jborean93

PSRemoting over SSH

Here is the general workflow over a PSRemoting session over SSH, for example spawned with Invoke-Command -HostName foo { 'test' }:

sequenceDiagram
    box Client Machine
    actor C as Pwsh Client
    participant S1 as ssh client
    end

jborean93

using System;
using System.Management.Automation.Remoting;
using System.Reflection;
using System.Threading;
using System.Threading.Tasks;

#nullable enable

/*
This code uses internal APIs of the PowerShell remoting system to create the

jborean93

#Requires -RunAsAdministrator
#Requires -Version 7.4

using namespace System.IO
using namespace System.Formats.Asn1
using namespace System.Globalization
using namespace System.Security.Cryptography
using namespace System.Security.Cryptography.Pkcs
using namespace System.Security.Cryptography.X509Certificates
using namespace System.Text

jborean93

<#
This must be run in Windows PowerShell (5.1). This will not work in PowerShell 7.x
as Add-Type cannot generate an output executable.
#>

Add-Type -OutputType ConsoleApplication -OutputAssembly kill.exe -TypeDefinition @'
using System;
using System.ComponentModel;
using System.Runtime.InteropServices;

jborean93

# Server 2025 fails to run Get-AppxPackage and other DISM module commands in
# a PSRemoting (psrp) session as it has a dependency on some dll's not present
# in the GAC and only in the powershell.exe directory. As PSRP runs through
# wsmprovhost.exe, it fails to find those dlls. This hack will manually load
# the 4 required dlls into the GAC. This is a hack and should be removed in the
# future if MS fix their bug on 2025.

Add-Type -AssemblyName "System.EnterpriseServices"
$publish = [System.EnterpriseServices.Internal.Publish]::new()

jborean93

Function Get-ValidatedScriptBlock {
    [OutputType([ScriptBlock])]
    param (
        [Parameter(Mandatory)]
        [string]
        $Name,

        [Parameter(Mandatory)]
        [string]
        $ScriptAsBase64

jborean93

# Copyright: (c) 2024, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

Function New-ScheduledTaskSession {
    <#
    .SYNOPSIS
    Creates a PSSession for a process running as a scheduled task.

    .DESCRIPTION
    Creates a PSSession that can be used to run code inside a scheduled task

jborean93

# Copyright: (c) 2024, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)

Function Invoke-AsScheduledJob {
    <#
    .SYNOPSIS
    Runs a scriptblock as a scheduled job.

    .DESCRIPTION
    This is a helper function to run PowerShell code as a scheduled task.

jborean93

#!/usr/bin/env python3
# Copyright: (c) 2024, Jordan Borean (@jborean93) <[email protected]>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)
# PYTHON_ARGCOMPLETE_OK

# Big thanks to pysmb for help with the RPC structures
# https://github.com/miketeo/pysmb

from __future__ import annotations

jborean93

#!/usr/bin/env python3

# /// script
# dependencies = [
#   "bcrypt",
#   "cryptography >= 43.0.0",
#   "pyyaml",
# ]
# ///