Accessing the Windows API in PowerShell via internal .NET methods and reflection

tl:dr version

It is possible to invoke Windows API function calls via internal .NET native method wrappers in PowerShell without requiring P/Invoke or C# compilation. How is this useful for an attacker? You can call any Windows API function (exported or non-exported) entirely in memory. For those familiar with Metasploit internals, think of this as an analogue to railgun.

---

This journey started for me upon releasing my PowerShell shellcode execution scripts and noticing that even if I issued C# compiler parameters to compile in memory, csc.exe would still write temporary files to disk. This is unacceptible for any attacker. The venerable Lee Holmes mentioned to me that the only way to achieve true memory-residence in .NET is through the System.Reflection namespace. Reflection is an extremely powerful technique used to generate dynamic code. In .NET, you can achieve fine-tuned control over generated code even to the MSIL bytecode level. Before I get too deep in the weeds, let me tell you a story about rifiling through .NET assemblies.

At one point, I was interested in auditing .NET methods that manipulated data/memory in a possibly unsafe fashion. To find some potential targets in Powershell I enumerated the exported types of every loaded .NET assembly via the following commands:

# Get a list of every loaded assembly
$Assemblies = [AppDomain]::CurrentDomain.GetAssemblies()
# Dump every unsafe class whose methods manipulate Int pointers in some fashion
$Assemblies |
   ForEach-Object {
      $_.GetTypes()|
         ForEach-Object {
            $_ | Get-Member -Static| Where-Object {
               $_.Definition.Contains('System.IntPtr') -And $_.TypeName.Contains('Unsafe')
            }
         }  2> $null
   }

This search yielded some very interesting methods. The ones that were of the most immediate value to me were those contained within Microsoft.Win32.UnsafeNativeMethods:

   TypeName: Microsoft.Win32.UnsafeNativeMethods

Name                        MemberType Definition
----                        ---------- ----------
CreateWindowEx              Method     static System.IntPtr CreateWindowEx(int exStyle, string lpszClassName, string lpszWindowName, int style, int x, int y, int width, int height, System.Runtime....
DefWindowProc               Method     static System.IntPtr DefWindowProc(System.IntPtr hWnd, int msg, System.IntPtr wParam, System.IntPtr lParam)
GetDC                       Method     static System.IntPtr GetDC(System.Runtime.InteropServices.HandleRef hWnd)
GetModuleHandle             Method     static System.IntPtr GetModuleHandle(string modName)
GetProcAddress              Method     static System.IntPtr GetProcAddress(System.Runtime.InteropServices.HandleRef hModule, string lpProcName)
GetProcessWindowStation     Method     static System.IntPtr GetProcessWindowStation()
GetStdHandle                Method     static System.IntPtr GetStdHandle(int type)
MsgWaitForMultipleObjectsEx Method     static int MsgWaitForMultipleObjectsEx(int nCount, System.IntPtr pHandles, int dwMilliseconds, int dwWakeMask, int dwFlags)
PostMessage                 Method     static bool PostMessage(System.Runtime.InteropServices.HandleRef hwnd, int msg, System.IntPtr wparam, System.IntPtr lparam)
SelectObject                Method     static System.IntPtr SelectObject(System.Runtime.InteropServices.HandleRef hDC, System.Runtime.InteropServices.HandleRef hObject)
SendMessage                 Method     static System.IntPtr SendMessage(System.Runtime.InteropServices.HandleRef hWnd, int msg, System.IntPtr wParam, System.IntPtr lParam)
SetClassLong                Method     static System.IntPtr SetClassLong(System.Runtime.InteropServices.HandleRef hWnd, int nIndex, System.IntPtr dwNewLong)
SetClassLongPtr32           Method     static System.IntPtr SetClassLongPtr32(System.Runtime.InteropServices.HandleRef hwnd, int nIndex, System.IntPtr dwNewLong)
SetClassLongPtr64           Method     static System.IntPtr SetClassLongPtr64(System.Runtime.InteropServices.HandleRef hwnd, int nIndex, System.IntPtr dwNewLong)
SetTimer                    Method     static System.IntPtr SetTimer(System.Runtime.InteropServices.HandleRef hWnd, System.Runtime.InteropServices.HandleRef nIDEvent, int uElapse, System.Runtime.I...
SetWindowLong               Method     static System.IntPtr SetWindowLong(System.Runtime.InteropServices.HandleRef hWnd, int nIndex, System.Runtime.InteropServices.HandleRef dwNewLong)
SetWindowLongPtr32          Method     static System.IntPtr SetWindowLongPtr32(System.Runtime.InteropServices.HandleRef hWnd, int nIndex, System.Runtime.InteropServices.HandleRef dwNewLong)
SetWindowLongPtr64          Method     static System.IntPtr SetWindowLongPtr64(System.Runtime.InteropServices.HandleRef hWnd, int nIndex, System.Runtime.InteropServices.HandleRef dwNewLong)
VerQueryValue               Method     static bool VerQueryValue(System.Runtime.InteropServices.HandleRef pBlock, string lpSubBlock, System.IntPtr&, mscorlib, Version=2.0.0.0, Culture=neutral, Pub...

