mirror of
https://github.com/PowerShellMafia/PowerSploit
synced 2026-06-08 12:13:33 +00:00
Matt Graeber
dfec277813
Another awesome addition from Joe Bialek. Invoke-ReflectivePEInjection is a vast improvement over Invoke-ReflectiveDllInjection. It adds the following features: * Now supports loading exe files in memory * Supports reflective dll injection into a remote process * Additional sample Visual Studio solutions
29 lines
522 B
NASM
29 lines
522 B
NASM
[SECTION .text]
|
|
|
|
global _start
|
|
|
|
_start:
|
|
; Save state of ebx and stack
|
|
push ebx
|
|
mov ebx, esp
|
|
|
|
; Align stack
|
|
and esp, 0xffffffc0
|
|
|
|
; Call GetProcAddress
|
|
mov eax, 0x41414141 ; DllHandle, supplied by PS
|
|
mov ecx, 0x41414141 ; Function name, supplied by PS
|
|
push ecx
|
|
push eax
|
|
mov eax, 0x41414141 ; GetProcAddress address, supplied by PS
|
|
call eax
|
|
|
|
; Write GetProcAddress return value to an address supplied by PS
|
|
mov ecx, 0x41414141 ; Address supplied by PS
|
|
mov [ecx], eax
|
|
|
|
; Fix stack
|
|
mov esp, ebx
|
|
pop ebx
|
|
ret
|