From dfec277813bfbc956dcac45345a9158093d68343 Mon Sep 17 00:00:00 2001 From: Matt Graeber Date: Fri, 31 May 2013 19:35:26 -0400 Subject: Added Invoke-ReflectivePEInjection Another awesome addition from Joe Bialek. Invoke-ReflectivePEInjection is a vast improvement over Invoke-ReflectiveDllInjection. It adds the following features: * Now supports loading exe files in memory * Supports reflective dll injection into a remote process * Additional sample Visual Studio solutions --- .../Shellcode/x64/ExitThread.asm | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x64/ExitThread.asm (limited to 'CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x64/ExitThread.asm') diff --git a/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x64/ExitThread.asm b/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x64/ExitThread.asm new file mode 100644 index 0000000..d16cbc9 --- /dev/null +++ b/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x64/ExitThread.asm @@ -0,0 +1,14 @@ +[SECTION .text] + +global _start + +_start: + ; Set a var to 1, let PS known exe is exiting + mov rbx, 0x4141414141414141 + mov [rbx], byte 0x01 + + ; Call exitthread instead of exitprocess + sub rsp, 0xc0 + and sp, 0xFFf0 ; Needed for stack alignment + mov rbx, 0x4141414141414141 + call rbx -- cgit v1.2.3