Microsoft.Win32.UnsafeNativeMethods is an internal class that cannot be referenced through any direct means. If you try to reference the class, you will get an error stating that its module is not loaded. Microsoft.Win32.UnsafeNativeMethods is implemented within System.dll in the GAC.

Of the methods listed above, GetModuleHandle and GetProcAddress were the most interesting to me since these two methods form the basis for calling any other function in the Windows API. How do you access these methods you ask? I wrote the following PowerShell function to demonstrate:

function Get-ProcAddress {
Param (
    [Parameter(Position = 0, Mandatory = $True)] [String] $Module,
    [Parameter(Position = 1, Mandatory = $True)] [String] $Procedure
)

    # Get a reference to System.dll in the GAC
    $SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() |
        Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }
    $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods')
    # Get a reference to the GetModuleHandle and GetProcAddress methods
    $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle')
    $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress')
    # Get a handle to the module specified
    $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module))
    $tmpPtr = New-Object IntPtr
    $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle)
    # Return the address of the function
    return $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef, $Procedure))
}

The function first gets a list of all loaded assemblies in PowerShell. It then gets a reference to System.dll, which contains Microsoft.Win32.UnsafeNativeMethods. I then call the GetMethod method on 'GetModuleHandle' and 'GetProcAddress'. I then invoke GetModuleHandle. Normally, in PowerShell, you would invoke this .NET method like this: 

[Microsoft.Win32.UnsafeNativeMethods]::GetModuleHandle('kernel32.dll')

That syntax would generate an error though because it is not a public class. I then get a reference to the returned handle. This is necessary because the managed version of GetProcAddress requires it. Finally, I call GetProcAddress on the function I'm interested in. As an example, the following command will return the address for VirtualAlloc:

Get-ProcAddress kernel32.dll VirtualAlloc

Now, having the address to VirtualAlloc is great and all, but what can be done with it? Conveniently, the System.Runtime.InteropServices.Marshal class contains a very handy method called GetDelegateForFunctionPointer. For those unfamiliar with delegates, think of them as function pointers. GetDelegateForFunctionPointer takes two parameters: a pointer (what was returned from Get-ProcAddress) and a type (a method signature). In C#, defining a method signature is trivial. You just use the delegate keyword. Therefore if you wanted to create a method signature for VirtualAlloc in C#, you could write something like the following:

IntPtr delegate VirtualAllocSig(IntPtr lpAddress, UInt32 dwSize, UInt32 flAllocationType, UInt32 flProtect);

Unfortunately, PowerShell has no equivalent to the 'delegate' keyword. This is where reflection and a handy article circa 2004 come into play. Using reflection, you can do the equivalent of compiling the C# code snippet above. This process is far from straightforward but can be accomplished via the function below:

function Get-DelegateType
{
    Param
    (
        [OutputType([Type])]
            
        [Parameter( Position = 0)]
        [Type[]]
        $Parameters = (New-Object Type[](0)),
            
        [Parameter( Position = 1 )]
        [Type]
        $ReturnType = [Void]
    )

    $Domain = [AppDomain]::CurrentDomain
    $DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate')
    $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)
    $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false)
    $TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
    $ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters)
    $ConstructorBuilder.SetImplementationFlags('Runtime, Managed')
    $MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters)
    $MethodBuilder.SetImplementationFlags('Runtime, Managed')
        
    Write-Output $TypeBuilder.CreateType()
}

So to create the equivalent of the C# code that creates a delegate type, you can issue the following command now:

$VirtualAllocDelegate = Get-DelegateType @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])

Note that if a function passes a parameter by reference, you can still get a proper delegate type by using the MakeByRefType method:

$ByRefDelegate = Get-DelegateType @([String].MakeByRefType()) ([Void])

Coming back full-circle now, we now have everything GetDelegateForFunctionPointer needs to get a 'managed function pointer' to any Windows API function. So lets say you wanted to allocate some RWX memory. This can now be achieved:

$VirtualAllocAddr = Get-ProcAddress kernel32.dll VirtualAlloc
$VirtualAllocDelegate = Get-DelegateType @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])
$VirtualAlloc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocAddr, $VirtualAllocDelegate)
$AllocatedMemory = $VirtualAlloc.Invoke([IntPtr]::Zero, 0x1000, 0x3000, 0x40)

Last but not least, it is worth noting that this method will only execute functions that use the StdCall calling convention. Also, if anyone is familiar with Lee Holmes' awesome Invoke-WindowsApi script, you might have noticed that these techniques offer similar functionality to his script. The main difference is that this technique does not use P/Invoke and because you're calling a function from an address, you not just limited to exported functions. You can call non-exported StdCall functions.

Now, you're limited only by your imagination as to what you can achieve in Powershell and all without touching the disk! For example, soon I'll be modifying PowerSyringe to take advantage of these techniques. Also, expect more features to be added to PowerSyringe in the near future...