diff --git a/modules/inject_dll_reflective.py b/modules/inject_dll_reflective.py index 0752726..2d5fd41 100644 --- a/modules/inject_dll_reflective.py +++ b/modules/inject_dll_reflective.py @@ -15,12 +15,23 @@ class Inject_dll_reflective(Inject_shellcode): Author: @stephenfewer Links: https://github.com/stephenfewer/ReflectiveDLLInjection - - Inject a reflective DLL into a remote process + + Inject a reflective DLL into a remote process. + You can choose if create a new process or use a pid of an existing process as a host process. + The dll_path is a relative path to a dll that exists in the folder 'reflective_dll/'. + The dll must be compiled with the reflective loader exported function otherwise it cannot be executed + at runtime. + You can use one of the following supported injection technique: + - remove_virtual: classic injection: + VirtualAllocEx (RWX) -> WriteProcessMemory -> CreateRemoteThread + - remote_virtual_protect: with this technique you never allocate RWX memory (polymorphic encoders won't work): + VirtualAllocEx(RW) -> WriteProcessMemory -> VirtualProtect(RX) -> CreateRemoteThread + Note that when you try to inject into an existing process you should ensure you have the rights to open + a handle to that process otherwise the injection cannot be performed. Usage: - #inject_shellcode dll_path [injection_type] [remote_process] + #inject_dll_reflective dll_path [injection_type] [remote_process] Positional arguments: dll_path name of a .dll module in the 'reflective_dll/' directory @@ -33,6 +44,8 @@ class Inject_dll_reflective(Inject_shellcode): Default: 'cmd.exe' Examples: + Inject a messagebox reflective DLL into an existing process: + #inject_dll_reflective messagebox_reflective_x64.dll 'remote_virtual' '2264' """ diff --git a/modules/inject_shellcode.py b/modules/inject_shellcode.py index 8270f28..84ae37a 100644 --- a/modules/inject_shellcode.py +++ b/modules/inject_shellcode.py @@ -13,10 +13,12 @@ class Inject_shellcode(Module): You can decide if inject into an existing process or if spawn a new process as a host process for the code. You should create the payload for the shellcode from msfvenom with the flag --format csharp. You can use one of the following supported injection technique: - - remove_virtual: classic injection: - VirtualAllocEx (RWX) -> WriteProcessMemory -> CreateRemoteThread - - remote_protect: with this technique you never allocate RWX memory: - VirtualAllocEx(RW) -> WriteProcessMemory -> VirtualProtect(RX) -> CreateRemoteThread + - remove_virtual: classic injection: + VirtualAllocEx (RWX) -> WriteProcessMemory -> CreateRemoteThread + - remote_virtual_protect: with this technique you never allocate RWX memory (polymorphic encoders won't work): + VirtualAllocEx(RW) -> WriteProcessMemory -> VirtualProtect(RX) -> CreateRemoteThread + Note that when you try to inject into an existing process you should ensure you have the rights to open + a handle to that process otherwise the injection cannot be performed. Usage: #inject_shellcode shellcode_path [injection_type] [remote_process] @@ -32,7 +34,12 @@ class Inject_shellcode(Module): Default: 'cmd.exe' Examples: - + Inject generated shellcode: + #inject_shellcode /path/to/shellcode.cs + Inject shellcode with specific injection type: + #inject_shellcode /path/to/shellcode.cs 'remote_virtual_protect' + Inject shellcode into an existing process + #inject_shellcode /path/to/shellcode.cs 'remote_virtual' '1550' """ @@ -155,7 +162,7 @@ class Inject_shellcode(Module): } } else{ - output += "\n\n\tCode executed left in background as an async thread in the process " + processName + " with pid " + targetProcessPid; + output += "\n\n\tCode executed left in background as an async thread in the process '" + processName + ".exe' with pid " + targetProcessPid; } } catch (Exception ex) @@ -307,7 +314,7 @@ class Inject_shellcode(Module): } } else{ - output += "\n\n\tCode executed left in background as an async thread in the process " + processName + " with pid " + targetProcessPid; + output += "\n\n\tCode executed left in background as an async thread in the process '" + processName + ".exe' with pid " + targetProcessPid; } } catch (Exception ex) diff --git a/modules/reflective_dll/messagebox_reflective_x64.dll b/modules/reflective_dll/messagebox_reflective_x64.dll new file mode 100644 index 0000000..a464776 Binary files /dev/null and b/modules/reflective_dll/messagebox_reflective_x64.dll differ diff --git a/modules/reflective_dll/messagebox_reflective_x86.dll b/modules/reflective_dll/messagebox_reflective_x86.dll new file mode 100644 index 0000000..7ac6ef2 Binary files /dev/null and b/modules/reflective_dll/messagebox_reflective_x86.dll differ