Address @jhart-r7's comments

bug/bundler_fix
Meatballs 2014-07-20 21:00:34 +01:00
parent 7583ed4950
commit b28343842f
5 changed files with 23 additions and 17 deletions

View File

@ -6,6 +6,8 @@ module Exploitation
module Powershell
class Function
FUNCTION_REGEX = Regexp.new(/\[(\w+\[\])\]\$(\w+)\s?=|\[(\w+)\]\$(\w+)\s?=|\[(\w+\[\])\]\s+?\$(\w+)\s+=|\[(\w+)\]\s+\$(\w+)\s?=/i)
PARAMETER_REGEX = Regexp.new(/param\s+\(|param\(/im)
attr_accessor :code, :name, :params
include Output
@ -32,15 +34,13 @@ module Powershell
#
def populate_params
@params = []
start = code.index(/param\s+\(|param\(/im)
start = code.index(PARAMETER_REGEX)
return unless start
# Get start of our block
idx = scan_with_index('(',code[start..-1]).first.last + start
pclause = block_extract(idx)
func_regex = /\[(\w+\[\])\]\$(\w+)\s?=|\[(\w+)\]\$(\w+)\s?=|\[(\w+\[\])\]\s+?\$(\w+)\s+=|\[(\w+)\]\s+\$(\w+)\s?=/i
#func_regex = /\[(\w+\[\])\]\.?\$(\w+)\s?=|\[(\w+)\]\s?\$(\w+)\s?=/i
matches = pclause.scan(func_regex)
matches = pclause.scan(FUNCTION_REGEX)
# Ignore assignment, create params with class and variable names
matches.each do |param|

View File

@ -8,6 +8,12 @@ module Exploitation
module Powershell
module Obfu
MULTI_LINE_COMMENTS_REGEX = Regexp.new(/<#(.*?)#>/m)
SINGLE_LINE_COMMENTS_REGEX = Regexp.new(/^\s*#(?!.*region)(.*$)/i)
WINDOWS_EOL_REGEX = Regexp.new(/[\r\n]+/)
UNIX_EOL_REGEX = Regexp.new(/[\n]+/)
WHITESPACE_REGEX = Regexp.new(/\s+/)
EMPTY_LINE_REGEX = Regexp.new(/^$|^\s+$/)
#
# Remove comments
@ -15,9 +21,9 @@ module Powershell
# @return [String] code without comments
def strip_comments
# Multi line
code.gsub!(/<#(.*?)#>/m,'')
code.gsub!(MULTI_LINE_COMMENTS_REGEX,'')
# Single line
code.gsub!(/^\s*#(?!.*region)(.*$)/i,'')
code.gsub!(SINGLE_LINE_COMMENTS_REGEX,'')
code
end
@ -28,9 +34,9 @@ module Powershell
# @return [String] code without empty lines
def strip_empty_lines
# Windows EOL
code.gsub!(/[\r\n]+/,"\r\n")
code.gsub!(WINDOWS_EOL_REGEX,"\r\n")
# UNIX EOL
code.gsub!(/[\n]+/,"\n")
code.gsub!(UNIX_EOL_REGEX,"\n")
code
end
@ -41,7 +47,7 @@ module Powershell
#
# @return [String] code with whitespace stripped
def strip_whitespace
code.gsub!(/\s+/,' ')
code.gsub!(WHITESPACE_REGEX,' ')
code
end
@ -84,7 +90,7 @@ module Powershell
subs.each do |modifier|
self.send(modifier)
end
code.gsub!(/^$|^\s+$/,'')
code.gsub!(EMPTY_LINE_REGEX,'')
code
end

View File

@ -125,7 +125,7 @@ module Powershell
end
#
# Extract block of code between inside brackets/parens
# Extract block of code inside brackets/parenthesis
#
# Attempts to match the bracket at idx, handling nesting manually
# Once the balanced matching bracket is found, all script content

View File

@ -18,9 +18,9 @@ module Powershell
# @param target [String] Location to save the file
#
# @return [String] Powershell code to download a file
def self.download(src,target=nil)
def self.download(src, target)
target ||= '$pwd\\' << src.split('/').last
return %Q^(new-object System.Net.WebClient).Downloadfile("#{src}", "#{target}")^
return %Q^(new-object System.Net.WebClient).DownloadFile("#{src}", "#{target}")^
end
#
@ -53,7 +53,7 @@ module Powershell
#
# @return [String] Powershell code to identify the PID of a file
# lock owner
def self.who_locked_file?(filename)
def self.who_locked_file(filename)
return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
end

View File

@ -7,7 +7,7 @@ describe Rex::Exploitation::Powershell::PshMethods do
describe "::download" do
it 'should return some powershell' do
script = Rex::Exploitation::Powershell::PshMethods.download('a')
script = Rex::Exploitation::Powershell::PshMethods.download('a','b')
script.should be
script.include?('WebClient').should be_true
end
@ -26,9 +26,9 @@ describe Rex::Exploitation::Powershell::PshMethods do
script.include?('AsPlainText').should be_true
end
end
describe "::who_locked_file?" do
describe "::who_locked_file" do
it 'should return some powershell' do
script = Rex::Exploitation::Powershell::PshMethods.who_locked_file?('a')
script = Rex::Exploitation::Powershell::PshMethods.who_locked_file('a')
script.should be
script.include?('Get-Process').should be_true
end