rapid7/metasploit-framework — pull request #2183 by sempervictus (2013-07-31 22:51:43+00:00)
Title: Powershell import post

This PR introduces the post modues from #2075. Since they rely on the /lib components in that PR, it is included in this one. We can remove the conflicting components or just commit this PR once we resolve what issues may come.

Notable features of the changes in post are a more in-depth abstraction to simple method calls for executing, cleaning up, and not killing other people's PIDs when running powershell from the "user" side of the framework (writing a post module/rc script). The cleanup process will now check a PID before attempting to kill it, removing the "access denied" errors we were seeing prior when killing a PID which committed suicide anyway.

The modules included are both util modules for executing PSH from a script or a simple command. Point them to a PS1 containing all the relvant pieces of a powersploit attack and they become more than management tools. The post modules and lib illustrate how to consume and prepare PSH code before pushing it to the target system. It is not a long shot from here to write specific modules consuming segments of PSH from different sources, combining, obfuscating, staging, and executig them... with full output.