Module: Msf::ReflectiveDLLLoader

Overview

This mixin contains functionality which loads a Reflective DLL from disk into memory and finds the offset of the reflective loader's entry point.

Constant Summary collapse

EXPORT_REFLECTIVELOADER =

This is the ordinal of the reflective loader by default In new RDI DLLs that come with MSF

1

Instance Method Summary collapse

Instance Method Details

#load_rdi_dll(dll_path, loader_name: 'ReflectiveLoader', loader_ordinal: EXPORT_REFLECTIVELOADER) ⇒ Array

Load a reflectively-injectable DLL from disk and find the offset to the ReflectiveLoader function inside the DLL.

Parameters:

  • dll_path (String)

    Path to the DLL to load.

Returns:

  • (Array)

    Tuple of DLL contents and offset to the ReflectiveLoader function within the DLL.


24
25
26
27
28
29
30
31
32
33
34
35
# File 'lib/msf/core/reflective_dll_loader.rb', line 24

def load_rdi_dll(dll_path, loader_name: 'ReflectiveLoader', loader_ordinal: EXPORT_REFLECTIVELOADER)
  dll = ''
  ::File.open(dll_path, 'rb') { |f| dll = f.read }

  offset = parse_pe(dll, loader_name: loader_name, loader_ordinal: loader_ordinal)

  unless offset
    raise "Cannot find the ReflectiveLoader entry point in #{dll_path}"
  end

  return dll, offset
end

#load_rdi_dll_from_data(dll_data, loader_name: 'ReflectiveLoader', loader_ordinal: EXPORT_REFLECTIVELOADER) ⇒ Integer

Load a reflectively-injectable DLL from a string and find the offset to the ReflectiveLoader function inside the DLL.

Parameters:

  • dll_data (String)

    the DLL data to load.

Returns:

  • (Integer)

    offset to the ReflectiveLoader function within the DLL.


43
44
45
46
47
48
49
50
51
# File 'lib/msf/core/reflective_dll_loader.rb', line 43

def load_rdi_dll_from_data(dll_data, loader_name: 'ReflectiveLoader', loader_ordinal: EXPORT_REFLECTIVELOADER)
  offset = parse_pe(dll_data, loader_name: loader_name, loader_ordinal: loader_ordinal)

  unless offset
    raise 'Cannot find the ReflectiveLoader entry point in DLL data'
  end

  offset
end