NetExec icon indicating copy to clipboard operation
NetExec copied to clipboard

Refactor/fix/update PowerShell and related features

Open Marshall-Hallenbeck opened this issue 9 months ago • 0 comments

  • fix(powershell): fix running via ps32, both with and without obfuscation
  • pwsh: remove commented code and remove easily detected amsi bypass
  • pwsh: tests: add and update tests related to powershell
  • pwsh: large amount of debugging added to powershell
  • pwsh: powershell helper refactored to fix obfuscation, running in 32 bit mode, encoding, etc
  • pwsh: turn off obfuscation by default for powershell, since defender picks it up easily
  • pwsh: turn off amsi-bypass by default, since it was an incredibly old signatured bypass (users can still pass in their own)
  • pwsh: more error checking for powershell
  • pwsh: better handling of quotes for powershell queries, since we have almost 4 layers of quoting (python, mssql, cmd, powershell)
  • wmi: check if virus detected in wmiexec
  • mssql: update mssql powershell to match smb
  • mssql: more error checking for mssql queries
  • fix(met_inject): simplify metasploit cradle, add logging, and update documentation
  • feat(tests): allow for specifying certain line numbers, allow for printing all failed commands, and properly use single quotes for linux
  • tests: add what was our default amsi bypass for testing
  • tests: add and update tests related to powershell

There's still more work to be done for the iex cradle & injection functions, but this gets us to a good point where we aren't being blown up by defender by default for simple powershell queries, etc.

Marshall-Hallenbeck avatar May 10 '24 15:05 Marshall-Hallenbeck