search

cobbr / SharpSploit

SharpSploit is a .NET post-exploitation library written in C#
https://sharpsploit.cobbr.io/api/
BSD 3-Clause "New" or "Revised" License
1.75k stars 307 forks source link

Added signatures, structs and functions for CreateProcess using the Platform Invoke API #64

Open salu90 opened 4 years ago

salu90 commented 4 years ago

Added signatures, structs and functions for CreateProcess using PInvoke in order to obtain the PROCESS_INFORMATION structure. This will allow us to better manage process creations and leverage features such as PPID Spoofing or Blockdlls.

New tasks in Covenant will follow to take advantage of these new functions.

Part of the code has been kindly stolen and adapted from TikiTorch (https://github.com/rasta-mouse/TikiTorch/blob/064c60c5e23188867a0f9c5a0626dd39718750d4/TikiLoader/Generic.cs).