search

0x00-0x00 / ShellPop

Pop shells like a master.
MIT License
1.44k stars 235 forks source link

Arguments --powershell-x64 and --powershell-x86 seem to be mixed up #37

Closed WOB1N closed 5 years ago

WOB1N commented 5 years ago

The arguments --powershell-x64 and --powershell-x86 arguments seem to prefix the wrong path to the payload. In fact, I believe they are reversed.

root@home:~# shellpop -H eth0 -P 1234 --powershell-x64 --reverse --number 9 [+] Execute this code in remote target: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe [...]

root@home:~# shellpop -H eth0 -P 1234 --powershell-x86 --reverse --number 9 [+] Execute this code in remote target: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe [...]

0x00-0x00 commented 5 years ago

No, they are not.

SysWow64 is used to spawn x86 processes from an 64 arch system.

System32 is the default folder for 64-bit binaries for x64 arch system.

If your system is 32-bit only, then using a default payload will work.

Please test your assumptions before raising issues in this repo.