From dfec277813bfbc956dcac45345a9158093d68343 Mon Sep 17 00:00:00 2001 From: Matt Graeber Date: Fri, 31 May 2013 19:35:26 -0400 Subject: Added Invoke-ReflectivePEInjection Another awesome addition from Joe Bialek. Invoke-ReflectivePEInjection is a vast improvement over Invoke-ReflectiveDllInjection. It adds the following features: * Now supports loading exe files in memory * Supports reflective dll injection into a remote process * Additional sample Visual Studio solutions --- CodeExecution/DemoReflectiveDLL/DemoDLL.sln | 26 ---- CodeExecution/DemoReflectiveDLL/DemoDLL.v11.suo | Bin 11264 -> 0 bytes .../DemoReflectiveDLL/DemoDLL/DemoDLL.cpp | 60 -------- CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.h | 17 --- .../DemoReflectiveDLL/DemoDLL/DemoDLL.vcxproj | 167 --------------------- .../DemoDLL/DemoDLL.vcxproj.filters | 42 ------ .../DemoReflectiveDLL/DemoDLL/DemoDLL.vcxproj.user | 3 - CodeExecution/DemoReflectiveDLL/DemoDLL/ReadMe.txt | 40 ----- .../DemoReflectiveDLL/DemoDLL/dllmain.cpp | 19 --- CodeExecution/DemoReflectiveDLL/DemoDLL/stdafx.cpp | 8 - CodeExecution/DemoReflectiveDLL/DemoDLL/stdafx.h | 20 --- .../DemoReflectiveDLL/DemoDLL/targetver.h | 8 - 12 files changed, 410 deletions(-) delete mode 100644 CodeExecution/DemoReflectiveDLL/DemoDLL.sln delete mode 100644 CodeExecution/DemoReflectiveDLL/DemoDLL.v11.suo delete mode 100644 CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.cpp delete mode 100644 CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.h delete mode 100644 CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.vcxproj delete mode 100644 CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.vcxproj.filters delete mode 100644 CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.vcxproj.user delete mode 100644 CodeExecution/DemoReflectiveDLL/DemoDLL/ReadMe.txt delete mode 100644 CodeExecution/DemoReflectiveDLL/DemoDLL/dllmain.cpp delete mode 100644 CodeExecution/DemoReflectiveDLL/DemoDLL/stdafx.cpp delete mode 100644 CodeExecution/DemoReflectiveDLL/DemoDLL/stdafx.h delete mode 100644 CodeExecution/DemoReflectiveDLL/DemoDLL/targetver.h (limited to 'CodeExecution/DemoReflectiveDLL') diff --git a/CodeExecution/DemoReflectiveDLL/DemoDLL.sln b/CodeExecution/DemoReflectiveDLL/DemoDLL.sln deleted file mode 100644 index 55267b4..0000000 --- a/CodeExecution/DemoReflectiveDLL/DemoDLL.sln +++ /dev/null @@ -1,26 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 11.00 -# Visual Studio 2010 -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "DemoDLL", "DemoDLL\DemoDLL.vcxproj", "{F4F1D8EF-4069-40F3-9AAB-F75BAD26CBBA}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Win32 = Debug|Win32 - Debug|x64 = Debug|x64 - Release|Win32 = Release|Win32 - Release|x64 = Release|x64 - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {F4F1D8EF-4069-40F3-9AAB-F75BAD26CBBA}.Debug|Win32.ActiveCfg = Debug|Win32 - {F4F1D8EF-4069-40F3-9AAB-F75BAD26CBBA}.Debug|Win32.Build.0 = Debug|Win32 - {F4F1D8EF-4069-40F3-9AAB-F75BAD26CBBA}.Debug|x64.ActiveCfg = Debug|x64 - {F4F1D8EF-4069-40F3-9AAB-F75BAD26CBBA}.Debug|x64.Build.0 = Debug|x64 - {F4F1D8EF-4069-40F3-9AAB-F75BAD26CBBA}.Release|Win32.ActiveCfg = Release|Win32 - {F4F1D8EF-4069-40F3-9AAB-F75BAD26CBBA}.Release|Win32.Build.0 = Release|Win32 - {F4F1D8EF-4069-40F3-9AAB-F75BAD26CBBA}.Release|x64.ActiveCfg = Release|x64 - {F4F1D8EF-4069-40F3-9AAB-F75BAD26CBBA}.Release|x64.Build.0 = Release|x64 - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/CodeExecution/DemoReflectiveDLL/DemoDLL.v11.suo b/CodeExecution/DemoReflectiveDLL/DemoDLL.v11.suo deleted file mode 100644 index f1bd5a6..0000000 Binary files a/CodeExecution/DemoReflectiveDLL/DemoDLL.v11.suo and /dev/null differ diff --git a/CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.cpp b/CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.cpp deleted file mode 100644 index 61380d3..0000000 --- a/CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.cpp +++ /dev/null @@ -1,60 +0,0 @@ -// DemoDLL.cpp : Defines the exported functions for the DLL application. -// - -#include "stdafx.h" -#include "DemoDLL.h" - -using namespace std; - - -extern "C" __declspec( dllexport ) char* StringFunc() -{ - ostream *outputStream = NULL; - - //If you want to output to cout, simply set outputStream to &cout. This allows you to write a program that can switch between outputting to string or to cout. - //outputStream = &cout; - - ostringstream *stringStream = new ostringstream(); - outputStream = stringStream; - - (*outputStream) << "String DLL function is working" << endl << endl; - - string output = (*stringStream).str(); - const char* outputStr = output.c_str(); - - char* out = new char[output.size()+1]; - strcpy(out, outputStr); - out[output.size()] = '\0'; - - - return out; -} - -extern "C" __declspec( dllexport ) void VoidFunc() -{ - printf("Void DLL function is working, using printf to display. You will only see this if you run locally.