Powershell import #2075

sempervictus · 2013-07-04T18:16:49Z

Thank you @meatballs for kicking me in the posterior to do this properly (#2073).

If the regex fails then the entire moudle would too

Add Rex powershell parser: reads PSH, determines functions, variables, blocks compresses and cleans up the code it's read, obfuscates handles string literals and reserved variable names extracts code blocks and functions for reuse turns powersploit into a useful sub-component for MSF Rewire Msf powershell modules Make use of Rex parser Handles payload generation, substituions Brings convenience methods - byte array generation and download Re-add .NET compiler Compiles .NET code (C#/VB.NET) in memory Can generate binary output file (dynamic persistence) Handles code-signing (steal cert with mimikatz, sign your bin) Not detected by AV (still...) Update payload generation GZip compression and decompression (see Rex module as well) msftidy violations for space efficiency - each char counts Re-submit psexec-psh Makes use of updated Msf and Rex modules Runs shellcode in-memory (in a hidden PSH window) Completely bypasses all AVs tested for the last year...

Meatballs1 · 2013-07-04T19:10:54Z

I fear that such a large pull is going to go the way of the previous one... Can we start off simple with 1 module (e.g. psexec) and just the dependencies for that?

There's also #2037 which will cause conflicts at some stage.

sempervictus · 2013-07-04T21:39:32Z

We can probably split this into core/exploit & post PRs (along with removing g0tm1lk's work which somehow made this branch). As far as the variable repetition issue, i think that's resolved in my code already.
This is still missing modules for actually building the .NET code (there's some other proprietary code in there i need to remove) and powersploit ports into MSF as i've not had time to reach out to Matt Graeber to get permission for it (MSIL injection and the like).

I think we should be able to comfortably convert the other PSH related PRs into this codebase and make use of the Rex parser/builder for dealing with PSH down the line.

Meatballs1 · 2013-07-19T22:39:08Z

@sempervictus I think this pull is waiting on:

Removing @g0tmi1k's PR
psexec_psh.rb deconflicting with whats already in trunk now
Splitting up into smaller chunks:

Post module can be submitted on its own?
Incremental adjustments to the library classes?

Hopefully @dark0perator and @obsuresec will drum up more powershell demand ;)

g0tmi1k · 2013-07-20T06:45:21Z

How did my stuff end up here!? :s

Meatballs1 · 2013-07-20T09:01:19Z

@sempervictus's bad branch management ;)

@g0tm1lk

@g0tm1lk: no clue, you must've pwned me in your sl33p. :)

Resolve conflicts from old code being pulled into master. Conflicts: lib/msf/core/exploit/powershell.rb modules/exploits/windows/smb/psexec_psh.rb

Remove .NET compiler, post lib and modules.

This is temporary and rather messy. Since the internals for dealing with PSH code have moved to Rex there may be a hiccup or two here. This was my original attempt at basic PSH integration and does not make use of the new libraries and namespaces in this PR. Will introduce the updated modules and libraries in separate PR.

sempervictus · 2013-07-20T23:50:45Z

Lets see how this goes - i've cut out post and .NET work for now, leaving just the core requirements. I need to finish with some client related work and i'll cut up new PRs for the post libs, PSH modules (execute in memory to your heart's content), and the in-mem .NET compiler.

@devs: for testing, shoot something running powershell with the new psexec_psh module for functional purposes.
Then, find a .ps1 file on your machine and:

s =Rex::Exploitation::Powershell::Script.new <your_file>
s.code
s.functions
s.compress_code

and so forth.
Makes life easier when you're up @ the Msf::... level, the psh code already does what we need.
I've tested this a reasonable amount, any feedback on parsing/processing failures would be great
@egypt: you're welcome to install every vendor's AV to see what they say. The actual binary executing the wraper + shellcode is a well known and trusted system bin which doesnt look that weird accessing the net when heuristics engines look @ it. If you ask them to look @ unsafe .NET calls, take a look @ https://github.com/mattifestation/PowerSploit/blob/master/CodeExecution/Invoke-ShellcodeMSIL.ps1, which avoids the problem rather neatly.

