rapid7/metasploit-framework — pull request #2001 by jtesta (2013-06-21 18:41:43+00:00)
Title: PSExec Classic Module

This module mimics the authentic PsExec program from Microsoft Sysinternals. It extracts the PSEXESVC.EXE code from the authentic PsExec.exe program, sends it to the target, then interacts with it just as PsExec does. The main reasons this module is useful are:

1.) modules/exploits/windows/smb/psexec tends to get caught by AV. This has a better chance of working because PSEXESVC.EXE has a Microsoft signature; blocking it would block Microsoft's PsExec too.

2.) Unlike the authentic PsExec, this lets us take advantage of pass-the-hash, along with running on platforms other than Windows.

3.) Its very convenient for executing interactive processes (like cmd.exe).

At this time, this module does not adhere to the Metasploit's HACKING guide because it reads user commands from $stdin. I tried asking in the IRC channel for pointers on how to fix this, but no one had any suggestions. I'd be happy to revise this module and re-submit once I have sample code to work with!