\n\n"); - return; -} - -extern "C" __declspec( dllexport ) wchar_t* WStringFunc() -{ - wostream *outputStream = NULL; - - //If you want to output to wcout, simply set outputStream to &cout. This allows you to write a program that can switch between outputting to wstring or to wcout. - outputStream = &wcout; - - wostringstream *stringStream = new wostringstream(); - outputStream = stringStream; - - (*outputStream) << L"WString DLL function is working" << endl << endl; - - wstring output = (*stringStream).str(); - const wchar_t* outputStr = output.c_str(); - - wchar_t* out = new wchar_t[output.size()+1]; - wcscpy(out, outputStr); - out[output.size()] = '\0'; - - - return out; -} \ No newline at end of file diff --git a/CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.h b/CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.h deleted file mode 100644 index 2cb11a0..0000000 --- a/CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.h +++ /dev/null @@ -1,17 +0,0 @@ -// The following ifdef block is the standard way of creating macros which make exporting -// from a DLL simpler. All files within this DLL are compiled with the DEMODLL_EXPORTS -// symbol defined on the command line. This symbol should not be defined on any project -// that uses this DLL. This way any other project whose source files include this file see -// DEMODLL_API functions as being imported from a DLL, whereas this DLL sees symbols -// defined with this macro as being exported. -#ifdef DEMODLL_EXPORTS -#define DEMODLL_API __declspec(dllexport) -#else -#define DEMODLL_API __declspec(dllimport) -#endif - -using namespace std; - -extern "C" __declspec( dllexport ) char* StringFunc(); -extern "C" __declspec( dllexport ) void VoidFunc(); -extern "C" __declspec( dllexport ) wchar_t* WStringFunc(); \ No newline at end of file diff --git a/CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.vcxproj b/CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.vcxproj deleted file mode 100644 index 788891f..0000000 --- a/CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.vcxproj +++ /dev/null @@ -1,167 +0,0 @@ - - - - - Debug - Win32 - - - Debug - x64 - - - Release - Win32 - - - Release - x64 - - - - {F4F1D8EF-4069-40F3-9AAB-F75BAD26CBBA} - Win32Proj - DemoDLL - - - - DynamicLibrary - true - Unicode - - - DynamicLibrary - true - Unicode - - - DynamicLibrary - false - true - Unicode - - - DynamicLibrary - false - true - Unicode - - - - - - - - - - - - - - - - - - - true - - - true - - - false - - - false - - - - Use - Level3 - Disabled - WIN32;_DEBUG;_WINDOWS;_USRDLL;DEMODLL_EXPORTS;%(PreprocessorDefinitions) - - - Windows - true - - - - - Use - Level3 - Disabled - WIN32;_DEBUG;_WINDOWS;_USRDLL;DEMODLL_EXPORTS;%(PreprocessorDefinitions) - - - Windows - true - - - - - Level3 - Use - MaxSpeed - true - true - WIN32;NDEBUG;_WINDOWS;_USRDLL;DEMODLL_EXPORTS;%(PreprocessorDefinitions) - - - Windows - true - true - true - - - - - Level3 - Use - MaxSpeed - true - true - WIN32;NDEBUG;_WINDOWS;_USRDLL;DEMODLL_EXPORTS;%(PreprocessorDefinitions) - - - Windows - true - true - true - - - - - - - - - - - - - - false - false - - - - - false - false - - - - - - - Create - Create - Create - Create - - - - - - \ No newline at end of file diff --git a/CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.vcxproj.filters b/CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.vcxproj.filters deleted file mode 100644 index 40f585c..0000000 --- a/CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.vcxproj.filters +++ /dev/null @@ -1,42 +0,0 @@ - - - - - {4FC737F1-C7A5-4376-A066-2A32D752A2FF} - cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx - - - {93995380-89BD-4b04-88EB-625FBE52EBFB} - h;hpp;hxx;hm;inl;inc;xsd - - - {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} - rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms - - - - - - - - Header Files - - - Header Files - - - Header Files - - - - - Source Files - - - Source Files - - - Source Files - - - \ No newline at end of file diff --git a/CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.vcxproj.user