module Rex::Powershell::Payload
Public Class Methods
read_replace_script_template(template_path, filename, hash_sub)
click to toggle source
# File lib/rex/powershell/payload.rb, line 7 def self.read_replace_script_template(template_path, filename, hash_sub) template_pathname = File.join(template_path, filename) template = '' File.open(template_pathname, "rb") {|f| template = f.read} template % hash_sub end
to_win32pe_psh(template_path, code)
click to toggle source
# File lib/rex/powershell/payload.rb, line 32 def self.to_win32pe_psh(template_path, code) hash_sub = {} hash_sub[:var_code] = Rex::Text.rand_text_alpha(rand(8)+8) hash_sub[:var_win32_func] = Rex::Text.rand_text_alpha(rand(8)+8) hash_sub[:var_payload] = Rex::Text.rand_text_alpha(rand(8)+8) hash_sub[:var_size] = Rex::Text.rand_text_alpha(rand(8)+8) hash_sub[:var_rwx] = Rex::Text.rand_text_alpha(rand(8)+8) hash_sub[:var_iter] = Rex::Text.rand_text_alpha(rand(8)+8) hash_sub[:var_syscode] = Rex::Text.rand_text_alpha(rand(8)+8) hash_sub[:shellcode] = Rex::Powershell.to_powershell(code, hash_sub[:var_code]) read_replace_script_template(template_path, "to_mem_old.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n") end
to_win32pe_psh_net(template_path, code)
click to toggle source
# File lib/rex/powershell/payload.rb, line 14 def self.to_win32pe_psh_net(template_path, code) rig = Rex::RandomIdentifier::Generator.new() rig.init_var(:var_code) rig.init_var(:var_kernel32) rig.init_var(:var_baseaddr) rig.init_var(:var_threadHandle) rig.init_var(:var_output) rig.init_var(:var_codeProvider) rig.init_var(:var_compileParams) rig.init_var(:var_syscode) rig.init_var(:var_temp) hash_sub = rig.to_h hash_sub[:b64shellcode] = Rex::Text.encode_base64(code) read_replace_script_template(template_path, "to_mem_dotnet.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n") end
to_win32pe_psh_reflection(template_path, code)
click to toggle source
Reflection technique prevents the temporary .cs file being created for the .NET compiler Tweaked by shellster Originally from PowerSploit
# File lib/rex/powershell/payload.rb, line 52 def self.to_win32pe_psh_reflection(template_path, code) # Intialize rig and value names rig = Rex::RandomIdentifier::Generator.new() rig.init_var(:func_get_proc_address) rig.init_var(:func_get_delegate_type) rig.init_var(:var_code) rig.init_var(:var_module) rig.init_var(:var_procedure) rig.init_var(:var_unsafe_native_methods) rig.init_var(:var_parameters) rig.init_var(:var_return_type) rig.init_var(:var_type_builder) rig.init_var(:var_buffer) rig.init_var(:var_hthread) hash_sub = rig.to_h hash_sub[:b64shellcode] = Rex::Text.encode_base64(code) read_replace_script_template(template_path, "to_mem_pshreflection.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n") end