+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] Process Hollowing and ShellCode (/showthread.php?tid=6242634)
Process Hollowing and ShellCode - Smoky - May 26, 2023
Hi guys,
I'm currently working on Process Hollowing.
I use among others, NtCreateSection, NtMapViewOfSection, WriteProcessMemory and ResumeThread for this.
The code seems ok because I get a connection on my Meterpreter payload, so far, so good.
My problem occurs as soon as I try with a RAT, Loader or Miner instead of Metasploit, from then on, impossible to inject in the created process, I can see the exe launching in ProcessHacker but it fails systematically.
I think my problem comes either from the injected process, but I've tried with several user processes and it's always the same, it fails, or, what I think is more likely, from the shellcode.
To recover the shellcode, I push my binary into HexEditor(HxD) and import it into C, then recover the Hexadecimal values.
Is my way of retrieving the shellcode is ok, please?
Do you think it could be something other than shellcode?
I can post the code if needed
Thanks in advance ✌
RE: Process Hollowing and ShellCode - SIM-5063966 - May 27, 2023
You can use something like donut to generate shellcode from .NET assemblies & pe2shc to generate shellcode from native executables
If you want to learn more about shellcode loading, you can checkout my [censored] pack!
RE: Process Hollowing and ShellCode - Smoky - May 27, 2023
(May 27, 2023 06:10 AM)WtfIsThis Wrote: You can use something like donut to generate shellcode from .NET assemblies & pe2shc to generate shellcode from native executables
If you want to learn more about shellcode loading, you can checkout my [censored] pack!
Thanks for your answer man :)
Ok, i'll look into Donut.
After solving this problem, I'd also have questions about AV evasion in the runtime, although I also have the Sektor7 courses, maybe one of your e-books could be of interest to me if you treat this with examples in C# as I don't have much knowledge of C or ASM.
I'll be in touch soon in DM
RE: Process Hollowing and ShellCode - PegasoUni - Apr 19, 2024
Hi, can you send me a private message, I would like to ask you something
RE: Process Hollowing and ShellCode - COCKBOT - May 4, 2024
(May 27, 2023 06:10 AM)WtfIsThis Wrote: You can use something like donut to generate shellcode from .NET assemblies & pe2shc to generate shellcode from native executables
If you want to learn more about shellcode loading, you can checkout my [censored] pack!
The second link, pe to shellcode, is what I used a year or so back when implementing runtime monitoring for a bot client I was selling.
15-20 shellcode variations, randomly sent over the wire on session init and mid-session re-negotiations.
I never had any problems with it. It's very useful.