diff options
Diffstat (limited to 'CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86')
3 files changed, 64 insertions, 0 deletions
diff --git a/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/CallDllMain.asm b/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/CallDllMain.asm new file mode 100644 index 0000000..41b1034 --- /dev/null +++ b/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/CallDllMain.asm @@ -0,0 +1,23 @@ +[SECTION .text] +global _start + +_start: + ; Get stack setup + push ebx + mov ebx, esp + and esp, 0xfffffff0 + + ; Call DllMain + mov ecx, 0x41414141 ; DLLHandle, set by PowerShell + mov edx, 0x1 ; PROCESS_ATTACH + mov eax, 0x0 ; NULL + push eax + push edx + push ecx + mov eax, 0x41414141 ; Address of DllMain, set by PS + call eax + + ; Fix stack + mov esp, ebx + pop ebx + ret diff --git a/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/ExitThread.asm b/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/ExitThread.asm new file mode 100644 index 0000000..ce66543 --- /dev/null +++ b/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/ExitThread.asm @@ -0,0 +1,13 @@ +[SECTION .text] +global _start + +_start: + ; Set a var to 1, let PS know the EXE is exiting + mov ebx, 0x41414141 + mov [ebx], byte 0x01 + + ; Call exitthread instead of exit process + sub esp, 0x20 + and esp, 0xFFFFFFc0 ; Needed for stack alignment + mov ebx, 0x41414141 + call ebx diff --git a/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/GetProcAddress.asm b/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/GetProcAddress.asm new file mode 100644 index 0000000..bf2ac9e --- /dev/null +++ b/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/GetProcAddress.asm @@ -0,0 +1,28 @@ +[SECTION .text] + +global _start + +_start: + ; Save state of ebx and stack + push ebx + mov ebx, esp + + ; Align stack + and esp, 0xffffffc0 + + ; Call GetProcAddress + mov eax, 0x41414141 ; DllHandle, supplied by PS + mov ecx, 0x41414141 ; Function name, supplied by PS + push ecx + push eax + mov eax, 0x41414141 ; GetProcAddress address, supplied by PS + call eax + + ; Write GetProcAddress return value to an address supplied by PS + mov ecx, 0x41414141 ; Address supplied by PS + mov [ecx], eax + + ; Fix stack + mov esp, ebx + pop ebx + ret |