Defcon 27 writing custom backdoor payloads with C# workshop

by do son · Published August 23, 2019 · Updated October 10, 2021

Writing custom backdoor payloads with C#

This workshop aims to provide attendees hands-on experience on writing custom backdoor payloads using C# for the most common command and control frameworks including Metasploit, Powershell Empire, and Cobalt Strike. The workshop consists of 7 lab exercises; each of the exercises goes over a different technique that leverages C# and .NET capabilities to obtain a reverse shell on a victim Windows host. The covered techniques include raw shellcode injection, process injection, process hollowing, runtime compilation, parent pid spoofing, antivirus bypassing, etc. At the end of this workshop, attendees will have a clear understanding of these techniques both from an attack and defense perspective.

Skill Level: Intermediate

Prerequisites: Basic to intermediate programming/scripting skills. Prior experience with C# helps but not required.

Materials: Laptop with virtualization software. A Windows 10 virtual machine and a Kali Linux Virtual Machine.

The “Writing custom back payloads with C#” workshop was first presented at Defcon 27.

Labs

Lab 1: Hello World

The goal of this lab is to implement the typical Hello World example with C#. The first exercise uses .NETs Console class to print “Hello World” while the second uses .NETs Platform Invocation Services feature to import and call the Win32 Api MessageBox.

Lab 2: Custom Meterpreter Stager

The goal of this lab is to write a custom Meterpreter stager with C# by leveraging the WebClient class to download meterpreter’s second stage and Win32 API functions to copy the second stage in memory and execute it.

Lab 3: Raw Shellcode Injection

The goal of this lab is to write a custom binary that injects a pre-defined shellcode into memory and executes it. Metasploit’s msfvenom will be used to generate the shellcode and the same Win32 API calls used in Lab 2 will be used to perform the execution.

Lab 4: Shellcode Obfuscation

The goal of this lab is to reduce detection of the custom payloads by signature-based anti-malware. We can achieve this by obfuscating the shellcode generated by msfvenom using two common techniques: XOR and AES

Lab 5: PowerShell without PowerShell.exe

The goal of this lab is to execute a Powershell script and avoid to use the powershell.exe binary by leveraging the .NET framework and C#. Using this technique, we will get a Powershell Empire agent.

Lab 6: DLL Injection

The goal of this lab is to implement the DLL Injection technique using C# and obtain a reverse shell from a victim host. Using 3 different exercises, we will understand and implement the different steps for successful injection.