Skip to content

Commit 1cdad58

Browse files
author
Matt Graeber
committed
Added a slight delay to Invoke-DllInjection validation
In some cases, the loaded module would show up as loaded after the check occurred.
1 parent f5d9b25 commit 1cdad58

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

CodeExecution/Invoke-DllInjection.ps1

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -313,9 +313,11 @@ http://www.exploit-monday.com
313313
# Close process handle
314314
$CloseHandle.Invoke($hProcess) | Out-Null
315315

316+
Start-Sleep -Seconds 2
317+
316318
# Extract just the filename from the provided path to the dll.
317-
$FileName = Split-Path $Dll -Leaf
318-
$DllInfo = (Get-Process -Id $ProcessID).Modules | ? { $_.FileName.Contains($FileName) }
319+
$FileName = (Split-Path $Dll -Leaf).ToLower()
320+
$DllInfo = (Get-Process -Id $ProcessID).Modules | ? { $_.FileName.ToLower().Contains($FileName) }
319321

320322
if (!$DllInfo)
321323
{

0 commit comments

Comments
 (0)