return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
end end

View File

@ -7,7 +7,7 @@ describe Rex::Exploitation::Powershell::PshMethods do
describe "::download" do describe "::download" do
it 'should return some powershell' do it 'should return some powershell' do
script = Rex::Exploitation::Powershell::PshMethods.download('a') script = Rex::Exploitation::Powershell::PshMethods.download('a','b')
script.should be script.should be
script.include?('WebClient').should be_true script.include?('WebClient').should be_true
end end
@ -26,9 +26,9 @@ describe Rex::Exploitation::Powershell::PshMethods do
script.include?('AsPlainText').should be_true script.include?('AsPlainText').should be_true
end end
end end
describe "::who_locked_file?" do describe "::who_locked_file" do
it 'should return some powershell' do it 'should return some powershell' do
script = Rex::Exploitation::Powershell::PshMethods.who_locked_file?('a') script = Rex::Exploitation::Powershell::PshMethods.who_locked_file('a')
script.should be script.should be
script.include?('Get-Process').should be_true script.include?('Get-Process').should be_true
end end