search

rapid7 / rex-powershell

Rex library for dealing with Powershell Scripts
Other
53 stars 35 forks source link

Save some bytes by compressing the shellcode #20

Closed phra closed 2 years ago

sempervictus commented 3 years ago

Not sure if this helps or hurts - the real problem is the length of the PSH command. We want to keep it under the max length of a CMD command to avoid having to stage in ENV vars.

bwatters-r7 commented 2 years ago

Hrm..... this has been around a while and is still a draft. I'd be curious to know the use case here. Are we realistically going to see benefits for the (admittedly smallish) added complexity?

adfoster-r7 commented 2 years ago

If we're landing this, it'd be great to see the before/after size changes, as we've recently changed the sizes of payloads with our obfuscation improvements

sempervictus commented 2 years ago

If we use the "middle-wrapper" compression bits, this wont help as gzipping gzip does not yield anything. I think it may help in other cases where we're going raw-out, but then you're likely not that worried about sizing. However, if wired-up as an option, it does add some entropy into the mix. In terms of size calculation, its dynamic anyway since these things wrap actual payloads of runtime-sized shellcode

bwatters-r7 commented 2 years ago

Thanks for your contribution to Metasploit Framework! We've looked at this pull request, and we agree that it seems like a good addition to Metasploit, but it looks like it is not quite ready to land. We've labeled it attic and closed it for now.

What does this generally mean? It could be one or more of several things:

It doesn't look like there has been any activity on this pull request in a while We may not have the proper access or equipment to test this pull request, or the contributor doesn't have time to work on it right now. Sometimes the implementation isn't quite right and a different approach is necessary. We would love to land this pull request when it's ready. If you have a chance to address all comments, we would be happy to reopen and discuss how to merge this!