defcon27_csharp_workshop - Writing custom backdoor payloads with C# - Defcon

项目说明

Writing custom backdoor payloads with C#

This workshop aims to provide attendees hands-on experience on writing custom backdoor payloads using C# for the most common command and control frameworks including Metasploit, Powershell Empire and Cobalt Strike. The workshop consists in 8 lab exercises; each of the exercises goes over a different technique that le C# and .NET capabilities to obtain a reverse shell on a Windows host. The covered techniques include raw shellcode injection, process injection, process hollowing, runtime compilation, parent pid spoofing, antivirus bypassing, etc. At the end of this workshop attendees will have a clear understanding of these techniques both from an attack and defense perspective.

Skill Level: Intermediate

Prerequisites: Basic to intermediate programming/scripting skills. Prior experience with C# helps but not required.

Materials: Laptop with software. A Windows 10 machine and a Kali Linux Machine.

The "Writing custom back payloads with C#" workshop was first presented at Defcon 27.

Authors

* Mauricio - @m

* Olindo -

Labs

Lab 1 : Hello World

The goal of this lab is to implement the typical Hello World example with C#. The first exercise uses .NETs Console class to print “Hello World” while the second uses .NETs Platform In Services feature to import and call the Win32 Api MessageBox.

Lab 2 : Custom Meterpreter Stager

The goal of this lab is to write a custom Meterpreter stager with C# by le the WebClient class to download meterpreter’s second stage and Win32 API functions to copy the second stage in memory and execute it.

Lab 3 : Raw Shellcode Injection

The goal of this lab is to write a custom binary that injects a pre-defined shellcode into memory and executes it. Metasploit’s msfvenom will be used to generate the shellcode and the same Win32 API calls used in Lab 2 will be used to perform the execution.

Lab 4 : Shellcode Obfuscation

The goal of this lab is to reduce detection of the custom payloads by signature based anti-malware. We can achieve this by obfuscating the shellcode generated by msfvenom using two common techniques: XOR and AES

Lab 5 : PowerShell without PowerShell.exe

The goal of this lab is to execute a Powershell script and avoid to use the powershell.exe binary by le the .NET 框架 and C#. Using this technique, we will get a Powershell Empire agent.

Lab 6 : DLL Injection

The goal of this lab is to implement the DLL Injection technique using C# and obtain a reverse shell from a host. Using 3 different exercises, we will understand and implement the different steps for a successful injection.

Lab 7 : Process Hollowing

The goal of this lab is to understand and implement the Process Hollowing technique using C# technique to obtain a reverse shell on a host.

Lab 8 : Parent Process Spoofing

The goal of the final lab is to le C# to spawn a new process spoofing its parent process and inject shellcode to it to obtain a reverse shell.

Acknowledgments

Most of the labs on this workshop started from a Github repository/gist, a Stack O 代码 snippet or a Google search. Thank you to e who shares 代码 for others to learn from.

*
*
*
*
*
*

项目信息

开发语言：C#

Star 数：1194

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Writing custom backdoor payloads with C# - Defcon 27 Workshop展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。