diff --git a/Enumerations/SYMBOLIC_LINK_FLAG.ps1 b/Enumerations/SYMBOLIC_LINK_FLAG.ps1 new file mode 100644 index 0000000..b54508d --- /dev/null +++ b/Enumerations/SYMBOLIC_LINK_FLAG.ps1 @@ -0,0 +1,5 @@ +$SYMBOLIC_LINK_FLAG = psenum $Module SYMBOLIC_LINK_FLAG UInt32 @{ + FILE = 0x00000000 + DIRECTORY = 0x00000001 + ALLOWUNPRIVILEGEDCREATE = 0x00000002 +} -Bitfield \ No newline at end of file diff --git a/FunctionDefinitions.ps1 b/FunctionDefinitions.ps1 index b58c1cb..c9ac3e5 100644 --- a/FunctionDefinitions.ps1 +++ b/FunctionDefinitions.ps1 @@ -211,6 +211,12 @@ [UInt32], #_In_ DWORD dwFlags, [UInt32] #_In_ DWORD th32ProcessID ) -EntryPoint CreateToolhelp32Snapshot -SetLastError), + + (func kernel32 CreateSymbolicLink ([bool]) @( + [String], #_Out_ LPCTSTR lpSymlinkPath, + [String], #_In_ LPCTSTR lpTargetPath, + [UInt32] #_In_ DWORD SYMBOLIC_LINK_FLAG + ) -EntryPoint CreateSymbolicLink -SetLastError) (func kernel32 GetCurrentProcess ([IntPtr]) @() -EntryPoint GetCurrentProcess), diff --git a/PSReflect-Functions.psd1 b/PSReflect-Functions.psd1 index a36126d..c896382 100644 --- a/PSReflect-Functions.psd1 +++ b/PSReflect-Functions.psd1 @@ -88,6 +88,7 @@ FunctionsToExport = @( 'CreateRemoteThread', 'CreateThread', 'CreateToolhelp32Snapshot', + 'CreateSymbolicLink', 'CryptCATAdminAcquireContext', 'CryptCATAdminAcquireContext2', 'CryptCATAdminAddCatalog', diff --git a/kernel32/CreateSymbolicLink.ps1 b/kernel32/CreateSymbolicLink.ps1 new file mode 100644 index 0000000..ed854bf --- /dev/null +++ b/kernel32/CreateSymbolicLink.ps1 @@ -0,0 +1,45 @@ +function CreateSymbolicLink +{ +<# + .SYNOPSIS + Creates a symbolic link in the filesystem. + + .DESCRIPTION + Creates a symbolic link in the filesystem. Requires Vista or higher. Requires administrator access. + + .NOTES + (func kernel32 CreateSymbolicLink ([bool]) @( + [String], #_Out_ LPCTSTR lpSymlinkPath, + [String], #_In_ LPCTSTR lpTargetPath, + [UInt32] #_In_ DWORD SYMBOLIC_LINK_FLAG + ) -EntryPoint CreateSymbolicLink -SetLastError) + ) + + + Author: Matt Green (@mgreen27) + License: BSD 3-Clause + Required Dependencies: PSReflect, SYMBOLIC_LINK_FLAG (enums) + Optional Dependencies: None +#> + param + ( + [Parameter(Mandatory = $true)] + [String] + $lpSymlinkPath, + + [Parameter(Mandatory = $true)] + [String] + $lpTargetPath, + + [Parameter(Mandatory = $true)] + [UInt32] + $dwFlags + ) + + $SUCCESS = $kernel32::CreateSymbolicLink($lpSymlinkPath, $lpTargetPath, $dwFlags); $LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() + + if(-not $SUCCESS) + { + throw "[CreateSymbolicLink] Error: $(([ComponentModel.Win32Exception] $LastError).Message)" + } +} \ No newline at end of file