diff --git a/lib/msf/base/sessions/powershell.rb b/lib/msf/base/sessions/powershell.rb index 13c35a80b86ed..fb04e1231164b 100644 --- a/lib/msf/base/sessions/powershell.rb +++ b/lib/msf/base/sessions/powershell.rb @@ -56,7 +56,7 @@ def self.to_cmd(executable, args) # - Side-step any PowerShell magic # If someone specifically wants to use the PowerShell magic, they can use other APIs - needs_wrapping_chars = ['$', '`', '(', ')', '@', '>', '<', '{','}', '&', ',', ' '] + needs_wrapping_chars = ['$', '`', '(', ')', '@', '>', '<', '{','}', '&', ',', ' ', ';'] result = "" cmd_and_args = [executable] + args diff --git a/lib/msf/core/post/file.rb b/lib/msf/core/post/file.rb index 4ae5abdf4645e..503ffa697ea22 100644 --- a/lib/msf/core/post/file.rb +++ b/lib/msf/core/post/file.rb @@ -740,6 +740,7 @@ def _write_file_powershell_fragment(file_name, data, offset, chunk_size, append else file_mode = 'Create' end + file_name = file_name.gsub("'","''") pwsh_code = <<~PSH try { $encoded='#{encoded_chunk}'; diff --git a/test/modules/post/test/cmd_exec.rb b/test/modules/post/test/cmd_exec.rb index 63c26a3af8296..ce583a4409944 100644 --- a/test/modules/post/test/cmd_exec.rb +++ b/test/modules/post/test/cmd_exec.rb @@ -202,7 +202,6 @@ def test_cmd_exec_stderr true else output = cmd_exec("cmd.exe", "/c echo #{test_string} 1>&2") - print_status("line is #{output}") output.rstrip == test_string end else