Skip to content

Commit 5d8cd60

Browse files
committed
Fix 'ambigous match' in Get-System.ps1; #4
See PowerShellMafia#289
1 parent bf09d23 commit 5d8cd60

File tree

1 file changed

+13
-4
lines changed

1 file changed

+13
-4
lines changed

Privesc/Get-System.ps1

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -156,14 +156,23 @@ http://clymb3r.wordpress.com/2013/11/03/powershell-and-token-impersonation/
156156
$UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods')
157157
# Get a reference to the GetModuleHandle and GetProcAddress methods
158158
$GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle')
159-
$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress')
159+
$GetProcAddress = $UnsafeNativeMethods.GetMethods() | Where {$_.Name -eq "GetProcAddress"} | Select-Object -first 1
160+
160161
# Get a handle to the module specified
161162
$Kern32Handle = $GetModuleHandle.Invoke($null, @($Module))
162-
$tmpPtr = New-Object IntPtr
163-
$HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle)
164163

165164
# Return the address of the function
166-
Write-Output $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef, $Procedure))
165+
try
166+
{
167+
$tmpPtr = New-Object IntPtr
168+
$HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle)
169+
Write-Output $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef, $Procedure))
170+
}
171+
catch
172+
{
173+
# Windows 10 v1803 needs $Kern32Handle as a System.IntPtr instead of System.Runtime.InteropServices.HandleRef
174+
Write-Output $GetProcAddress.Invoke($null, @($Kern32Handle, $Procedure))
175+
}
167176
}
168177

169178
# performs named pipe impersonation to elevate to SYSTEM without needing

0 commit comments

Comments
 (0)