rapid7/metasploit-framework — pull request #1379 by sempervictus (2013-01-24 20:41:20+00:00)
Title: Powershell bulk import - modules, libs, and suggestions for further targets

This pull request incorporates prior work submitted in
various PRs including 701 and 705. Since several PRs
never made it into trunk, SVIT's in-house framework
has diverged in a few places and modules making use
of those changes suffer in trunk.

Given the interest shown by viewers of the
thelightcosine's webcast in powershell techniques, i
believe it appropriate to re-submit the changes and sync
the core libs used in house with R7 master, as well
as providing some of the modules derived from the
changes in lib.

I believe we still have some localization issues and other
kinks to work out with the modules and PSH code
therein, so testing and commentary are very welcome.

Powershell commentary and TODO:

Its been over a year since we started adding Powershell to
framework and at this point the argument of "its not widely
used" no longer carries as much weight. Ideally some of
the work stubbed out in Post would move in Rex itself in
the same manner we handle other languages we modify.

Syntax parsing will lead to better obfuscation as the current
approach is going to be pretty easy to unwrap once they
get their heads around it. A PSH native shell set would
also be a good idea, although work i've seen so far is not
there yet (its been a while, i shall re-check). Native use of
SSL sockets to pull stage2 would be preferable to
the standard rev_tcp stage1, and with cert validation can
provide a much more secure transfer method.
Darkoperator and others have written PSH cryptors,
which coupled with the currently used obfuscation
techniques provide a higher level of evasion...

Technically speaking, the post execution method only requires
meterpeter to read the channel, so PSH is a good way to
get a meterpreter session out of command line execution
(see PR 1343). I welcome discussion and suggestions for
updating the post libs to handle command sessions as well.