search

BC-SECURITY / Empire

Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.
https://bc-security.gitbook.io/empire-wiki/
BSD 3-Clause "New" or "Revised" License
4.25k stars 576 forks source link

[BUG] Invoke-ReflectivePEInjection C# executables crash Powershell #229

Open Invoke-Mimikatz opened 4 years ago

Invoke-Mimikatz commented 4 years ago

Empire Version

OS Information (Linux flavor, Python version)

Describe the bug Some EXE files are not usable with Invoke-ReflectivePEInjection. In testing, it seems C# binaries are affected. Normal C binaries are able to be loaded just fine.

To Reproduce Steps to reproduce the behavior:

  1. Import-Module Invoke-ReflectivePEInjection
  2. Invoke-ReflectivePEInjection -PEPath File.exe
  3. if File.exe is a C# binary, Powershell crashes and EXE does not run.
  4. If File.exe is a C binary, Powershell does not crash, and the program runs.

Screenshots

Watson, a C# binary, crashes when loaded into Invoke-ReflectivePEInjection

watson

Running a C/assembly binary successfully and then a C# binary crashes the loader.

lsass

Mimikatz, a C binary, loads without issue.

mimkatz

Expected behavior A clear and concise description of what you expected to happen.

Screenshots If applicable, add screenshots to help explain your problem.

Additional context Add any other context about the problem here.

close-issue-app[bot] commented 4 years ago

This issue is closed because it does not meet our issue template. Please resubmit with the correct template.

close-issue-app[bot] commented 4 years ago

This issue is closed because it does not meet our issue template. Please resubmit with the correct template.

Hubbl3 commented 4 years ago

@Invoke-Mimikatz sorry for not responding earlier this is a known bug I plan on trying to fix next week. C# is a .Net language and when you compile into an .exe it actually has a different format than a unmanaged exe (a C program). That's why one works but the other doesn't