evil-winrm 3.9 → 4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 00667efb62697e6dd9757369f1db060361b7fe6c38cdc2f2b740d8d97040e9db
-  data.tar.gz: 6cd43aa52b1e1c1e6d91a155f653c3c72d259dd32a9bd2cd64f9b3173927a466
+  metadata.gz: 30c79c310ded67cef1d5bf2b58e0a40fab19f4677a35c3d6c60f5cd8c50d838e
+  data.tar.gz: 434a47d6a124f8769fe549ec89e40fe7b2c582fd48c023c72e7944697cc9efbb
 SHA512:
-  metadata.gz: dff7266f3a6045fa0944b45851e434ed5d53508a73af2446d702979a09cb7a2bb121eba672f4bbb26ba84966e2e55d661d1b6ec869018169383ca0dafc0de1ba
-  data.tar.gz: c540b57db84aa63896c72f109243e3e10f93d4919765f7c1a97b43d2f7a97dbb15e99550d8dc0bdf82520c0188363eaa302e045ea9026ff2d8ef53573f8a0e5f
+  metadata.gz: baa637901d809d708be6580a8cc12ad6296929d246aebc4d31e225c34aac31de1ac02b174141f5bda902c1c675c2000bd29c866a903f4c2cc0738183ca50be82
+  data.tar.gz: 5c318e9333a6d934a84dece396a1c189819545bf6ef7c61d801a65a062128561e7d4b8b2b0bfe323155ca5547d466d28051f4b8fcc28c038397b46e58c59e96b

data/evil-winrm.rb

@@ -18,11 +18,12 @@ require 'time'
 require 'fileutils'
 require 'logger'
 require 'shellwords'
+require 'thread'
 
 # Constants
 
 # Version
-VERSION = '3.9'
+VERSION = '4.1'
 
 # Msg types
 TYPE_INFO = 0
@@ -34,7 +35,7 @@ TYPE_SUCCESS = 4
 # Global vars
 
 # Available commands
-$LIST = %w[Bypass-4MSI services upload download clear cls menu exit]
+$LIST = %w[Bypass-4MSI services upload download clear cls menu exit quit]
 $COMMANDS = $LIST.dup
 $CMDS = $COMMANDS.clone
 $LISTASSEM = [''].sort
@@ -94,6 +95,9 @@ $WORDS_RANDOM_CASE = [
 $colors_enabled = true
 $check_rpath_completion = true
 
+# Flush stdout after each write
+$stdout.sync = true
+
 # Path for ps1 scripts and exec files
 $scripts_path = ''
 $executables_path = ''
@@ -155,7 +159,10 @@ module WinRM
         command = "Get-ChildItem #{remote_path} | Select-Object Name"
 
         @connection.shell(:powershell) { |e| e.run(command) }.stdout.strip.split(/\n/).drop(2).each do |file|
-          download(File.join(remote_file_path.to_s, file.strip), File.join(local_path, file.strip), chunk_size, false)
+          sanitized_path = File.basename(file.strip)
+          next if sanitized_path.empty? || sanitized_path == '.' || sanitized_path == '..'
+
+          download(File.join(remote_file_path.to_s, file.strip), File.join(local_path, sanitized_path), chunk_size, false)
         end
       end
 
