NetExec
NetExec copied to clipboard
Refactor/fix/update PowerShell and related features
- fix(powershell): fix running via ps32, both with and without obfuscation
- pwsh: remove commented code and remove easily detected amsi bypass
- pwsh: tests: add and update tests related to powershell
- pwsh: large amount of debugging added to powershell
- pwsh: powershell helper refactored to fix obfuscation, running in 32 bit mode, encoding, etc
- pwsh: turn off obfuscation by default for powershell, since defender picks it up easily
- pwsh: turn off amsi-bypass by default, since it was an incredibly old signatured bypass (users can still pass in their own)
- pwsh: more error checking for powershell
- pwsh: better handling of quotes for powershell queries, since we have almost 4 layers of quoting (python, mssql, cmd, powershell)
- wmi: check if virus detected in wmiexec
- mssql: update mssql powershell to match smb
- mssql: more error checking for mssql queries
- fix(met_inject): simplify metasploit cradle, add logging, and update documentation
- feat(tests): allow for specifying certain line numbers, allow for printing all failed commands, and properly use single quotes for linux
- tests: add what was our default amsi bypass for testing
- tests: add and update tests related to powershell
There's still more work to be done for the iex cradle & injection functions, but this gets us to a good point where we aren't being blown up by defender by default for simple powershell queries, etc.