Class: Msf::Sessions::WinrmPowerShell

Inherits:
PowerShell show all
Defined in:
lib/msf/base/sessions/winrm_power_shell.rb

Overview

This class provides a PowerShell session for WinRM client connections, where Metasploit has authenticated to a remote WinRM instance and is using a PSRP runspace rather than a WinRS command shell.

Defined Under Namespace

Classes: WinRMPowerShellStreamAdapter

Instance Attribute Summary collapse

Attributes inherited from CommandShell

#arch, #banner, #max_threads, #platform

Attributes included from Msf::Session::Interactive

#rstream

Attributes included from Rex::Ui::Interactive

#completed, #interacting, #next_session, #on_command_proc, #on_print_proc, #on_run_command_error_proc, #orig_suspend, #orig_usr1, #orig_winch

Attributes included from Rex::Ui::Subscriber::Input

#user_input

Attributes included from Rex::Ui::Subscriber::Output

#user_output

Attributes included from Msf::Session

#alive, #db_record, #exploit, #exploit_datastore, #exploit_task, #exploit_uuid, #framework, #info, #machine_id, #payload_uuid, #routes, #sid, #sname, #target_host, #target_port, #username, #uuid, #via, #workspace

Attributes included from Framework::Offspring

#framework

Instance Method Summary collapse

Methods inherited from PowerShell

can_cleanup_files, #platform, #to_cmd, to_cmd, type

Methods included from PowerShell::Mixin

#shell_command

Methods inherited from CommandShell

#_file_transfer, _glue_cmdline_escape, #_interact, binary_exists, #binary_exists, #bootstrap, can_cleanup_files, #cleanup, #cmd_background, #cmd_background_help, #cmd_download, #cmd_download_help, #cmd_help, #cmd_help_help, #cmd_irb, #cmd_irb_help, #cmd_pry, #cmd_pry_help, #cmd_resource, #cmd_resource_help, #cmd_sessions, #cmd_sessions_help, #cmd_shell, #cmd_shell_help, #cmd_source, #cmd_source_help, #cmd_upload, #cmd_upload_help, #docs_dir, #escape_arg, #execute_file, #run_builtin_cmd, #run_single, #shell_close, #shell_command, #shell_init, #shell_read, #shell_write, type, #type

Methods included from Rex::Ui::Text::Resource

#load_resource

Methods included from Scriptable

#execute_file, #execute_script, included, #legacy_script_to_post_module

Methods included from Msf::Session::Provider::SingleCommandShell

#command_termination, #set_is_echo_shell, #shell_close, #shell_command_token, #shell_command_token_base, #shell_command_token_unix, #shell_command_token_win32, #shell_init, #shell_read, #shell_read_until_token, #shell_write, #to_cmd

Methods included from Msf::Session::Basic

#_interact, #type

Methods included from Msf::Session::Interactive

#_interact, #_interact_complete, #_interrupt, #_usr1, #abort_foreground, #cleanup, #comm_channel, #interactive?, #kill, #run_cmd, #tunnel_local, #tunnel_peer, #user_want_abort?

Methods included from Rex::Ui::Interactive

#_interact, #_interact_complete, #_interrupt, #_local_fd, #_remote_fd, #_stream_read_local_write_remote, #_stream_read_remote_write_local, #_winch, #detach, #handle_suspend, #handle_usr1, #handle_winch, #interact, #interact_stream, #prompt, #prompt_yesno, #restore_suspend, #restore_usr1, #restore_winch

Methods included from Rex::Ui::Subscriber

#copy_ui, #init_ui, #reset_ui

Methods included from Rex::Ui::Subscriber::Input

#gets

Methods included from Rex::Ui::Subscriber::Output

#flush, #print, #print_blank_line, #print_error, #print_good, #print_line, #print_status, #print_warning

Methods included from Msf::Session

#alive?, #cleanup, #comm_channel, #dead?, #inspect, #interactive?, #kill, #log_file_name, #log_source, #name, #name=, #register?, #session_host, #session_host=, #session_port, #session_port=, #session_type, #set_from_exploit, #set_via, #tunnel_local, #tunnel_peer, #tunnel_to_s, type, #type, #via_exploit, #via_payload

Constructor Details

#initialize(shell, opts = {}) ⇒ WinrmPowerShell

Create an MSF PowerShell session from a WinRM PowerShell shell object.

