Powershell Improvements - Auto Arch Detection, Size Reduction

This is basically my PR to @sempervictus's branch https://github.com/rapid7/metasploit-framework/pull/2075

It builds a better framework for performing Powershell command execution -> shellcode execution. 

One of the main features I'm trying to do is that powershell will spawn the correct process for the payload architecture.

More and more modules are starting to poke at the powershell functionality so I would rather get these in earlier rather than later. 

## Specced
Some may not be the best specs ever written but at least they exercise most code paths

```
rspec spec/lib/rex/exploitation/powershell* spec/lib/msf/core/exploit/powershell_spec.rb 
Msf::Exploit::Powershell ...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
Rex::Exploitation::Powershell::Function ..
Rex::Exploitation::Powershell::Obfu .........
Rex::Exploitation::Powershell::Output ..............
Rex::Exploitation::Powershell::Param .
Rex::Exploitation::Powershell::Parser ...........
Rex::Exploitation::Powershell::PshMethods .....
Rex::Exploitation::Powershell::Output ...
Rex::Exploitation::Powershell ...

Finished in 4.29 seconds
543 examples, 0 failures
```
![capture](https://cloud.githubusercontent.com/assets/1854557/2882635/ec30bb50-d490-11e3-8e31-73791e73fc13.PNG)

## Features

* The payload auto detects the architecture of the runtime environment that it is executed within. This allows it to spawn a new powershell process if the shellcode targets a different architecture. This means powershell exploits have an Automatic target rather than specifying x86/x64. Obviously this doesn't work with x64 shellcode on an x86 target but x86 shellcode should be properly universal.
* It reduces the size of the final payload. This means we can execute a full meterpreter payload in a fully base64 encoded -e command around < 5700 chars. This makes the cmd exec a lot more usable as there are a lot less bad characters to worry about.
* Unencoded payloads can be generated < 2200 characters which could be helpful if command injection is more limited in size. (By editing the source powershell we should be able to drop this further).
* More flexible techniques for generating powershell command lines and arguments are used so these aren't hardcoded strings within modules. No more gsubbing of bad characters if possible!

## Options
cmd_psh_payload options:
* :use_single_quotes => Encapsulates the final -c command in single quotes. e.g. -c 'echo 1' (~2200)
* :encode_inner_payload => b64 encodes the inner payload (~5230)
* :encode_final_payload => b64 encodes the final payload e.g. -e blah. (~5700)
* :remove_comspec => Remove %COMSPEC% and just rely on powershell.exe.
* :no_full_stop => Remove .exe from powershell (incase . is a bad char)
* :no_equals => Remove == from base64 encoded final payload (incase = is a bad char)
* :shorten => Shorten command line args e.g. -Command -> -c 

## Update Modules
Current modules that need to be fixed up regarding these changes:

- [x] windows/http/oracle_endeca_exec
- [x] windows/local/current_user_psexec
- [x] windows/local/ms13_005_hwnd_broadcast
- [x] windows/local/wmi
- [x] windows/browser/ie_unsafe_scripting
- [x] windows/smb/psexec_psh
- [x] windows/misc/psh_web_delivery
- [x] windows/local/powershell_cmd_upgrade.rb
- [x] windows/misc/hp_dataprotector_exec_bar.rb

## Potential PR conflicts:

#2551
<del>#2307</del>
<del>#2468</del>
<del>#2402</del>

## Verification: Auto Arch Targeting using psh_web_delivery
- [x] x86 payload on x86 system
- [x] x86 payload on x64 Process
- [x] x86 payload on SYSWOW64 Process
- [x] x64 payload on x64 Process
- [x] x64 payload on SYSWOW64 Process

## Verification: Modules still functional
- [ ] windows/http/oracle_endeca_exec
- [x] windows/local/current_user_psexec
- [ ] windows/local/ms13_005_hwnd_broadcast
- [x] windows/local/wmi
- [ ] windows/browser/ie_unsafe_scripting
- [x] windows/smb/psexec_psh
- [x] windows/misc/psh_web_delivery
- [x] windows/local/powershell_cmd_upgrade.rb
- [ ] windows/misc/hp_dataprotector_exec_bar.rb
Leave one for the eol...
On Jul 16, 2014 3:19 PM, "Jon Hart" <notifications@github.com> wrote:

> In lib/msf/core/exploit/powershell.rb:
>
> > +        final_payload = "'#{final_payload}'"
> > +      end
> > +
> > +      command_args[:command] = final_payload
> > +    end
> > +
> > +    psh_command = generate_psh_command_line(command_args)
> > +
> > +    if opts[:remove_comspec]
> > +      command = psh_command
> > +    else
> > +      command = "%COMSPEC% /b /c start /min #{psh_command}"
> > +    end
> > +
> > +    vprint_status("Powershell command length: #{command.length}")
> > +    if command.length > 8191
>
> 8191 or 8192? In the unlikely event that the command is exactly 8192
> characters, this will incorrectly raise (or the error message is incorrect,
> depending on your POV)
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/rapid7/metasploit-framework/pull/2557/files#r15021129>
> .
>