module
Microsoft Windows Authenticated Powershell Command Execution
| Disclosed | Created |
|---|---|
| 01/01/1999 | 05/30/2018 |
Disclosed
01/01/1999
Created
05/30/2018
Description
This module uses a valid administrator username and password to execute a powershell
payload using a similar technique to the "psexec" utility provided by SysInternals. The
payload is encoded in base64 and executed from the commandline using the -encodedcommand
flag. Using this method, the payload is never written to disk, and given that each payload
is unique, is less prone to signature based detection. A persist option is provided to
execute the payload in a while loop in order to maintain a form of persistence. In the
event of a sandbox observing PSH execution, a delay and other obfuscation may be added to
avoid detection. In order to avoid interactive process notifications for the current user,
the psh payload has been reduced in size and wrapped in a powershell invocation which hides
the window entirely.
payload using a similar technique to the "psexec" utility provided by SysInternals. The
payload is encoded in base64 and executed from the commandline using the -encodedcommand
flag. Using this method, the payload is never written to disk, and given that each payload
is unique, is less prone to signature based detection. A persist option is provided to
execute the payload in a while loop in order to maintain a form of persistence. In the
event of a sandbox observing PSH execution, a delay and other obfuscation may be added to
avoid detection. In order to avoid interactive process notifications for the current user,
the psh payload has been reduced in size and wrapped in a powershell invocation which hides
the window entirely.
Authors
Royce @R3dy__ Davis RageLtMan
Platform
Windows
References
Module Options
To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:
msf > use exploit/windows/smb/psexec_psh
msf /(h) > show actions
...actions...
msf /(h) > set ACTION < action-name >
msf /(h) > show options
...show and set options...
msf /(h) > run
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.