Meatballs1 · 2013-07-20T23:52:16Z

lib/msf/core/exploit/powershell.rb has lots of merge conflicts in it

Meatballs1 · 2013-07-20T23:54:42Z

modules/exploits/windows/smb/psexec_psh.rb also appears to be overwritten with a completely different file! 🐙

sempervictus · 2013-07-20T23:59:33Z

They are overwrites, problem is that the PR resurrecting psexec_psh is based on old code from my framework, which has been superceded by these components as well as other private libs.

As you can see by my commit/PR history there's a ton of work in my framework which isnt in master. I tend to make large PRs and work in lib which probably doesnt help. This is the first time i've run into the problem of having someone resurrect conflicting (out of date) work. Sorry for all the confusion.

todb-r7 · 2013-07-21T00:02:17Z

Unfortunately, you're going to have to untangle these conflicts before we can start to validate it. Otherwise, it's a guessing game to determine your intent.

sempervictus · 2013-07-21T00:05:58Z

@todb-r7: any chance i can put back the post lib and modules? They all run off the same base in Rex::Exploitation and Msf::Core::Exploit.

Intent is for us to have a unified mechanism for working with powershell code. Allow framework and modules to have a central interface and reduce hackery.

todb-r7 · 2013-07-21T00:14:54Z

@sempervictus sorry it's just hard to see what the changes intended are in my phone, I'll (or someone) will take a look on a proper computer.

Meatballs1 · 2013-07-28T21:10:43Z

@sempervictus I'm happy to help get this landed but psexec_psh is still overwritten with completely the wrong file.

Replace powershell lib which snuck in as psexec_psh. Introduce psexec_psh module which uses the Rex and Msf PSH methods provided in the lib import.

sempervictus · 2013-07-28T23:29:12Z

Thank you @Meatballs1. Too many branches, not nearly enough time these days.

Meatballs1 · 2013-07-29T12:46:33Z

modules/exploits/windows/smb/psexec_psh.rb

-	def exploit
-		command = cmd_psh_payload(payload.encoded)
+		register_options([
+			OptBool.new('PERSIST', [false, 'Run the payload in a loop']),


I re-factored these to the mixin library as they are not referenced in the module but are referenced in the mixin so it makes more sense, to me, for them to be there?

Meatballs1 · 2013-07-29T13:21:42Z

I'll see if I can correct the merge issues with psexec_psh should be pretty straightforward

… psh_merge Conflicts: modules/exploits/windows/smb/psexec_psh.rb

Looks good from here, though we may want to address the all caps opt names.

Meatballs1 · 2013-07-31T15:57:33Z

lib/msf/core/exploit/powershell.rb

+    # Build script object
+    psh = PshScript.new(script_in)
+    # Invoke enabled modifiers
+    datastore.select {|k,v| k =~ /^PSH::(strip|sub)/ and v == 'true' }.keys.map do |k|


Will this work with the renaming of the functions?

Yup, i run with sub_vars and sub_funcs all the time. This was written before the recent commits adding unique random var generation, so handles that in the psh Rex lib. If you're seeing bugs in testing, would love to reproduce and fix in the Rex layer.

… into powershell_import

…t-framework into powershell_import

This is the core post component broken out from rapid7#2075. Includes new post library leveraging the rex and msf namespace changes in lib. Includes basic modules for script and command execution. These modules can be used a simple base for complex powershell execution from post modules and RC scripts.

