C# Executing Shellcode In C# (No Imports Required)

PHP Code



<?php 
/**
 * C# Shellcode Example
 * (c) 2017 atom0s [[email protected]]
 *
 * Demonstrates how to invoke shellcode within C# using a memory mapped file.
 */
 
namespace ShellcodeExample
{
    using System;
    using System.IO.MemoryMappedFiles;
    using System.Runtime.InteropServices;
 
    class Program
    {
        /// <summary>
        /// Function delegate to invoke the shellcode.
        /// </summary>
        /// <returns></returns>
        private delegate IntPtr GetPebDelegate();
 
        /// <summary>
        /// Shellcode function used to obtain the PEB of the process.
        /// </summary>
        /// <returns></returns>
        private unsafe static IntPtr GetPeb()
        {
           var shellcode = new byte[]
               {
                   0x64, 0xA1, 0x30, 0x00, 0x00, 0x00,         // mov eax, dword ptr fs:[30]
                   0xC3                                        // ret
               };
 
            MemoryMappedFile mmf = null;
            MemoryMappedViewAccessor mmva = null;
 
            try
            {
                // Create a read/write/executable memory mapped file to hold our shellcode..
                mmf = MemoryMappedFile.CreateNew("__shellcode", shellcode.Length, MemoryMappedFileAccess.ReadWriteExecute);
 
                // Create a memory mapped view accessor with read/write/execute permissions..
                mmva = mmf.CreateViewAccessor(0, shellcode.Length, MemoryMappedFileAccess.ReadWriteExecute);
 
                // Write the shellcode to the MMF..
                mmva.WriteArray(0, shellcode, 0, shellcode.Length);
 
                // Obtain a pointer to our MMF..
                var pointer = (byte*)0;
                mmva.SafeMemoryMappedViewHandle.AcquirePointer(ref pointer);
 
                // Create a function delegate to the shellcode in our MMF..
                var func = (GetPebDelegate)Marshal.GetDelegateForFunctionPointer(new IntPtr(pointer), typeof(GetPebDelegate));
 
                // Invoke the shellcode..
                return func();
            }
            catch
            {
                return IntPtr.Zero;
            }
            finally
            {
                mmva?.Dispose();
                mmf?.Dispose();
            }
        }
 
        /// <summary>
        /// Entry point.
        /// </summary>
        /// <param name="args"></param>
        static void Main(string[] args)
        {
            var peb = GetPeb();
            Console.WriteLine("PEB is located at: {0:X8}", peb.ToInt32());
        }
    }
}

Code

private delegate IntPtr GetPebDelegate();



private static unsafe IntPtr GetPeb()

{

    byte *pCode = null;

    MemoryMappedFile mmf = null;

    MemoryMappedViewAccessor mmva = null;



    var asm = new[]

    {

        new byte[]

        {

            0x64, 0xA1, 0x30, 0x00, 0x00, 0x00, // mov eax, dword ptr fs:30

            0xC3 // ret

        },

        new byte[]

        {

            0x65, 0x48, 0x8B, 0x04, 0x25, 0x60, 0x00, 0x00, 0x00, // mov rax, qword ptr gs:0x60

            0xC3 // ret

        }

    };



    var shellcode = asm[IntPtr.Size / 8];

    RuntimeHelpers.PrepareConstrainedRegions();

    try

    {

        mmf = MemoryMappedFile.CreateNew("__PEB_Address", shellcode.Length, MemoryMappedFileAccess.ReadWriteExecute);

        mmva = mmf.CreateViewAccessor(0, shellcode.Length, MemoryMappedFileAccess.ReadWriteExecute);

        mmva.WriteArray(0, shellcode, 0, shellcode.Length);

        mmva.SafeMemoryMappedViewHandle.AcquirePointer(ref pCode);



        if (pCode != null)

        {

            return ((GetPebDelegate)Marshal.GetDelegateForFunctionPointer(new IntPtr(pCode), typeof(GetPebDelegate)))();

        }

    }

    catch (Exception ex)

    {

        Debug.WriteLine(ex.ToString());

    }

    finally

    {

        if (mmva != null)

        {

            if (pCode != null)

            {

                mmva.SafeMemoryMappedViewHandle.ReleasePointer();

            }

            mmva.Dispose();

        }

        mmf?.Dispose();

    }



    return IntPtr.Zero;

}