Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/mvelazc0/defcon27_csharp_workshop

Writing custom backdoor payloads with C# - Defcon 27 Workshop
https://github.com/mvelazc0/defcon27_csharp_workshop

csharp payloads redteam

Last synced: 11 days ago
JSON representation

Writing custom backdoor payloads with C# - Defcon 27 Workshop

Awesome Lists containing this project

README 

        
# Writing custom backdoor payloads with C#



This workshop aims to provide attendees hands-on experience on writing custom backdoor payloads using C# for the most common command and control frameworks including Metasploit, Powershell Empire and Cobalt Strike. The workshop consists in 8 lab exercises; each of the exercises goes over a different technique that leverages C# and .NET capabilities to obtain a reverse shell on a victim Windows host. The covered techniques include raw shellcode injection, process injection, process hollowing, runtime compilation, parent pid spoofing, antivirus bypassing, etc. At the end of this workshop attendees will have a clear understanding of these techniques both from an attack and defense perspective.



**Skill Level**: Intermediate



**Prerequisites**: Basic to intermediate programming/scripting skills. Prior experience with C# helps but not required.



**Materials**: Laptop with virtualization software. A Windows 10 virtual machine and a Kali Linux Virtual Machine.



The "Writing custom back payloads with C#" workshop was first presented at [Defcon 27](https://www.defcon.org/html/defcon-27/dc-27-workshops.html#velazco). 



## Authors



* **Mauricio Velazco** - [@mvelazco](https://twitter.com/mvelazco)



* **Olindo Verrillo** - [@olindoverrillo](https://twitter.com/olindoverrillo)



## Labs



### Lab 1 : Hello World



The goal of this lab is to implement the typical Hello World example with C#. The first exercise uses .NETs Console class to print “Hello World” while the second uses .NETs Platform Invocation Services feature to import and call the Win32 Api MessageBox.



### Lab 2 : Custom Meterpreter Stager



The goal of this lab is to write a custom Meterpreter stager with C# by leveraging the WebClient class to download meterpreter’s second stage and Win32 API functions to copy the second stage in memory and execute it.



### Lab 3 : Raw Shellcode Injection



The goal of this lab is to write a custom binary that injects a pre-defined shellcode into memory and executes it. Metasploit’s msfvenom will be used to generate the shellcode and the same Win32 API calls used in Lab 2 will be used to perform the execution.



### Lab 4 : Shellcode Obfuscation



The goal of this lab is to reduce detection of the custom payloads by signature based anti-malware. We can achieve this by obfuscating the shellcode generated by msfvenom using two common techniques: XOR and AES



### Lab 5 : PowerShell without PowerShell.exe



The goal of this lab is to execute a Powershell script and avoid to use the powershell.exe binary by leveraging the .NET framework and C#. Using this technique, we will get a Powershell Empire agent.  



### Lab 6 : DLL Injection



The goal of this lab is to implement the DLL Injection technique using C# and obtain a reverse shell from a victim host. Using 3 different exercises, we will understand and implement the different steps for a successful injection.



### Lab 7 : Process Hollowing



The goal of this lab is to understand and implement the Process Hollowing technique using C# technique to obtain a reverse shell on a victim host. 



### Lab 8 : Parent Process Spoofing



The goal of the final lab is to leverage C# to spawn a new process spoofing its parent process and inject shellcode to it to obtain a reverse shell.



## Acknowledgments



Most of the labs on this workshop started from a Github repository/gist, a Stack Overflow code snippet or a Google search. Thank you to everyone who shares code for others to learn from.



* https://github.com/pwndizzle/c-sharp-memory-injection

* http://www.codingvision.net/miscellaneous/c-inject-a-dll-into-a-process-w-createremotethread

* https://github.com/re4lity/subTee-gits-backups

* https://www.codeproject.com/Articles/769741/Csharp-AES-bits-Encryption-Library-with-Salt

* https://gist.github.com/Arno0x/7f34e869cc847e088d3e107632e18294

* https://github.com/leoloobeek/csharp/blob/master/ExecutionTesting.cs