admin/mattifestation-PIC_Bindshell
1
0
Fork 0
mirror of https://github.com/mattifestation/PIC_Bindshell synced 2026-06-08 15:47:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1 from caseysmithrc/master

Browse Source 
Minor modification for Visual Studio 2017
This commit is contained in:
Matt Graeber
2018-08-28 10:21:54 -07:00
committed by GitHub
parent 298e1615d7 ce605af8de
commit 7f03be49e8
4 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
PIC_Bindshell/Get-PEHeader.ps1
+4 -2
View File
@@ -564,7 +564,9 @@ PROCESS {
$UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods')
# Get a reference to the GetModuleHandle and GetProcAddress methods
$GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle')
$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress')
#Fix For Windows 10 1803. Probably should check version , but meh.
$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String]))
#$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress')
# Get a handle to the module specified
$Kern32Handle = $GetModuleHandle.Invoke($null, @($Module))
$tmpPtr = New-Object IntPtr
@@ -957,4 +959,4 @@ PROCESS {
}
}
}
PIC_Bindshell/Out-Shellcode.ps1
+4 -1
View File
@@ -26,7 +26,10 @@ $PE = Get-PEHeader $InputExe -GetSectionData
$TextSection = $PE.SectionHeaders | Where-Object { $_.Name -eq '.text' }
$MapContents = Get-Content $InputMapFile
$TextSectionInfo = @($MapContents | Where-Object { $_ -match '\.text\W+CODE' })[0]
#
#$TextSectionInfo = @($MapContents | Where-Object { $_ -match '\.text\W+CODE' })[0]
$TextSectionInfo = @($MapContents | Where-Object { $_ -match 'CODE' })[0]
# Possible fix for VS 2017, sufficient to match on just CODE in line.
$ShellcodeLength = [Int] "0x$(( $TextSectionInfo -split ' ' | Where-Object { $_ } )[1].TrimEnd('H'))" - 1
lib/PowerShell/Get-PEHeader.ps1
+4 -2
View File
@@ -564,7 +564,9 @@ PROCESS {
$UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods')
# Get a reference to the GetModuleHandle and GetProcAddress methods
$GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle')
$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress')
#Fix For Windows 10 1803. Probably should check version , but meh.
$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String]))
#$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress')
# Get a handle to the module specified
$Kern32Handle = $GetModuleHandle.Invoke($null, @($Module))
$tmpPtr = New-Object IntPtr
@@ -957,4 +959,4 @@ PROCESS {
}
}
}
lib/PowerShell/Out-Shellcode.ps1
+3 -1
View File
@@ -26,8 +26,10 @@ $PE = Get-PEHeader $InputExe -GetSectionData
$TextSection = $PE.SectionHeaders | Where-Object { $_.Name -eq '.text' }
$MapContents = Get-Content $InputMapFile
$TextSectionInfo = @($MapContents | Where-Object { $_ -match '\.text\W+CODE' })[0]
#$TextSectionInfo = @($MapContents | Where-Object { $_ -match '\.text\W+CODE' })[0]
$TextSectionInfo = @($MapContents | Where-Object { $_ -match 'CODE' })[0]
# Possible fix for VS 2017, sufficient to match on just CODE in line.
$ShellcodeLength = [Int] "0x$(( $TextSectionInfo -split ' ' | Where-Object { $_ } )[1].TrimEnd('H'))" - 1
Write-Host "Shellcode length: 0x$(($ShellcodeLength + 1).ToString('X4'))"