Meatballs1 · 2013-08-20T20:37:08Z

modules/exploits/windows/smb/psexec_psh.rb

@@ -68,16 +68,21 @@ def initialize(info = {})
 				[ 'URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx' ]
 			]
 		))
+
+		register_options([
+			OptBool.new('DryRun',[false,'dry run',false]),


This needs a better description

Meatballs1 · 2013-08-20T20:57:26Z

Dev Required

Naming convention of PSH:: should be lower_case
Integrate the Rex::RandomIdentifierGenerator into the PSH exe functions
Other small comments

Testing Required, doesn't look like this affects too much existing functionality - post modules/scripts not affected.

Check .ps1 generation still works correctly - msfvenom/msfpayload/psh_web_delivery
Check psexec_psh still works correctly

Meatballs1 · 2013-08-20T21:35:14Z

modules/exploits/windows/smb/psexec_psh.rb

 				fail_with(Exploit::Failure::NoAccess, "#{peer} - Unable to authenticate with given credentials: #{autherror}")
+      ensure


This disconnect causes the module to fail, should be placed back within the rescue. My bad!

Retab/pr/2075

Meatballs1 · 2013-09-16T09:40:21Z

I have submitted a PR to sempervictus repository to advance this sempervictus#18

jvazquez-r7 · 2013-11-19T22:41:00Z

According to github there are conflics to solve before we can proceed with this. Please fix them or warn us if github is wrong :)

Meatballs1 · 2013-11-20T18:24:46Z

I have merged some of the conflicts in #2557 but that is also in need of some deconfliction!

jvazquez-r7 · 2013-11-21T15:55:09Z

This pull request is creating conflicts and can't be landed, please @sempervictus feel free to fix the conflicts and reopen again once ready.

In Addition, according to @Meatballs1 , some of the conflicts are already merged on #2557, which as far as I understand is the same thing than this pull request. So I guess work can be done on #2557, right?

g0tmi1k and others added 2 commits July 4, 2013 13:27

post/local_admin_search_enum~Regex fails,module 2

595e538

If the regex fails then the entire moudle would too

sempervictus mentioned this pull request Jul 6, 2013

Resurrect PSEXEC Powershell #2073

Merged

sempervictus mentioned this pull request Jul 19, 2013

PSH Downloader #2133

Merged

RageLtMan added 4 commits July 20, 2013 19:26

Revert "post/local_admin_search_enum~Regex fails,module 2"

cd14569

@g0tm1lk: no clue, you must've pwned me in your sl33p. :)

Merge branch 'master' into powershell_import

dc15c5b

Resolve conflicts from old code being pulled into master. Conflicts: lib/msf/core/exploit/powershell.rb modules/exploits/windows/smb/psexec_psh.rb

Trim to core requirements

eb18537

Remove .NET compiler, post lib and modules.

replace lib/msf/core/exploit/powershell.rb, thanks @Meatballs1

4df3b02

sempervictus mentioned this pull request Jul 28, 2013

Exploits MS13-005 - Low Integrity to Medium Integrity Local Priv Esc #2162

Merged

Fix git branch mauling - reintroduce psexec_psh

b3fab9a

Replace powershell lib which snuck in as psexec_psh. Introduce psexec_psh module which uses the Rex and Msf PSH methods provided in the lib import.

Meatballs1 reviewed Jul 29, 2013
View reviewed changes

Meatballs1 added 3 commits July 29, 2013 15:13

Selective psexec_psh merge.

176de5a

Merge remote-tracking branch 'remotes/semperv/powershell_import' into…

eb3f83f

… psh_merge Conflicts: modules/exploits/windows/smb/psexec_psh.rb

Merge Upstream Exploit::Powershell

59a2c7e

Merge pull request #5 from Meatballs1/psh_merge

976c058

Looks good from here, though we may want to address the all caps opt names.

