rapid7 / rex-powershell

Rex library for dealing with Powershell Scripts

Rex::Powershell

Ruby Exploitation(Rex) library for dealing with Powershell Scripts. This Library is designed to help create and manipulate powershell scripts for use with Metasploit exploits. It is ported over from the Metasploit Framework code originally created by RageLtMan(https://github.com/sempervictus) and perfected by Meatballs1(https://github.com/Meatballs1).

Installation

Add this line to your application's Gemfile:

gem 'rex-powershell'

And then execute:

$ bundle

Or install it yourself as:

$ gem install rex-powershell

Development

After checking out the repo, run bin/setup to install dependencies. Then run rake spec to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.

To install this gem onto your local machine, run bundle exec rake install. To release a new version, update the version number in version.rb, and then run bundle exec rake release, which will create a git tag for the version, push git commits and tags, and push the .gem file to rubygems.org.

Contributing

Bug reports and pull requests are welcome on GitHub at https://github.com/rapid7/rex-powershell. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the Contributor Covenant code of conduct.

rex-powershell's Issues

Rex::Powershell::Command.compress_script generates not working payloads

duplicate of rapid7/rex#9

Rex::Powershell::Command.compress_script generates payload that are not working on win 10 1803. after some debugging i discovered that:

the current generated payload is
( NeW-OBJeCT iO.streAmreaDER( ( NeW-OBJeCT Io.ComPreSsioN.dEfLATEStReAm( [SYsTEM.Io.MEMOrYstReam][coNvERT]::FROmBase64sTRinG('S03OyFdIzkzMV6hRyC8t0U3LzElVAJMFiSUZCslWMaXFqUXFMQWlSTmZyTEpmfnJiXmpeiUVJQA=') ,[sYStEM.Io.cOMpreSSiON.coMprEssIONMoDe]::decoMPrEss)) ,[systEM.TeXT.EncoDIng]::ASCii) ).reAdtoEnD( )| Write-Host

but the working version is
( NeW-OBJeCT system.iO.streAmreaDER( ( NeW-OBJeCT system.Io.ComPreSsioN.dEfLATEStReAm( [SYsTEM.Io.MEMOrYstReam][system.coNvERT]::FROmBase64sTRinG('S03OyFdIzkzMV6hRyC8t0U3LzElVAJMFiSUZCslWMaXFqUXFMQWlSTmZyTEpmfnJiXmpeiUVJQA=') ,[sYStEM.Io.cOMpreSSiON.coMprEssIONMoDe]::decoMPrEss)) ,[systEM.TeXT.EncoDIng]::ASCii) ).reAdtoEnD( )| Write-Host

bundler fails to install data files, may be others

I'm installing the latest version 0.1.87 using the following command:

fatal: not a git repository (or any parent up to mount point /var/tmp)
Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).

It fails due to the following line:
https://github.com/rapid7/rex-powershell/blob/master/rex-powershell.gemspec#L16

The release should not use "git" since it is no longer available.

It is also reported in our bug track:
pentoo/pentoo-overlay#691

Update: it is mentioned as a bad practice in multiple places
https://stackoverflow.com/questions/16203163/what-are-the-best-practices-for-updating-a-gemspecs-file-list
Something like this should be used instead:

spec.files = Dir['data/**/*']

(need to be tested)

console and setup binaries

does this really need to ship the same console and setup binaries as rex-text and rex-random_identifier?