In-memory PowerShell Revisited
We developed powerful tradecaft With Windows Script Host and C#.
Let’s go back and combine that with our PowerShell and Office tradecraft
from the previous module to develop another way of executing C# code
entirely in memory.
One of the issues when executing PowerShell in-memory was the use of Add-Type
or the rather complicated use of reflection.
While we proved that it is possible to call Win32 APIs and create a shellcode
runner in PowerShell entirely in-memory,
we can also do this by combining PowerShell and C#.
Using the Add-Type keyword made the .NET framework
both compile and load the C# assembly into the PowerShell process.
However, we can separate these steps, then fetch the pre-compiled assembly
and load it directly into memory.