Skip to content
This repository has been archived by the owner on Jan 21, 2021. It is now read-only.

Invoke-NinjaCopy.ps1 fails on server 2019 #335

Open
tuian opened this issue Oct 31, 2019 · 2 comments
Open

Invoke-NinjaCopy.ps1 fails on server 2019 #335

tuian opened this issue Oct 31, 2019 · 2 comments

Comments

@tuian
Copy link

tuian commented Oct 31, 2019

0x00 error info

Get-ProcAddress : Exception calling "GetMethod" with "1" argument(s): "Ambiguous match found."
At C:\tools\t.ps1:436 char:23
+         $VirtualAllocAddr = Get-ProcAddress kernel32.dll VirtualAlloc
+                             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-ProcAddress], MethodInvocationException
    + FullyQualifiedErrorId : AmbiguousMatchException,Get-ProcAddress
 

0x01 Get-ProcAddress func details

	#Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/
	Function Get-ProcAddress
	{
	    Param
	    (
	        [OutputType([IntPtr])]
	    
	        [Parameter( Position = 0, Mandatory = $True )]
	        [String]
	        $Module,
	        
	        [Parameter( Position = 1, Mandatory = $True )]
	        [String]
	        $Procedure
	    )

	    # Get a reference to System.dll in the GAC
	    $SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() |
	        Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }
	    $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods')
	    # Get a reference to the GetModuleHandle and GetProcAddress methods
	    $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle')
	    $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress')
	    # Get a handle to the module specified
	    $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module))
	    $tmpPtr = New-Object IntPtr
	    $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle)

	    # Return the address of the function
	    Write-Output $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef, $Procedure))
	}

0x02 system info

Windows Server 2019 Datacenter
@tuian
Copy link
Author

tuian commented Oct 31, 2019

Solved

@danielniccoli
Copy link

Where can I get the fixed source code?

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants