Why Invoke-ReflectivePEInjection not recognized

spiceuser-ez549 · 2020-03-16T15:16:18.000Z

I was trying Invoke-ReflectivePEInjection by doing

.\Convert-BinaryToString

Convert-BinaryToString C:\file.exe

$InputString=“base64string”

$PEBytes=[System.Convert]::FromBase64String($InputString)

But when I run

Invoke-ReflectivePEInjection -PEBytes $PEBytes

I get

Invoke-ReflectivePEInjection : The term ‘Invoke-ReflectivePEInjection’ is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. At line:1 char:1 + Invoke-ReflectivePEInjection -PEBytes $PEBytes + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (Invoke-ReflectivePEInjection:String) , CommandNotFoundException + FullyQualifiedErrorId : CommandNotFoundException

What can be the reason?

Neally · 2020-03-16T15:59:30.000Z

Invoke-ReflectivePEInjection seems to be a custom function you have to load before you can use it.

github.com

PowerShellMafia/PowerSploit/blob/master/CodeExecution/Invoke-ReflectivePEInjection.ps1

function Invoke-ReflectivePEInjection
{
<#
.SYNOPSIS

This script has two modes. It can reflectively load a DLL/EXE in to the PowerShell process,
or it can reflectively load a DLL in to a remote process. These modes have different parameters and constraints,
please lead the Notes section (GENERAL NOTES) for information on how to use them.

1.)Reflectively loads a DLL or EXE in to memory of the Powershell process.
Because the DLL/EXE is loaded reflectively, it is not displayed when tools are used to list the DLLs of a running process.

This tool can be run on remote servers by supplying a local Windows PE file (DLL/EXE) to load in to memory on the remote system,
this will load and execute the DLL/EXE in to memory without writing any files to disk.

2.) Reflectively load a DLL in to memory of a remote process.
As mentioned above, the DLL being reflectively loaded won't be displayed when tools are used to list DLLs of the running remote process.

This is probably most useful for injecting backdoors in SYSTEM processes in Session0. Currently, you cannot retrieve output
from the DLL. The script doesn't wait for the DLL to complete execution, and doesn't make any effort to cleanup memory in the

This file has been truncated. show original

#load function
function Invoke-ReflectivePEInjection {
    #function code
}

#call function
Invoke-ReflectivePEInjection

spiceuser-ez549 · 2020-03-16T16:13:51.000Z

At the end of the script I have add

Convert base64 string to byte array

$PEBytes = [System.Convert]::FromBase64String($InputString)

Run EXE in memory

Invoke-ReflectivePEInjection -PEBytes $PEBytes
But with no success

Neally · 2020-03-16T16:21:49.000Z

spiceuser-ez549:

LOAD FUNCTION

function Invoke-ReflectivePEInjection { #function code }

Convert base64 string to byte array

$PEBytes = [System.Convert]::FromBase64String($InputString)

Run EXE in memory

call function

Invoke-ReflectivePEInjection -PEBytes $PEBytes

Again… you have to LOAD the function first.

ALso, If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don't say "Need help" or "PowerShell Help", actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy, past…

spiceuser-ez549 · 2020-03-16T16:35:56.000Z

Finally did it. Thanks and sorry for the incorrect formating