Module: Msf::Post::Windows

Defined in:
lib/msf/core/post/windows.rb,
lib/msf/core/post/windows/lsa.rb,
lib/msf/core/post/windows/kiwi.rb,
lib/msf/core/post/windows/ldap.rb,
lib/msf/core/post/windows/wmic.rb,
lib/msf/core/post/windows/mssql.rb,
lib/msf/core/post/windows/extapi.rb,
lib/msf/core/post/windows/system.rb,
lib/msf/core/post/windows/net_api.rb,
lib/msf/core/post/windows/packrat.rb,
lib/msf/core/post/windows/process.rb,
lib/msf/core/post/windows/accounts.rb,
lib/msf/core/post/windows/eventlog.rb,
lib/msf/core/post/windows/registry.rb,
lib/msf/core/post/windows/services.rb,
lib/msf/core/post/windows/cli_parse.rb,
lib/msf/core/post/windows/file_info.rb,
lib/msf/core/post/windows/powershell.rb,
lib/msf/core/post/windows/file_system.rb,
lib/msf/core/post/windows/shadow_copy.rb,
lib/msf/core/post/windows/user_profiles.rb,
lib/msf/core/post/windows/task_scheduler.rb

Defined Under Namespace

Modules: Accounts, CliParse, Dotnet, Error, Eventlog, ExtAPI, FileInfo, FileSystem, Kiwi, LDAP, Lsa, MSSQL, NetAPI, Packrat, Powershell, Priv, Process, ReflectiveDLLInjection, Registry, Runas, Services, ShadowCopy, System, TaskScheduler, UserProfiles, Version, WMIC, WindowsServices

Class Method Summary collapse

Class Method Details

.escape_cmd_literal(string, spaces:) ⇒ String

Escape a string literal value to be included as an argument to cmd.exe. The escaped value should not be placed within double quotes as this will alter now it is evaluated (e.g. echo "^"((^&test) Foo^"" is different than echo ^"((^&test) Foo^".

Parameters:

  • string (String) —

    The string to escape for use with cmd.exe.

  • spaces (Boolean) —

    Whether or not to escape spaces. If the string is being passed to echo, set this to false otherwise if it's an argument, set it to true.

Returns:

  • (String) —

    The escaped string.



12
13
14
15
16
17
 
# File 'lib/msf/core/post/windows.rb', line 12

def self.escape_cmd_literal(string, spaces:)
  string = string.dup
  %w[ ^ & < > | " ].each { |char| string.gsub!(char, "^#{char}") }
  string.gsub!(' ', '" "') if spaces
  string
end

.escape_powershell_literal(string) ⇒ String

Escape a string literal value to be included as an argument to powershell.exe. The escaped value should be placed within single quotes which is a Powershell verbatim string. See: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_quoting_rules?view=powershell-7.4#single-quoted-strings

This will help in cases where one might need to use & as in PowerShell this is a reserved character whereas in cmd.exe this is used to indicate the start of an additional command to execute.

Example (without this escaping): powershell -Command "cmd /c echo hello & echo world" <- This will result in errors as & is a reserved character. powershell -Command "cmd.exe /c 'echo hello & echo world'" <- This will succeed as & is interpreted as part of a string by PowerShell.

In our case we use PowerShell quoting as described at https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_quoting_rules?view=powershell-7.3 which states that to use a single quote inside of a single quoted string, use a second consecutive single quote. Therefore this is valid in PowerShell: 'don''t' Which in turn becomes the string "don't" (sans double quotes) inside PowerShell.

Parameters:

  • string (String) —

    The string to escape for use with powershell.exe.

Returns:

  • (String) —

    The escaped string.



38
39
40
41
42
 
# File 'lib/msf/core/post/windows.rb', line 38

def self.escape_powershell_literal(string)
  string = string.dup
  string.gsub!("'", "''")
  string
end