Phrozen Timeline

PowerAssembly

Map in current PowerShell Instance Memory .NET Assemblies from remote web server.

When Assembly is mapped, you can invoke it's main with a command line argument.

The advantage of this technique is to avoid having assemblies written on disk. Everything happens in memory.

I'm using this script during my penetration tests / labs right after getting an initial shell on Windows to load other .NET Tools (Ex: ShapHound, ShapUp etc..)

Read more...

As promised, we will adapt our previous code grab an exported function directly from memory.

Serious advantage of this technique:

  • We don't have to use CreateToolHelp32Snapshot anymore to enumerate modules and catch target module base address.
  • We don't need to parse PE Header from disk anymore, we will parse PE Header directly from memory.

Read more...