b/CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.vcxproj.user deleted file mode 100644 index ace9a86..0000000 --- a/CodeExecution/DemoReflectiveDLL/DemoDLL/DemoDLL.vcxproj.user +++ /dev/null @@ -1,3 +0,0 @@ - - - \ No newline at end of file diff --git a/CodeExecution/DemoReflectiveDLL/DemoDLL/ReadMe.txt b/CodeExecution/DemoReflectiveDLL/DemoDLL/ReadMe.txt deleted file mode 100644 index 0edff7b..0000000 --- a/CodeExecution/DemoReflectiveDLL/DemoDLL/ReadMe.txt +++ /dev/null @@ -1,40 +0,0 @@ -======================================================================== - DYNAMIC LINK LIBRARY : DemoDLL Project Overview -======================================================================== - -AppWizard has created this DemoDLL DLL for you. - -This file contains a summary of what you will find in each of the files that -make up your DemoDLL application. - - -DemoDLL.vcxproj - This is the main project file for VC++ projects generated using an Application Wizard. - It contains information about the version of Visual C++ that generated the file, and - information about the platforms, configurations, and project features selected with the - Application Wizard. - -DemoDLL.vcxproj.filters - This is the filters file for VC++ projects generated using an Application Wizard. - It contains information about the association between the files in your project - and the filters. This association is used in the IDE to show grouping of files with - similar extensions under a specific node (for e.g. ".cpp" files are associated with the - "Source Files" filter). - -DemoDLL.cpp - This is the main DLL source file. - -///////////////////////////////////////////////////////////////////////////// -Other standard files: - -StdAfx.h, StdAfx.cpp - These files are used to build a precompiled header (PCH) file - named DemoDLL.pch and a precompiled types file named StdAfx.obj. - -///////////////////////////////////////////////////////////////////////////// -Other notes: - -AppWizard uses "TODO:" comments to indicate parts of the source code you -should add to or customize. - -///////////////////////////////////////////////////////////////////////////// diff --git a/CodeExecution/DemoReflectiveDLL/DemoDLL/dllmain.cpp b/CodeExecution/DemoReflectiveDLL/DemoDLL/dllmain.cpp deleted file mode 100644 index 69b5891..0000000 --- a/CodeExecution/DemoReflectiveDLL/DemoDLL/dllmain.cpp +++ /dev/null @@ -1,19 +0,0 @@ -// dllmain.cpp : Defines the entry point for the DLL application. -#include "stdafx.h" - -BOOL APIENTRY DllMain( HMODULE hModule, - DWORD ul_reason_for_call, - LPVOID lpReserved - ) -{ - switch (ul_reason_for_call) - { - case DLL_PROCESS_ATTACH: - case DLL_THREAD_ATTACH: - case DLL_THREAD_DETACH: - case DLL_PROCESS_DETACH: - break; - } - return TRUE; -} - diff --git a/CodeExecution/DemoReflectiveDLL/DemoDLL/stdafx.cpp b/CodeExecution/DemoReflectiveDLL/DemoDLL/stdafx.cpp deleted file mode 100644 index f18a679..0000000 --- a/CodeExecution/DemoReflectiveDLL/DemoDLL/stdafx.cpp +++ /dev/null @@ -1,8 +0,0 @@ -// stdafx.cpp : source file that includes just the standard includes -// DemoDLL.pch will be the pre-compiled header -// stdafx.obj will contain the pre-compiled type information - -#include "stdafx.h" - -// TODO: reference any additional headers you need in STDAFX.H -// and not in this file diff --git a/CodeExecution/DemoReflectiveDLL/DemoDLL/stdafx.h b/CodeExecution/DemoReflectiveDLL/DemoDLL/stdafx.h deleted file mode 100644 index a67fe85..0000000 --- a/CodeExecution/DemoReflectiveDLL/DemoDLL/stdafx.h +++ /dev/null @@ -1,20 +0,0 @@ -// stdafx.h : include file for standard system include files, -// or project specific include files that are used frequently, but -// are changed infrequently -// - -#pragma once - -#include "targetver.h" - -#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers -// Windows Header Files: -#include -#include -#include -#include -#include - - - -// TODO: reference additional headers your program requires here diff --git a/CodeExecution/DemoReflectiveDLL/DemoDLL/targetver.h b/CodeExecution/DemoReflectiveDLL/DemoDLL/targetver.h deleted file mode 100644 index 87c0086..0000000 --- a/CodeExecution/DemoReflectiveDLL/DemoDLL/targetver.h +++ /dev/null @@ -1,8 +0,0 @@ -#pragma once - -// Including SDKDDKVer.h defines the highest available Windows platform. - -// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and -// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. - -#include -- cgit v1.2.3