rapid7/metasploit-framework — pull request #2767 by Meatballs1 (2013-12-16 12:55:29+00:00)
Title: Powershell Reflective Payload

This is update of https://github.com/rapid7/metasploit-framework/pull/2307

The Powershell Reflection Template uses slightly different techniques to inject the shellcode which prevents the creation of a temporary .cs file in the %TEMP% dir. Presumably Powershell is using the .NET compiler on the .NET payload.

Updates made:
The shellcode length was being passed in flAllocationType instead of dwSize (which was set to 0x1000). Which is now corrected.
We base64 encode the payload instead of encoding it as a Powershell byte array to save some filesize.
We use the RandomIdentifierGenerator to generate the variables in the template.
Added a WaitForSingleObject similar to the .NET template which prevents the process from exiting. Without this you have to run powershell -noexit or you would never get a shell if executed from the commandline.