Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] C# Shellcode not being executed by Custom Implant #249

Open
M1ck3yS3c opened this issue Aug 7, 2021 · 2 comments
Open

[BUG] C# Shellcode not being executed by Custom Implant #249

M1ck3yS3c opened this issue Aug 7, 2021 · 2 comments
Labels
bug Something isn't working

Comments

@M1ck3yS3c
Copy link

Description

Using Posh_v4_x64_Shellcode.bin in a Dropper leveraging Process Hollowing tradecraft (See file attached below) doesn't return an implant

Execution Environment:

All of this must be filled in
Data | Value
Windows 10 Pro | Version 20H2
PoshC2 | v7.4.0

Implant Info

C# Shellcode | Posh_v4_x64_Shellcode.bin

Defensive Technologies

Windows Defender Deactivated

To Reproduce

Steps to reproduce the behavior:

  1. Compile code using Visual Studio (.Net Version 4.0)
  2. Execute

Expected behavior

Expected an Implant on PoshC2 Client
.

Attach files if required

Program.txt

Additional context

@M1ck3yS3c M1ck3yS3c added the bug Something isn't working label Aug 7, 2021
@benpturner
Copy link
Contributor

Hi, you mentioned C# Implant but have selected the Posh shellcode. Have you tried the Sharp_v4_x64 shellcode varients

@M1ck3yS3c
Copy link
Author

Hello!
I tried using the Sharp_v4_x64 shellcode with the code I shared below and I do not get an implant back.
FYI: Stagefull shellcodes from msfvenom work without any issue using the same code attached.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants