Reflective DLL Injection in PowerShell
We’ll reuse the PowerShell reflective DLL injection code
developed by the security researchers
Joe Bialek and Matt Graeber.
The script performs reflection
to avoid writing assemblies to disk,
after which it parses the desired PE file.
It has two separate modes,
the first is to reflectively load a DLL or EXE into the same process,
and the second is to load a DLL into a remote process.
We must specify a DLL or EXE as an array of bytes in memory,
which allows us to download and execute it without touching the disk.
For this exercise, we’ll use the same Meterpreter DLL that we created earlier.
Let’s set up our listener before we proceed.
To reflectively load a Meterpreter DLL in explorer.exe,
we are going to download it using the PowerShell DownloadData method…
…place it in a byte array,
and look up the desired process ID.
In order to execute the required commands…
…we must open a PowerShell window with “Exec Bypass”,
which allows script execution.
Once the window is open,
we’ll load the DLL into a byte array and retrieve the explorer process ID.
To use Invoke-ReflectivePEInjection,
we must first import it from its location in the tools folder
with Import-Module…
…and finally, we’ll supply the byte array
along with the process ID and execute the script.
This loads the DLL in memory,
and provides us with a reverse Meterpreter shell.
This script produces an error which can be ignored
as it does not affect the functionality of the script.
Notice that met.dll is not shown in the loaded DLL listing of Process Explorer.