Rapid7 Vulnerability & Exploit Database

Microsoft Windows Authenticated Powershell Command Execution

Back to Search

Microsoft Windows Authenticated Powershell Command Execution

Disclosed
01/01/1999
Created
05/30/2018

Description

This module uses a valid administrator username and password to execute a powershell payload using a similar technique to the "psexec" utility provided by SysInternals. The payload is encoded in base64 and executed from the commandline using the -encodedcommand flag. Using this method, the payload is never written to disk, and given that each payload is unique, is less prone to signature based detection. A persist option is provided to execute the payload in a while loop in order to maintain a form of persistence. In the event of a sandbox observing PSH execution, a delay and other obfuscation may be added to avoid detection. In order to avoid interactive process notifications for the current user, the psh payload has been reduced in size and wrapped in a powershell invocation which hides the window entirely.

Author(s)

  • Royce @R3dy__ Davis <rdavis@accuvant.com>
  • RageLtMan <rageltman@sempervictus>

Platform

Windows

Development

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/windows/smb/psexec_psh
msf exploit(psexec_psh) > show targets
    ...targets...
msf exploit(psexec_psh) > set TARGET < target-id >
msf exploit(psexec_psh) > show options
    ...show and set options...
msf exploit(psexec_psh) > exploit

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;