rapid7/metasploit-framework — pull request #2966 by Meatballs1 (2014-02-09 19:43:30+00:00)
Title: Powershell Remoting - Invoke-Command

Similar to current_user_psexec and wmi this exploit grabs shells on remote hosts via an existing session.

Powershell remoting runs on 47001 and isn't enabled by default.

You can enable it on a target host with ```Enable-PSRemoting -force``` in powershell.

It works best with a hostfile so it doesn't have to resolve IP addresses. You can get an awesome list of hostnames from enum_ad_computers ;)

If you want to use different credentials these can be specified - the module will generate a PSCredential variable for you from the supplied details.

Unlike WMI and Current User Psexec we are not executing a command for each host - we give a list of hosts for powershell remoting to handle - so instead of waiting for an arbitrary amount of time I have set it up like multi/handler ExitOnSession false. I have added a default timeout of 60seconds but this may need reviewing after some mass exploitation testing ;)