Bugfix: Resolving ordinals in remote dll injection

clymb3r · clymb3r · commit 90a05de7a66c · 2015-01-07T21:08:58.000-08:00
Thanks to sixdub for finding and fixing a bug when resolving functions
by ordinal in remote processes.
diff --git a/CodeExecution/Invoke-ReflectivePEInjection.ps1 b/CodeExecution/Invoke-ReflectivePEInjection.ps1
@@ -33,7 +33,7 @@ Author: Joe Bialek, Twitter: @JosephBialek
 License: BSD 3-Clause
 Required Dependencies: None
 Optional Dependencies: None
-Version: 1.2
+Version: 1.3
 
 .DESCRIPTION
 
@@ -1547,7 +1547,7 @@ $RemoteScriptBlock = {
 		{
 			Throw "Unable to allocate memory in the remote process for shellcode"
 		}
-		
+		[UIntPtr]$NumBytesWritten = [UIntPtr]::Zero
 		$Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten)
 		if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength))
 		{

Original file line number	Diff line number	Diff line change
`@@ -33,7 +33,7 @@ Author: Joe Bialek, Twitter: @JosephBialek`
`33`	`33`	`License: BSD 3-Clause`
`34`	`34`	`Required Dependencies: None`
`35`	`35`	`Optional Dependencies: None`
`36`		`-Version: 1.2`
	`36`	`+Version: 1.3`
`37`	`37`
`38`	`38`	`.DESCRIPTION`
`39`	`39`
`@@ -1547,7 +1547,7 @@ $RemoteScriptBlock = {`
`1547`	`1547`	`{`
`1548`	`1548`	`Throw "Unable to allocate memory in the remote process for shellcode"`
`1549`	`1549`	`}`
`1550`		`-`
	`1550`	`+ [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero`
`1551`	`1551`	`$Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten)`
`1552`	`1552`	`if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength))`
`1553`	`1553`	`{`