From 6b0ada999a9d2be8c6c9267da57b898494d13219 Mon Sep 17 00:00:00 2001 From: Matt Graeber Date: Sun, 29 May 2016 07:54:50 -0700 Subject: Fixed FreeLibrary function signature #146 The parameter type and return types were accidentally transposed. Thanks @rojaster for pointing this out. --- Exfiltration/Invoke-NinjaCopy.ps1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'Exfiltration/Invoke-NinjaCopy.ps1') diff --git a/Exfiltration/Invoke-NinjaCopy.ps1 b/Exfiltration/Invoke-NinjaCopy.ps1 index 15bee1b..f22d5f5 100644 --- a/Exfiltration/Invoke-NinjaCopy.ps1 +++ b/Exfiltration/Invoke-NinjaCopy.ps1 @@ -572,7 +572,7 @@ $RemoteScriptBlock = { $Win32Functions | Add-Member NoteProperty -Name GetModuleHandle -Value $GetModuleHandle $FreeLibraryAddr = Get-ProcAddress kernel32.dll FreeLibrary - $FreeLibraryDelegate = Get-DelegateType @([Bool]) ([IntPtr]) + $FreeLibraryDelegate = Get-DelegateType @([IntPtr]) ([Bool]) $FreeLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FreeLibraryAddr, $FreeLibraryDelegate) $Win32Functions | Add-Member -MemberType NoteProperty -Name FreeLibrary -Value $FreeLibrary -- cgit v1.2.3