@@ -1073,6 +1080,80 @@ class EvilWinRM
     ccache_path
   end
 
+  # True when the exception indicates the WinRM session is dead or was never established
+  def connection_error?(error)
+    error_msg = error.message.to_s.downcase
+    error_class = error.class.to_s
+
+    return true if error_msg.match?(/timeout|connection|closed|broken|reset|refused|unreachable|unauthorized|digest|ssl|ntlm|spnego|kerberos|gssapi|wsman|winrm|http|401|403|500|503|expired|empty response/)
+    return true if error_class.match?(/Timeout|Connection|Socket|HTTP|WinRM|GSSAPI|GssApi|OpenSSL|Errno/)
+
+    false
+  end
+
+  # WinRM::Connection#shell is lazy: the TCP/WinRM handshake happens on the first command.
+  # Never show the interactive prompt unless that command actually succeeds.
+  def verify_remote_connection(shell)
+    result = shell.run('(get-location).path')
+    pwd = result&.output.to_s.strip
+    raise 'Empty response from remote endpoint; session is not ready' if pwd.empty?
+
+    pwd
+  rescue => e
+    print_message('Cannot establish connection to remote endpoint. Check credentials and network.', TYPE_ERROR, true, $logger)
+    print_message("#{e.class}: #{e.message}", TYPE_ERROR, true, $logger)
+    custom_exit(1, false)
+  end
+
+  def handle_lost_connection(error)
+    puts
+    print_message("Connection timeout or error occurred: #{error.class} - #{error.message}", TYPE_ERROR, true, $logger)
+    print_message('Cleaning up and exiting...', TYPE_WARNING, true, $logger)
+    custom_exit(1, false)
+  end
+
+  # Keep the remote shell active while the local prompt is idle.
+  # Without this, Windows marks the shell Disconnected after ~1 minute of ShellInactivity
+  # and the next command fails even though the prompt still looks connected.
+  def decorate_shell_with_keepalive(shell, interval = 30)
+    mutex = Mutex.new
+    state = { last_activity: Time.now, stop: false }
+    original_run = shell.method(:run)
+
+    shell.define_singleton_method(:run) do |*args, &block|
+      mutex.synchronize do
+        result = original_run.call(*args, &block)
+        state[:last_activity] = Time.now
+        result
+      end
+    end
+
+    thread = Thread.new do
+      Thread.current.abort_on_exception = false
+      until state[:stop]
+        sleep(interval)
+        break if state[:stop]
+        next if (Time.now - state[:last_activity]) < interval
+        next unless shell.shell_id
+
+        begin
+          shell.run('[void]0')
+        rescue StandardError
+          # The next user command will surface a dead session
+        end
+      end
+    end
+
+    lambda do
+      state[:stop] = true
+      begin
+        thread.wakeup
+      rescue ThreadError
+      end
+      thread.join(1)
+    end
+  end
+
   # Main function
   def main
     arguments
@@ -1128,7 +1209,14 @@ class EvilWinRM
       time = Time.now.to_i
       print_message('Establishing connection to remote endpoint', TYPE_INFO)
       $conn.shell(:powershell) do |shell|
+        stop_keepalive = nil
         begin
+          last_pwd = verify_remote_connection(shell)
+          pwd = last_pwd
+          skip_pwd_refresh = true
+          print_message('Connection successful', TYPE_INFO)
+          stop_keepalive ||= decorate_shell_with_keepalive(shell)
+
           completion = proc do |str|
             case
             when Readline.line_buffer =~ /help.*/i
@@ -1198,32 +1286,22 @@ class EvilWinRM
           # Load history for this host/user
           load_history
 
-          until command == 'exit' do
-            begin
-              pwd = shell.run('(get-location).path').output.strip
-            rescue => e
-              # Handle connection/timeout errors when getting pwd
-              error_msg = e.message.to_s.downcase
-              if error_msg.include?('timeout') || error_msg.include?('connection') ||
-                 error_msg.include?('closed') || error_msg.include?('broken') ||
-                 e.class.to_s.include?('Timeout') || e.class.to_s.include?('Connection')
-                puts
-                print_message("Connection timeout or error occurred: #{e.class} - #{e.message}", TYPE_ERROR, true, $logger)
-                print_message("Cleaning up and exiting...", TYPE_WARNING, true, $logger)
-                # Clean up KRB5CCNAME before exiting
-                begin
-                  if defined?($original_krb5ccname) && !$original_krb5ccname.nil?
-                    ENV['KRB5CCNAME'] = $original_krb5ccname
-                  elsif defined?($original_krb5ccname) && $original_krb5ccname.nil?
-                    ENV.delete('KRB5CCNAME') if ENV.key?('KRB5CCNAME')
-                  end
-                rescue => cleanup_error
-                  # Ignore cleanup errors
+          until %w[exit quit].include?(command) do
+            if skip_pwd_refresh
+              skip_pwd_refresh = false
+            else
+              begin
+                new_pwd = shell.run('(get-location).path').output.to_s.strip
+                unless new_pwd.empty?
+                  pwd = new_pwd
+                  last_pwd = pwd
+                end
+              rescue => e
+                if connection_error?(e)
+                  handle_lost_connection(e)
+                else
+                  pwd = last_pwd
                 end
-                custom_exit(1, false)
-              else
-                # For other errors, try to continue with a default pwd
-                pwd = "C:\\"
               end
             end
 
