[krayon]

So this method is working flawlessly on windows 7 victims, but on xp home it seems to open up multiple instances of the server and cancels each other out. Ending up in a death loop of services starting and stopping. Any idea why it would keep trying to open the file over and over? I swear RunPE has a mind of its own sometimes.

[South Park]

Now theirs going to be another 100 crypters on the marketplace.

[stoney666]

Thanks man this helped me on my crypter im working on shouldnt be long now there will be a PUBLIC beta and then it will probably go private ill give credits to you and everyone else i need 2.

[L0w hack3r]

nice tut im going to read this later its bit long...🤝

[JIMP]

So this method is working flawlessly on windows 7 victims, but on xp home it seems to open up multiple instances of the server and cancels each other out. Ending up in a death loop of services starting and stopping. Any idea why it would keep trying to open the file over and over? I swear RunPE has a mind of its own sometimes.

i totally agree.

[DeltaNox]

Very nice tutorial. You're the first I've seen actually explain what the parts of the RunPE do, this will be helpful for members wanting to learn and write their own.

[HeXploit]

@$atanrulze

Could you list the service packs and .Net frameworks you have installed, as it could be a incorrect mix you have that's causing you error.

If you want you could PM me and I could help.

Yours,

HeXploit

[JIMP]

I dont think its th prob of .net framework.It works for some exe.

[krayon]

I dont think its th prob of .net framework.It works for some exe.

This is exactly right, after further testing it works fine with dark comet under xp and windows7...and goes ape sh1t with cybergate under xp but fine under win7...it's just the nature of the beast.

[stoney666]

well i cant figure out how to get rid of the avira detection.

[Wind]

well i cant figure out how to get rid of the avira detection.

I've been told all you need to do is change the icon of your .exe.

✌

[stoney666]

I've been told all you need to do is change the icon of your .exe.

✌

ive tried that it dont work.

[imperium]

RunPE ideas:

I bet you the reason it doesn't work on 64-bit is because of this line where it checks the registers (since the processors are structured differently, the apis will work on any processor) I'm just trying to figure out if I'm right and if I can bypass it since it looks like its just checking to see if there are any values in the thread before injecting the byte array.

Code

If H.GetThreadContext(PI.Thread, C) And H.ReadProcessMemory(PI.Process, C.Ebx + 8, Address, 4, 0) >= 0 And H.ZwUnmapViewOfSection(PI.Process, Address) >= 0 Then

Any one familiar with this?

I did something similar in C# that injects shellcode into an existing process and it works on Win7 64 (and 32) since thats what I'm running, I just used the raw api calls, so i'm assuming I can do the same for this. Right now I'm just going through it all and seeing if I should try to convert it or start from scratch based on my program since I use c# not vb.net.
Check out my program shellInjector @ http://imperiumsec.com

[JIMP]

RunPE ideas:

I bet you the reason it doesn't work on 64-bit is because of this line where it checks the registers (since the processors are structured differently, the apis will work on any processor) I'm just trying to figure out if I'm right and if I can bypass it since it looks like its just checking to see if there are any values in the thread before injecting the byte array.

Code

If H.GetThreadContext(PI.Thread, C) And H.ReadProcessMemory(PI.Process, C.Ebx + 8, Address, 4, 0) >= 0 And H.ZwUnmapViewOfSection(PI.Process, Address) >= 0 Then

Any one familiar with this?

I did something similar in C# that injects shellcode into an existing process and it works on Win7 64 (and 32) since thats what I'm running, I just used the raw api calls, so i'm assuming I can do the same for this. Right now I'm just going through it all and seeing if I should try to convert it or start from scratch based on my program since I use c# not vb.net.
Check out my program shellInjector @ http://imperiumsec.com

Can u be more specific bro.I think ur geting to somewhere usefull.

[imperium]

Specifically I'm trying to make it work on a 64bit processors, right now using my own code I can inject shellcode into a process but not start a process from a full pe in 64bit. Going through this runpe module line by line I'm trying to find the areas that are 32-bit specific and the line I posted above is one place that jumps out at me. So I'm asking people who are experienced with this technique of starting a process if they know the areas we can change to make it work on both 32 and 64 bi processors.