Fix WinPEAS In-Memory Execution: Use Compatible .NET Execution Methods Instead of Injection into Notepad on Windows 10 x64 "#20434" #20439
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR addresses the issue where running the Metasploit command exec -m winpeas.exe -d notepad.exe on Windows 10 x64 causes the error "The parameter is incorrect" or crashes the Meterpreter session.
Problem Summary:
Direct in-memory injection of WinPEAS, a .NET executable, into Notepad fails because Notepad is a native Win32 process that does not load the .NET Common Language Runtime (CLR). This mismatch leads to session instability or execution errors.
Proposed Solution:
Benefits:
Testing and Validation:
1)Verified successful in-memory execution of WinPEAS via execute_dotnet_assembly across Windows 10 x64 versions.
2)Confirmed fallback PowerShell method works as intended on targets lacking the post module.
3)Tested architecture checks ensure no cross-bitness mismatches causing crashes.