module Rex::Powershell::Payload

Public Class Methods

read_replace_script_template(template_path, filename, hash_sub) click to toggle source
# File lib/rex/powershell/payload.rb, line 10
def self.read_replace_script_template(template_path, filename, hash_sub)
  template = ''
  template_pathname = File.join(template_path, filename)
  File.open(template_pathname, "rb") {|f| template = f.read}
  template % hash_sub
end
to_win32pe_psh(template_path = TEMPLATE_DIR, code) click to toggle source
# File lib/rex/powershell/payload.rb, line 36
def self.to_win32pe_psh(template_path = TEMPLATE_DIR, code)
  hash_sub = {}
  hash_sub[:var_code]                 = Rex::Text.rand_text_alpha(rand(8)+8)
  hash_sub[:var_win32_func]           = Rex::Text.rand_text_alpha(rand(8)+8)
  hash_sub[:var_payload]              = Rex::Text.rand_text_alpha(rand(8)+8)
  hash_sub[:var_size]                 = Rex::Text.rand_text_alpha(rand(8)+8)
  hash_sub[:var_rwx]                  = Rex::Text.rand_text_alpha(rand(8)+8)
  hash_sub[:var_iter]                 = Rex::Text.rand_text_alpha(rand(8)+8)
  hash_sub[:var_syscode]              = Rex::Text.rand_text_alpha(rand(8)+8)

  hash_sub[:shellcode] = Rex::Powershell.to_powershell(code, hash_sub[:var_code])

  read_replace_script_template(template_path, "to_mem_old.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")
end
to_win32pe_psh_msil(template_path = TEMPLATE_DIR, code) click to toggle source

MSIL JIT approach as demonstrated by Matt Graeber www.exploit-monday.com/2013/04/MSILbasedShellcodeExec.html Referencing PowerShell Empire data/module_source/code_execution/Invoke-ShellcodeMSIL.ps1

# File lib/rex/powershell/payload.rb, line 82
def self.to_win32pe_psh_msil(template_path = TEMPLATE_DIR, code)
  rig = Rex::RandomIdentifier::Generator.new(DEFAULT_RIG_OPTS)
  rig.init_var(:func_build_dyn_type)
  rig.init_var(:func_get_meth_addr)
  rig.init_var(:var_type_name)
  rig.init_var(:var_dyn_asm)
  rig.init_var(:var_dyn_mod)
  rig.init_var(:var_tgt_meth)
  rig.init_var(:var_dyn_type)
  rig.init_var(:var_dyn_meth)
  rig.init_var(:var_args)
  rig.init_var(:var_xor)
  rig.init_var(:var_sc_addr)
  rig.init_var(:var_sc)
  rig.init_var(:var_src_meth)
  rig.init_var(:str_addr_loc)
  rig.init_var(:str_tgt_meth)
  rig.init_var(:str_src_type)
  rig.init_var(:str_tgt_type)

  hash_sub = rig.to_h
  hash_sub[:b64shellcode] = Rex::Text.encode_base64(code)

  read_replace_script_template(template_path, "to_mem_msil.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")
end
to_win32pe_psh_net(template_path = TEMPLATE_DIR, code) click to toggle source
# File lib/rex/powershell/payload.rb, line 17
def self.to_win32pe_psh_net(template_path = TEMPLATE_DIR, code)
  rig = Rex::RandomIdentifier::Generator.new(DEFAULT_RIG_OPTS)
  rig.init_var(:var_code)
  rig.init_var(:var_kernel32)
  rig.init_var(:var_baseaddr)
  rig.init_var(:var_threadHandle)
  rig.init_var(:var_output)
  rig.init_var(:var_codeProvider)
  rig.init_var(:var_compileParams)
  rig.init_var(:var_syscode)
  rig.init_var(:var_temp)
  rig.init_var(:var_opf)

  hash_sub = rig.to_h
  hash_sub[:b64shellcode] = Rex::Text.encode_base64(code)

  read_replace_script_template(template_path, "to_mem_dotnet.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")
end
to_win32pe_psh_rc4(template_path = TEMPLATE_DIR, code) click to toggle source

PSH script that executes an RC4 encrypted payload with Invoke-Expression by Adrian Vollmer (SySS GmbH, www.syss.de)

# File lib/rex/powershell/payload.rb, line 112
def self.to_win32pe_psh_rc4(template_path = TEMPLATE_DIR, code)
  rig = Rex::RandomIdentifier::Generator.new(DEFAULT_RIG_OPTS)
  rig.init_var(:func_rc4_decrypt)
  rig.init_var(:var_rc4buffer)
  rig.init_var(:var_key)

  key = Rex::Text.rand_text_alpha(rand(8)+8)
  rc4 = RC4.new(key)
  enc_code = rc4.encrypt(code)

  hash_sub = rig.to_h
  hash_sub[:random_key] = key
  hash_sub[:b64payload] = Rex::Text.encode_base64(enc_code)

  read_replace_script_template(template_path, "to_mem_rc4.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")
end
to_win32pe_psh_reflection(template_path = TEMPLATE_DIR, code) click to toggle source

Reflection technique prevents the temporary .cs file being created for the .NET compiler Tweaked by shellster Originally from PowerSploit

# File lib/rex/powershell/payload.rb, line 56
def self.to_win32pe_psh_reflection(template_path = TEMPLATE_DIR, code)
  rig = Rex::RandomIdentifier::Generator.new(DEFAULT_RIG_OPTS)
  rig.init_var(:func_get_proc_address)
  rig.init_var(:func_get_delegate_type)
  rig.init_var(:var_code)
  rig.init_var(:var_module)
  rig.init_var(:var_procedure)
  rig.init_var(:var_unsafe_native_methods)
  rig.init_var(:var_parameters)
  rig.init_var(:var_return_type)
  rig.init_var(:var_type_builder)
  rig.init_var(:var_buffer)
  rig.init_var(:var_hthread)
  rig.init_var(:var_opf)

  hash_sub = rig.to_h
  hash_sub[:b64shellcode] = Rex::Text.encode_base64(code)

  read_replace_script_template(template_path, "to_mem_pshreflection.ps1.template",hash_sub).gsub(/(?<!\r)\n/, "\r\n")
end