Skip to content

C# Shellcode Runner to execute shellcode via CreateRemoteThread and SetThreadContext to evade Get-InjectedThread

Notifications You must be signed in to change notification settings

djhohnstein/CSharpSetThreadContext

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 
 
 
 
 
 
 

Repository files navigation

Disclaimer

The code provided is "as is" and will not be supported.

CSharp SetThreadContext Shellcode Runner Example

This project is a C# port of the work @xpn did in his blog post here:

https://blog.xpnsec.com/undersanding-and-evading-get-injectedthread/

We only tackle the SetThreadContext portion here, though the building blocks to perform all three tasks are here.

This project first determines a suitable executable to spawn, decrypts shellcode using a predefined key, then uses CreateRemoteThread and SetThreadContext to ensure that the remote thread is backed by a file on disk, effectively evading Get-InjectedThread.

Usage

The solution file is in Cryptor\ThreadContextRunner.sln. Open this and view the two projects. If you wish to change the encryption key, you'll need to change it both in Cryptor and Runner projects.

Right click Cryptor in the solution pane and click "Build". This will build the executable, Cryptor.exe, that will encrypt your shellcode. Run this by: Cryptor.exe C:\Path\To\Shellcode.bin. This generates a new file, encrypted.bin.

Next, right click the Runner project in the Solution Explorer on the right hand side and click "Properties". Go to Resources then add a new File resource. Navigate to the folder where encrypted.bin was generated and add it as a resource. Then, click this new resource in the Solution Explorer and ensure that the Build Action is set to "Embedded Resource".

Now you can rebuild the entire solution. Runner.exe will be generated and should be suitable to run your shellcode when double clicked.

Special Thanks

@xpn and @its_a_feature for their excellent blog and teaching me C/C++ respectively.

About

C# Shellcode Runner to execute shellcode via CreateRemoteThread and SetThreadContext to evade Get-InjectedThread

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages