Refactor/fix/update PowerShell and related features

[Marshall-Hallenbeck]

• fix(powershell): fix running via ps32, both with and without obfuscation
• pwsh: remove commented code and remove easily detected amsi bypass
• pwsh: tests: add and update tests related to powershell
• pwsh: large amount of debugging added to powershell
• pwsh: powershell helper refactored to fix obfuscation, running in 32 bit mode, encoding, etc
• pwsh: turn off obfuscation by default for powershell, since defender picks it up easily
• pwsh: turn off amsi-bypass by default, since it was an incredibly old signatured bypass (users can still pass in their own)
• pwsh: more error checking for powershell
• pwsh: better handling of quotes for powershell queries, since we have almost 4 layers of quoting (python, mssql, cmd, powershell)
• wmi: check if virus detected in wmiexec
• mssql: update mssql powershell to match smb
• mssql: more error checking for mssql queries
• fix(met_inject): simplify metasploit cradle, add logging, and update documentation
• feat(tests): allow for specifying certain line numbers, allow for printing all failed commands, and properly use single quotes for linux
• tests: add what was our default amsi bypass for testing
• tests: add and update tests related to powershell

There's still more work to be done for the iex cradle & injection functions, but this gets us to a good point where we aren't being blown up by defender by default for simple powershell queries, etc.

[NeffIsBack]

Great work, i will test it as soon as the changes are made and i have the time.

What about winrm powershell? Does that need to be adjusted now as well?

[NeffIsBack]

@Marshall-Hallenbeck i think we should also update the winrm powershell logic to match the logic of smb/mssql, thoughts?

[Marshall-Hallenbeck]

@Marshall-Hallenbeck i think we should also update the winrm powershell logic to match the logic of smb/mssql, thoughts?

hmm didn't realize it used a different method of execution... I'll have to look into that.

[Marshall-Hallenbeck]

@NeffIsBack ohh it uses RSRP over WinRM, that's why. I think it should be fine to leave alone since it's a different protocol. I can look into updating the obfuscation/etc later, but that's not a huge priority right now.

[mpgn]

@NeffIsBack ohh it uses RSRP over WinRM, that's why. I think it should be fine to leave alone since it's a different protocol. I can look into updating the obfuscation/etc later, but that's not a huge priority right now.

💯

[NeffIsBack]

Ok sounds good👍🏼will test the next days and than this can be merged

[NeffIsBack]

Besides the cosmetic issue everything is working as expected! Finally powershell is working again 🚀
Fyi, tests ran perfectly fine

[NeffIsBack]

Tested other exec methods because of crashes in #317, so far it looks like this PR fixes the issue(s). I will add the exec methods to the tests though.

[Marshall-Hallenbeck]

@NeffIsBack fixed the output, this should be good to go

[NeffIsBack]

@Marshall-Hallenbeck 😬

[Marshall-Hallenbeck]

@NeffIsBack ah okay I misunderstood. I've changed it back and they're both the same now

[NeffIsBack]

Awesome! Works as intended

[NeffIsBack]

LGTM