Shellcode Runner in C#
Now that we have the basic framework,
we can reuse the shellcode runner technique from both VBA and PowerShell
and combine VirtualAlloc, CreateThread,
and WaitForSingleObject to execute shellcode in memory.
The first step is to use DllImport to import the three Win32 APIs
and configure the appropriate argument data types.
Next, we need to generate our shellcode.
Keep in mind that on a 64-bit Windows operating system,
Jscript will execute in a 64-bit context by default
so we have to generate a 64-bit Meterpreter staged payload,
in csharp format.
While we’re at it, we’ll set up our multi/handler.
Next, we add the payload to our code,
along with the calls to the three Win32 APIs,
and the managed to unmanaged memory copy,
which is the last part of the shellcode runner.
This should look very similar to what we did earlier.
Let’s discuss a few details of this code,
starting with the variable declarations.
The first, buf, is our shellcode.
Next is our size variable that stores the size of our buf variable.
As mentioned earlier, we use Marshal.Copy,
but don’t have to specify the .NET namespace.
We’ll once again use the WaitForSingleObject API
to let the shellcode finish execution.
Otherwise, the Jscript execution would terminate the process
before the shell becomes active.
Before compiling this project,
we must set the CPU architecture to x64
since we are using 64-bit shellcode.
This is done through the CPU drop down menu,
where we open the Configuration Manager.
In the Configuration Manager, we choose from the Platform drop down menu
and accept the new platform as x64.
Now we’ll need to compile the C# project,
which will generate an executable on our Samba share.
Executing it will give us a reverse Meterpreter shell.
Nice. We are one step closer.
In the next section we will get this
running in the context of the DotNetToJscript project.