Meatballs1 reviewed Jul 31, 2013
View reviewed changes

RageLtMan added 2 commits July 31, 2013 18:34

Merge branch 'master' of https://github.com/rapid7/metasploit-framework…

7c46e95

… into powershell_import

Merge branch 'powershell_import' of github.com:sempervictus/metasploi…

2c850d8

…t-framework into powershell_import

sempervictus mentioned this pull request Jul 31, 2013

Powershell import post #2183

Closed

Meatballs1 reviewed Aug 20, 2013
View reviewed changes

tabassassin added 2 commits September 5, 2013 14:33

Merge for retab

8668a51

Retab changes for PR rapid7#2075

3494374

todb-r7 mentioned this pull request Sep 5, 2013

Retab/pr/2075 sempervictus/metasploit-framework#8

Merged

Merge pull request #8 from tabassassin/retab/pr/2075

a2be75b

Retab/pr/2075

Meatballs1 mentioned this pull request Sep 16, 2013

Powershell bulk import - modules, libs, and suggestions for further targets #1379

Closed

Meatballs1 mentioned this pull request Oct 21, 2013

Powershell Improvements - Auto Arch Detection, Size Reduction #2557

Closed

14 tasks

jvazquez-r7 closed this Nov 21, 2013

Meatballs1 added a commit that referenced this pull request Jul 30, 2014

Land #2075, Powershell Improvements

53b66f3

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Powershell import #2075

Powershell import #2075

sempervictus commented Jul 4, 2013

Meatballs1 commented Jul 4, 2013

sempervictus commented Jul 4, 2013

Meatballs1 commented Jul 19, 2013

g0tmi1k commented Jul 20, 2013

Meatballs1 commented Jul 20, 2013

sempervictus commented Jul 20, 2013

Meatballs1 commented Jul 20, 2013

Meatballs1 commented Jul 20, 2013

sempervictus commented Jul 20, 2013

todb-r7 commented Jul 21, 2013

sempervictus commented Jul 21, 2013

todb-r7 commented Jul 21, 2013

Meatballs1 commented Jul 28, 2013

sempervictus commented Jul 28, 2013

Meatballs1 Jul 29, 2013

Meatballs1 commented Jul 29, 2013

Meatballs1 Jul 31, 2013

sempervictus Jul 31, 2013

Meatballs1 Aug 20, 2013

Meatballs1 commented Aug 20, 2013

Meatballs1 Aug 20, 2013

Meatballs1 commented Sep 16, 2013

jvazquez-r7 commented Nov 19, 2013

Meatballs1 commented Nov 20, 2013

jvazquez-r7 commented Nov 21, 2013

		fail_with(Exploit::Failure::NoAccess, "#{peer} - Unable to authenticate with given credentials: #{autherror}")
		ensure

Powershell import #2075

Powershell import #2075

Conversation

sempervictus commented Jul 4, 2013

Meatballs1 commented Jul 4, 2013

sempervictus commented Jul 4, 2013

Meatballs1 commented Jul 19, 2013

g0tmi1k commented Jul 20, 2013

Meatballs1 commented Jul 20, 2013

sempervictus commented Jul 20, 2013

Meatballs1 commented Jul 20, 2013

Meatballs1 commented Jul 20, 2013

sempervictus commented Jul 20, 2013

todb-r7 commented Jul 21, 2013

sempervictus commented Jul 21, 2013

todb-r7 commented Jul 21, 2013

Meatballs1 commented Jul 28, 2013

sempervictus commented Jul 28, 2013

Meatballs1 Jul 29, 2013

Choose a reason for hiding this comment

Meatballs1 commented Jul 29, 2013

Meatballs1 Jul 31, 2013

Choose a reason for hiding this comment

sempervictus Jul 31, 2013

Choose a reason for hiding this comment

Meatballs1 Aug 20, 2013

Choose a reason for hiding this comment

Meatballs1 commented Aug 20, 2013

Meatballs1 Aug 20, 2013

Choose a reason for hiding this comment

Meatballs1 commented Sep 16, 2013

jvazquez-r7 commented Nov 19, 2013

Meatballs1 commented Nov 20, 2013

jvazquez-r7 commented Nov 21, 2013