mr-un1k0d3r / powerlessshell Goto Github PK

Awesome stuff. I love the Cobaltstrike integration. I ran into a problem however when laterally moving to a host I have local admin on. The randomly generated project file does get uploaded, but the MSBuild.exe command execution doesn't seem to occur. The wmi cmd.exe call doesn't appear to execute.

-I used the following syntax:
beacon> wmi_build target ListenerName

Things I validated:
-wmi_msbuild.cna is in cobalstrike directory
-PowerLessShell git clone is in subdirectory of cobaltstrike directory
-When I execute the "MSBUILD.exe XxXxx.TMP" manually on the target the it runs like a champ. Just not with the cobaltstrike beacon alias integration with the .cna provided.

Please advise
-bSpence7337

MSBuild.exe在执行pyload时会在c:\windows\temp目录缓存文件。
当这个目录没有访问权限的时候，就会出现如下错误。我们如何才能自己指定一个目录来缓存临时文件？

我做了如下尝试，在代码里添加

C:\ProgramData
C:\ProgramData
C:\ProgramData;$(MSBuildAssemblySearchPaths)

来自定义临时目录位置，可是失败了。

请求帮助。

As stated above, users may not always have write permissions to C:\Windows\Microsoft.NET\Framework\v4.0.30319, so I am requesting a feature to specify either User %APPDATA% or a user provided path to drop the temp files the *.cmd / *.bat create.

If I have some time, I could create a PR with this feature.

payload can't run the second time already exists !