Skip to content
Utilizing MMF as a execution space for shell code
Branch: master
Clone or download
Latest commit 0b8c1fc Aug 28, 2018
Type Name Latest commit message Commit time
Failed to load latest commit information. Update Aug 7, 2018
mmffml.cs Add files via upload Aug 7, 2018
mmfml.ps1 Update mmfml.ps1 Aug 28, 2018


MMFml - A tool for injecting shell code into and executing from the Windows system memory map.


The goal was to create a method for inserting either x86 or x64 (depending on your target architecture) shell into MMF (heap) and gain a pointer back to the starting position of the opcode. From there we direct CPU execution back to the target address allowing for the execution of the code living within MMF.


The Powershell code requires PS v5+ to run. The Powershell code currently is designed only for 64-bit systems.

Using MMFml

The C#.NET source is a PoC that we built as the first PoC. As it stands it will launch calc.exe by making a command call to calc.exe via cmd.exe. The shell is x64 and was generated by utilizing the following msfvenom command:

msfvenom -p windows/x64/exec CMD="cmd.exe -c calc.exe" -f csharp

The powershell module utilizes Matt Graeber's function, Get-DelagateType from Invoke-Shellcode. The powershell does the same thing as the .NET portion of the project however is capable of launching more complex programs such as a meterpreter session, empire payload, etc.

Please add your own shell prior to using if you want it to execute. Please note that in its current iteration, this is designed to work on 64-bit systems.


We do not intend to maintain the C# version; this code is provided as reference. Work moving forward will be performed on the Powershell code.


The MMFml project and all individual components are under the BSD 3-Clause license unless explicitly noted otherwise.

You can’t perform that action at this time.