Parameters:

  • shell (WinRM::Shells::PowerShell) —

    A WinRM PowerShell shell object

  • opts (Hash) (defaults to: {}) —

    Optional parameters to pass to the session object.



177
178
179
180
181
 
# File 'lib/msf/base/sessions/winrm_power_shell.rb', line 177

def initialize(shell, opts = {})
  self.shell = shell
  self.adapter = WinRMPowerShellStreamAdapter.new(self.shell, method(:shell_ended))
  super(adapter, opts)
end

Instance Attribute Details

#adapter ⇒ Object (protected)

Returns the value of attribute adapter.



232
233
234
 
# File 'lib/msf/base/sessions/winrm_power_shell.rb', line 232

def adapter
  @adapter
end

#shell ⇒ Object (protected)

Returns the value of attribute shell.



232
233
234
 
# File 'lib/msf/base/sessions/winrm_power_shell.rb', line 232

def shell
  @shell
end

Instance Method Details

#_interact_stream ⇒ Object

:category: Msf::Session::Interactive implementors



202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
 
# File 'lib/msf/base/sessions/winrm_power_shell.rb', line 202

def _interact_stream
  fds = [user_input.fd]
  while interacting
    sd = Rex::ThreadSafe.select(fds, nil, fds, 0.5)
    begin
      user_output.print(shell_read(-1, 0))
      if sd
        run_single((user_input.gets || '').chomp("\n"))
      end
    rescue WinRM::WinRMWSManFault => e
      print_error(e.fault_description)
      shell_close
    end
    Thread.pass
  end
end

#_suspend ⇒ Object (protected) 



234
235
236
237
238
239
 
# File 'lib/msf/base/sessions/winrm_power_shell.rb', line 234

def _suspend
  # PSRP does not provide a way to send Ctrl+Z to a foreground process. If
  # the SUB byte is submitted as a new pipeline, WinRM can return a fault
  # that contains invalid XML and closes the session.
  self.interacting = false if prompt_yesno("Background session #{name}?")
end

#abort_foreground_supported ⇒ Object 



183
184
185
186
187
188
189
 
# File 'lib/msf/base/sessions/winrm_power_shell.rb', line 183

def abort_foreground_supported
  # The default abort_foreground writes a Ctrl+C byte to the stream, which
  # would be submitted as a new PSRP pipeline rather than signaling the
  # active one. Supporting this requires tracking and signaling the active
  # pipeline command ID, which WinRM::Shells::Powershell#run does not expose.
  false
end

#commands ⇒ Object 



161
162
163
164
165
166
167
168
169
170
 
# File 'lib/msf/base/sessions/winrm_power_shell.rb', line 161

def commands
  {
    'help' => 'Help menu',
    'background' => 'Backgrounds the current shell session',
    'sessions' => 'Quickly switch to another session',
    'resource' => 'Run a meta commands script stored in a local file',
    'irb' => 'Open an interactive Ruby shell on the current session',
    'pry' => 'Open the Pry debugger on the current session'
  }
end

#desc ⇒ Object 



191
192
193
 
# File 'lib/msf/base/sessions/winrm_power_shell.rb', line 191

def desc
  'WinRM PowerShell'
end

#on_registered ⇒ Object 



219
220
221
 
# File 'lib/msf/base/sessions/winrm_power_shell.rb', line 219

def on_registered
  adapter.framework = framework
end

#process_autoruns(datastore) ⇒ Object 



195
196
197
 
# File 'lib/msf/base/sessions/winrm_power_shell.rb', line 195

def process_autoruns(datastore)
  Msf::Sessions::CommandShell.instance_method(:process_autoruns).bind(self).call(datastore)
end

#shell_ended(reason = '') ⇒ Object

Callback used by the background thread to let us know the shell is done.



224
225
226
227
228
 
# File 'lib/msf/base/sessions/winrm_power_shell.rb', line 224

def shell_ended(reason = '')
  self.interacting = false
  framework.events.on_session_interact_completed
  framework.sessions.deregister(self, reason)
end