decay88

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace BlockDllTest
{
    class Program
    {
        static void Main(string[] args)
        {

decay88

/*
Author: Arno0x0x, Twitter: @Arno0x0x
Completely based on @Flangvik netloader

This partial rewrite of @Flangvik Netloader includes the following changes:

	- Allow loading of an XOR encrypted binary to bypass antiviruses
		To encrypt the initial binary you can use my Python transformFile.py script.
		Example: ./transformFile.py -e xor -k mightyduck -i Rubeus.bin -o Rubeus.xor
		

decay88

Useful C# References

decay88

using System;
using System.IO;
using System.Reflection;
using System.Reflection.Emit;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;

namespace ConsoleApp60
{
    class Program

decay88

<#
    ImageFileExecutionOptions v1.0
    License: GPLv3
    Author: @netbiosX
#>
# Image File Execution Options Injection Persistence Technique
# https://pentestlab.blog/2020/01/13/persistence-image-file-execution-options-injection/

function Persist-Debugger

decay88

/* 
 * Helper class for XTEA en/decryption of arbitrary data.
 * 
 * Copyright (c) 2017, Henrik Heine
 */

using System;
using System.IO;
using System.Text;

decay88

using System;
using System.ComponentModel;
using System.IO;
using System.Runtime.InteropServices;

namespace ConsoleApp61
{
    // something is wrong with this runpe
    // probably has to do with the context
    // not sure

decay88

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Classes\Scripting.Dictionary]
@=""

[HKEY_CURRENT_USER\Software\Classes\Scripting.Dictionary]
@="{00000001-0000-0000-0000-0000FEEDACDC}"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}]
@="Scripting.Dictionary"

decay88

 public static partial class Util
    {
        const string kDelegateInvokeMethodName = "Invoke";
        // http://www.codeproject.com/Tips/441743/A-look-at-marshalling-delegates-in-NET
        public static T GetDelegateForFunctionPointer<T>(IntPtr ptr, System.Runtime.InteropServices.CallingConvention call_conv)
            where T : class
        {
            Contract.Requires<ArgumentException>(typeof(T).IsSubclassOf(typeof(Delegate)));
            Contract.Requires<ArgumentNullException>(ptr != IntPtr.Zero);
            Contract.Requires<ArgumentException>(call_conv != System.Runtime.InteropServices.CallingConvention.ThisCall,

decay88

using System;
using System.Reflection;
using System.Reflection.Emit;
using System.Runtime;
using System.Text;
using System.Runtime.InteropServices;
using System.EnterpriseServices;
using ComTypes = System.Runtime.InteropServices.ComTypes;