@@ -1233,8 +1311,14 @@ class EvilWinRM
               command = Readline.readline("*Evil-WinRM* PS #{pwd}> ", true)
             end
 
-            # Handle Ctrl+L if it returns as empty or special character
-            if command == "\f" || (command.nil? && Readline.line_buffer.empty?)
+            if command.nil?
+              custom_exit(0)
+            end
+
+            break if %w[exit quit].include?(command.strip.downcase)
+
+            # Handle Ctrl+L if it returns as a special character
+            if command == "\f"
               clear_screen
               command = ''
               next
@@ -1511,27 +1595,9 @@ class EvilWinRM
               end
               $logger.info(output_logger)
             rescue => e
-              # Handle connection/timeout errors gracefully
-              error_msg = e.message.to_s.downcase
-              if error_msg.include?('timeout') || error_msg.include?('connection') ||
-                 error_msg.include?('closed') || error_msg.include?('broken') ||
-                 e.class.to_s.include?('Timeout') || e.class.to_s.include?('Connection')
-                puts
-                print_message("Connection timeout or error occurred: #{e.class} - #{e.message}", TYPE_ERROR, true, $logger)
-                print_message("Cleaning up and exiting...", TYPE_WARNING, true, $logger)
-                # Clean up KRB5CCNAME before exiting
-                begin
-                  if defined?($original_krb5ccname) && !$original_krb5ccname.nil?
-                    ENV['KRB5CCNAME'] = $original_krb5ccname
-                  elsif defined?($original_krb5ccname) && $original_krb5ccname.nil?
-                    ENV.delete('KRB5CCNAME') if ENV.key?('KRB5CCNAME')
-                  end
-                rescue => cleanup_error
-                  # Ignore cleanup errors
-                end
-                custom_exit(1, false)
+              if connection_error?(e)
+                handle_lost_connection(e)
               else
-                # Re-raise other errors
                 raise
               end
             end
@@ -1548,6 +1614,11 @@ class EvilWinRM
           else
             retry
           end
+        ensure
+          if stop_keepalive
+            stop_keepalive.call
+            stop_keepalive = nil
+          end
         end
 
         custom_exit(0)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: evil-winrm
 version: !ruby/object:Gem::Version
-  version: '3.9'
+  version: '4.1'
 platform: ruby
 authors:
 - CyberVaca
@@ -11,7 +11,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-12-07 00:00:00.000000000 Z
+date: 2026-09-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: benchmark
@@ -75,6 +75,34 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.4.3
+- !ruby/object:Gem::Dependency
+  name: readline
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.0.4
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.0.4
+- !ruby/object:Gem::Dependency
+  name: readline-ext
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.2.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.2.0
 - !ruby/object:Gem::Dependency
   name: stringio
   requirement: !ruby/object:Gem::Requirement
@@ -147,16 +175,22 @@ dependencies:
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '5.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '5.0'
 description: The ultimate WinRM shell for hacking/pentesting
 email:
 - oscar.alfonso.diaz@gmail.com
@@ -193,7 +227,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.15
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: Evil-WinRM