PowerShellMafia / PowerSploit

PowerSploit - A PowerShell Post-Exploitation Framework
Other
11.77k stars 4.59k forks source link

[Invoke-ReflectivePEInjection] Allow DLL loading without calling any function. #280

Open mgeeky opened 6 years ago

mgeeky commented 6 years ago

There are many DLL payloads that all start up from DllMain(DLL_PROCESS_ATTACH). They do not export any method so there is no need to call one. In order to work with those payloads, the script had to be modified so that -FuncReturnType could accept value of None and therefore avoid calling any function in the DLL. Thus of course, leaving all the job for the DLL's entrypoint routine.

For instance, to work with msfvenom generated DLL - which rely solely on it's DllMain implementation, we don't want to call any exported function.