Reflective Injection Returns
In an earlier module, we used the
Invoke-ReflectivePEInjection PowerShell script
to inject an unmanaged Meterpreter DLL
into a process with reflective DLL injection.
However, in a previous section, we enabled AppLocker DLL
rules to block untrusted DLLs.
Let’s try to leverage InstallUtil to bypass AppLocker
& revive the powerful reflective DLL injection technique.
First, we’ll generate a 64-bit Meterpreter DLL
and host it on the Apache server on our Kali machine.
We’ll also make sure the Invoke-ReflectivePEInjection.ps1
script from C:\Tools is on the Apache
server to simulate the full attack scenario.
Next, we’ll modify the cmd variable inside the constrained
language mode bypass from the C# application developed
in the previous sections.
Our goal is to download the Meterpreter DLL
into a byte array,
determine the process ID of explorer.exe for the DLL
injection, and download and execute the
Invoke-ReflectivePEInjection script.
Since we pass the script on a single line, we used the
; command terminator to supply multiple commands at once.
Once we compile and execute the C# application
through InstallUtil,
it generates a reverse shell, proving that the unmanaged DLL
successfully loaded, bypassing AppLocker’s DLL rules.