rapid7/metasploit-framework — pull request #705 by sempervictus (2012-08-19 20:16:33+00:00)
Title: Add WMI Execution of powershell payloads - AV bypass

Remote payload execution without disk access via WMI and powershell.
This module uses the current user's credentials (must be an admin
on the remote machine) to execute a WMI call to the remote host.
The WMI call starts powershell.exe and passes a psh-net payload
encoded in base64 as an argument. The payload can be wrapped in a
loop which runs so long as a handler can catch the payload. The
loop break on failure to connect is still under investigation.

This method of execution entirely bypasses AV as there's no binary
to check, no powershell script to read from disk, and nothing short
of a command argument to evaluate at all. The payload is obfuscated
every time it is generated and then base64 encoded so there's no
signature on the wire either.

Now, who wants to build COM/DCOM/WMI for ruby natively without win32ole bindings? This can replace PSExec entirely without much concern for AV detection.