To be clear, the shell that was tested with was 'windows/shell_reverse_tcp' delivered via 'exploit/windows/smb/psexec'
Additional changes required to fix regex to support the multiline output. Also, InstanceId uses a lower case 'D' on the platforms I tested - PowerShell 2.0 on Windows 2003, Windows 7, Windows 2008 R2 as well as PowerShell 4.0 on Windows 2012 R2.
This method doesn't appear to be used anywhere in the Metasploit codebase currently.
I have a case where on a Windows 2008 R2 host with PowerShell 2.0 the 'have_powershell' method times out. When I interactively run the command I find that the output stops after the PowerShell command and the token from 'cmd_exec' is NOT displayed. When I hit return the shell then processes the '&echo <randomstring>' and generates the token that 'cmd_exec' was looking for. I tried various versions of the PowerShell command string such as 'Get-Host;Exit(0)', '$PSVErsionTable.PSVersion', and '-Command Get-Host' but was unable to change the behavior. I found that adding 'echo. | ' simulated pressing enter and did not disrupt the results on this host or on another host where the 'have_powershell' method functioned as expected.
There may be a better solution, but this was the only one that I could find.
Adding the payload generator, but not the post module -- couldn't get a
satisfactory test out of the module (see the comments on #251).
Please open a new request with the post module and a test scenario, like
a sample script or something to drop into /scripts/powershell.
I like the powershell stuff a lot; I imagine it's a popular set of
tools on high-value targets, like workstations of IT people.
[Closes#251]
Squashed commit of the following:
commit 46475c27a2d0a84b62167a65c9a158dfb7c9e755
Author: Tod Beardsley <todb@metasploit.com>
Date: Fri May 18 15:23:22 2012 -0500
Fixing whitespace on msfvenom case list.
commit 7e4c6613004e9b70e0ba4653e9eaa83470429c7e
Merge: 81a7d6252183aa
Author: Tod Beardsley <todb@metasploit.com>
Date: Fri May 18 15:06:51 2012 -0500
Merge branch 'master' into rage-ps
commit 81a7d62c6d
Author: RageLtMan <rageltman [at] sempervictus>
Date: Tue Mar 20 20:19:13 2012 -0400
powershell for msfvenom
commit 672c7bc37e
Merge: 3e86dc4ed542e2
Author: RageLtMan <rageltman [at] sempervictus>
Date: Tue Mar 20 20:08:12 2012 -0400
exe.rb merge cleanup
commit 3e86dc4c40
Author: RageLtMan <rageltman [at] sempervictus>
Date: Tue Mar 20 20:06:03 2012 -0400
psh encoder cleanup
commit f619ed477f
Author: RageLtMan <rageltman@sempervictus.com>
Date: Sun Feb 5 13:35:11 2012 -0500
method call fix for psh-net encoder
commit 7b035e6da0
Author: RageLtMan <rageltman@sempervictus.com>
Date: Fri Feb 3 18:53:54 2012 -0500
PS encoders: .net and architecture dependent native (psh-net, psh)
commit 7a2749bf26
Merge: 32730b9f89853d
Author: RageLtMan <rageltman@sempervictus.com>
Date: Fri Feb 3 18:38:03 2012 -0500
Merge branch 'master' into powershell
commit 32730b96be
Merge: e69fcd1f6a6963
Author: RageLtMan <rageltman@sempervictus.com>
Date: Wed Jan 25 10:33:17 2012 -0500
Merge branch 'master' of https://github.com/rapid7/metasploit-framework into powershell
commit e69fcd1a83
Author: RageLtMan <rageltman@sempervictus.com>
Date: Wed Jan 25 07:59:38 2012 -0500
msfvenom psh addition
commit 9a5d8ead7e
Author: RageLtMan <rageltman@sempervictus.com>
Date: Wed Jan 25 07:29:38 2012 -0500
Proper author reference
commit 9fd8ac75a8
Author: RageLtMan <rageltman@sempervictus.com>
Date: Tue Jan 24 19:07:30 2012 -0500
Fix script handling
commit fa363dfe96
Author: RageLtMan <rageltman@sempervictus.com>
Date: Tue Jan 24 17:31:09 2012 -0500
added Msf::Post::Windows::Powershell, reworked post module to use mixin
commit e078d15b54
Author: RageLtMan <rageltman@sempervictus.com>
Date: Mon Jan 23 13:42:35 2012 -0500
vprint_good change
commit 355f8bb19a
Author: RageLtMan <rageltman@sempervictus.com>
Date: Mon Jan 23 12:50:51 2012 -0500
exec powershell module
commit 5f95094449
Author: RageLtMan <rageltman@sempervictus.com>
Date: Mon Jan 23 12:45:41 2012 -0500
powershell encoder support - Redmine Feature #6049
Tom Sellers