Possible with .net assembly ?

Idov31 / FunctionStomping

Shellcode injection technique. Given as C++ header, standalone Rust program or library.

https://idov31.github.io/2022/01/28/function-stomping.html

GNU General Public License v3.0

684 stars 97 forks source link

Possible with .net assembly ? #6

Closed spookycheekybreeky closed 2 years ago

spookycheekybreeky commented 2 years ago

Hi , is your beautiful peace of work working with .net assembly ?

Im trying to run a .net assembly shellcode generated with the donuts tools from TheWover. https://github.com/TheWover/donut

the .net PE i converted is a asyncrat PE, when i try to inject it inside a process (i had to remove the max shellcode lengh because shellcode is 147k bytes long) but i get no connection back / the asssembly is not starting ?

is this even possible to work with a .net PE?

sorry for retarded question but im really noy good with shellcode stuff.

Idov31 commented 2 years ago

Hey, I'm glad that you like my work and experimenting with it :)

It can work with .net PE generally but since the injection overwrites a single function a complete rat as a shellcode might be too big for it.

I suggest you to either:

Use a stager shellcode to execute the AsyncRat.
Find other similar alternative like klezVirus's FunctionHijacking that might be a better fit for it.

spookycheekybreeky commented 2 years ago

Thx for your reply,

Im gonna look into FunctionHijacking (its looking definitely better for my use case), but im still gonna use your repo for small use case like spawning a process or runing shell command in general !

Thx. (you can mark this issue as close)