lib/rex/powershell/output.rb
#
# Return a zlib compressed powershell code wrapped in decode stub
#
# @param eof [String] End of file identifier to append to code
#
# @return [String] Zlib compressed powershell code wrapped in
# decompression stub
Return a zlib compressed powershell code wrapped in decode stub
Return a zlib compressed powershell code wrapped in decode stub
def deflate_code(eof = nil)
      compressed_stream = ::Zlib::Deflate.deflate(code,
                                                  ::Zlib::BEST_COMPRESSION)
      encoded_stream = Rex::Text.encode_base64(compressed_stream)
      psh_expression =  "$s=New-Object IO.MemoryStream(,"
      psh_expression << "[Convert]::FromBase64String('#{encoded_stream}'));"
      psh_expression << '$s.ReadByte();'
      psh_expression << '$s.ReadByte();'
      psh_expression << 'IEX (New-Object IO.StreamReader('
      psh_expression << 'New-Object IO.Compression.DeflateStream('
      psh_expression << '$s,'
      psh_expression << '[IO.Compression.CompressionMode]::Decompress)'
      psh_expression << ')).ReadToEnd();'
      psh_expression << "echo '#{eof}';" if eof
      @code = psh_expression
    end
def deflate_code ( eof = nil ) compressed_stream = :: Zlib :: Deflate . deflate ( code , :: Zlib :: BEST_COMPRESSION ) encoded_stream = Rex :: Text . encode_base64 ( compressed_stream ) psh_expression = "$s=New-Object IO.MemoryStream(," psh_expression << "[Convert]::FromBase64String('#{encoded_stream}'));" psh_expression << '$s.ReadByte();' psh_expression << '$s.ReadByte();' psh_expression << 'IEX (New-Object IO.StreamReader(' psh_expression << 'New-Object IO.Compression.DeflateStream(' psh_expression << '$s,' psh_expression << '[IO.Compression.CompressionMode]::Decompress)' psh_expression << ')).ReadToEnd();' psh_expression << "echo '#{eof}';" if eof @code = psh_expression end
Return a zlib compressed powershell code wrapped in decode stub
Return a zlib compressed powershell code wrapped in decode stub
# Compress using the Deflate algorithm # Base64 encode the compressed file contents # Build the powershell expression # Decode base64 encoded command and create a stream object # Read & delete the first two bytes due to incompatibility with MS # Uncompress and invoke the expression (execute) # If eof is set, add a marker to signify end of code output # if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end
Zlib compressed powershell code wrapped in decompression stub
Zlib compressed powershell code wrapped in decompression stub
String
eof
End of file identifier to append to code
End of file identifier to append to code