rapid7/metasploit-framework — pull request #251 by sempervictus (2012-03-21 01:28:58+00:00)
Title: Powershell Encoders, Mixin, and Post module

This pull request adds two powershell encoders (.NET based as well as a normal VirtualAlloc method). One of these came from Redmine #6049, the other was adapted from other reading. The post module and mixin are based on Nicholas Nam's posh meterpreter script.

Post module will execute powershell from memory, so complex post exp tasks do not require an on disk script. Meterpreter payloads can be executed via the -encodedcommand method as well, psh requires the proper arch (32bit payloads need wow64 version of powershell, etc). psh-net does not, but requires .NET.

Planned additions: Powershell persistence via task scheduler (schtasks -encodedcommand ) is not picked up by any AV yet (have it working, will build a module). Powershell remote attack vectors via winrm should be possible, but so far it appears that execution is being interrupted. Further testing is required...