diff --git a/Gemfile.lock b/Gemfile.lock index 9b0075c2fb4d9..c3807d929f7a7 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -104,7 +104,7 @@ PATH rex-mime rex-nop rex-ole - rex-powershell + rex-powershell (>= 0.1.105) rex-random_identifier rex-registry rex-rop_builder @@ -538,7 +538,7 @@ GEM rex-arch rex-ole (0.1.9) rex-text - rex-powershell (0.1.103) + rex-powershell (0.1.105) bigdecimal rex-random_identifier rex-text diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 7f5e5d60fe48d..9fa200ff053f7 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -171,7 +171,7 @@ Gem::Specification.new do |spec| # Library for Generating Randomized strings valid as Identifiers such as variable names spec.add_runtime_dependency 'rex-random_identifier' # library for creating Powershell scripts for exploitation purposes - spec.add_runtime_dependency 'rex-powershell' + spec.add_runtime_dependency 'rex-powershell', '>= 0.1.105' # Library for processing and creating Zip compatbile archives spec.add_runtime_dependency 'rex-zip' # Library for parsing offline Windows Registry files diff --git a/modules/exploits/windows/smb/psexec.rb b/modules/exploits/windows/smb/psexec.rb index 329797828f0dd..4206c165d4894 100644 --- a/modules/exploits/windows/smb/psexec.rb +++ b/modules/exploits/windows/smb/psexec.rb @@ -66,11 +66,8 @@ def initialize(info = {}) }, 'Platform' => 'win', 'Targets' => [ - # PowerShell isn't offered for AArch64: the PowerShell shellcode-injection - # wrapper (rex-powershell) only knows how to spawn x86/x64 powershell.exe, - # so it can't be used to run AArch64 shellcode. [ 'Automatic', { 'Arch' => [ARCH_X86, ARCH_X64, ARCH_AARCH64] } ], - [ 'PowerShell', { 'Arch' => [ARCH_X86, ARCH_X64] } ], + [ 'PowerShell', { 'Arch' => [ARCH_X86, ARCH_X64, ARCH_AARCH64] } ], [ 'Native upload', { # upload a service executable 'Arch' => [ARCH_X86, ARCH_X64, ARCH_AARCH64], # service executables place the payload within a segment, 1GiB is a practical max in many cases. @@ -159,12 +156,7 @@ def exploit case target.name when 'Automatic' - # The PowerShell delivery path can only launch x86/x64 powershell.exe, so - # an AArch64 payload has to go straight to the native upload technique. - if payload_instance.arch.include?(ARCH_AARCH64) - print_status('Selecting native target') - native_upload_with_workaround(smbshare) - elsif powershell_installed?(smbshare, datastore['PSH_PATH']) + if powershell_installed?(smbshare, datastore['PSH_PATH']) print_status('Selecting PowerShell target') execute_powershell_payload else