[CL1B]

Saw this thread https://hackforums.net/showthread.php?tid=6318965

PE Binding can be approached in numerous ways, but 1 thing: Your payloads have to be clean.

Doesn't have to but you know what I mean.

Here's my 30 minute POC in ++ and #:

• A stub (if you truly care for evasion you can write a real loader. Since payload is clean, not needed that much)
  


• A 16b footer metadata (sizes and magic marker)
  


• When executed, the stub reads itself, extracts the payloads and runs both with current privs
  

The footer at the end allows the stub to locate and extract the bound executables without scanning for marker.

POC

This is barebones don't hate.

C#



++



AV Performance:



For educational purposes only.

[NotYourFriend]

For educational purposes only.

Interesting. In a known crybercrime forum.

[ShellPower]

Still not sure what to do with it, but i will dive deeper later today, thanks for taking the time to answer

[CL1B]

Still not sure what to do with it, but i will dive deeper later today, thanks for taking the time to answer

What do you mean not sure what to do with it?

[ShellPower]

What do you mean not sure what to do with it?

What to do to make this piece of code usable :)

[Hackers]

Interesting. In a known crybercrime forum.

This is not a cybercrime forum, illegal activity is specifically banned. Not sure why people think HackForums is blackhat, we are on clearnet, and a lot of users are only here to research, help provide info for cybersecurity experts to analyze, and create tech.

For example, this PE binder can be used as a whitehat program to combine a main program and its corresponding update-fetcher that might run in background silently. That would be a good quality of life improvement so someone does not need to run 2 programs, which could be too technical for Gen Z or other less savvy users.

---

What to do to make this piece of code usable :)

compile it and then run the command given for exec program 1, 2, and then output.exe

[Endorphins]

This is not a cybercrime forum, illegal activity is specifically banned. Not sure why people think HackForums is blackhat, we are on clearnet, and a lot of users are only here to research, help provide info for cybersecurity experts to analyze, and create tech.

For example, this PE binder can be used as a whitehat program to combine a main program and its corresponding update-fetcher that might run in background silently. That would be a good quality of life improvement so someone does not need to run 2 programs, which could be too technical for Gen Z or other less savvy users.

I think he's mocking this forum as a whole "cry"ber crime. He's basically just trolling.