diff --git a/PIC_Bindshell/Get-PEHeader.ps1 b/PIC_Bindshell/Get-PEHeader.ps1 index 2f35292..c9c1b2a 100644 --- a/PIC_Bindshell/Get-PEHeader.ps1 +++ b/PIC_Bindshell/Get-PEHeader.ps1 @@ -564,7 +564,9 @@ PROCESS { $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods') # Get a reference to the GetModuleHandle and GetProcAddress methods $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle') - $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress') + #Fix For Windows 10 1803. Probably should check version , but meh. + $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])) + #$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress') # Get a handle to the module specified $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module)) $tmpPtr = New-Object IntPtr @@ -957,4 +959,4 @@ PROCESS { } -} \ No newline at end of file +} diff --git a/PIC_Bindshell/Out-Shellcode.ps1 b/PIC_Bindshell/Out-Shellcode.ps1 index 10b5369..c20efb8 100644 --- a/PIC_Bindshell/Out-Shellcode.ps1 +++ b/PIC_Bindshell/Out-Shellcode.ps1 @@ -26,7 +26,10 @@ $PE = Get-PEHeader $InputExe -GetSectionData $TextSection = $PE.SectionHeaders | Where-Object { $_.Name -eq '.text' } $MapContents = Get-Content $InputMapFile -$TextSectionInfo = @($MapContents | Where-Object { $_ -match '\.text\W+CODE' })[0] +# +#$TextSectionInfo = @($MapContents | Where-Object { $_ -match '\.text\W+CODE' })[0] +$TextSectionInfo = @($MapContents | Where-Object { $_ -match 'CODE' })[0] +# Possible fix for VS 2017, sufficient to match on just CODE in line. $ShellcodeLength = [Int] "0x$(( $TextSectionInfo -split ' ' | Where-Object { $_ } )[1].TrimEnd('H'))" - 1 diff --git a/lib/PowerShell/Get-PEHeader.ps1 b/lib/PowerShell/Get-PEHeader.ps1 index 2f35292..c9c1b2a 100644 --- a/lib/PowerShell/Get-PEHeader.ps1 +++ b/lib/PowerShell/Get-PEHeader.ps1 @@ -564,7 +564,9 @@ PROCESS { $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods') # Get a reference to the GetModuleHandle and GetProcAddress methods $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle') - $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress') + #Fix For Windows 10 1803. Probably should check version , but meh. + $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])) + #$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress') # Get a handle to the module specified $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module)) $tmpPtr = New-Object IntPtr @@ -957,4 +959,4 @@ PROCESS { } -} \ No newline at end of file +} diff --git a/lib/PowerShell/Out-Shellcode.ps1 b/lib/PowerShell/Out-Shellcode.ps1 index 10b5369..0ffbd73 100644 --- a/lib/PowerShell/Out-Shellcode.ps1 +++ b/lib/PowerShell/Out-Shellcode.ps1 @@ -26,8 +26,10 @@ $PE = Get-PEHeader $InputExe -GetSectionData $TextSection = $PE.SectionHeaders | Where-Object { $_.Name -eq '.text' } $MapContents = Get-Content $InputMapFile -$TextSectionInfo = @($MapContents | Where-Object { $_ -match '\.text\W+CODE' })[0] +#$TextSectionInfo = @($MapContents | Where-Object { $_ -match '\.text\W+CODE' })[0] +$TextSectionInfo = @($MapContents | Where-Object { $_ -match 'CODE' })[0] +# Possible fix for VS 2017, sufficient to match on just CODE in line. $ShellcodeLength = [Int] "0x$(( $TextSectionInfo -split ' ' | Where-Object { $_ } )[1].TrimEnd('H'))" - 1 Write-Host "Shellcode length: 0x$(($ShellcodeLength + 1).ToString('X4'))"