AH2021Workshop - Malware development for red teaming workshop

项目说明

Malware de workshop.

Welcome to the Malware De workshop for AfricaHackon 2021. In this interacti, we will take a look at the C# language and how to write malware focused on droppers/loaders that will run shellcode on Windows 10 targets that give a meterpreter session back.

The flow of this workshop is building out the code like how virus research looks at Gain of Function. We start off with a simple shellcode runner and build out from there.

> In order to be able to follow the workshop properly, it is highly recommended to go through Lab 0 before the start of the workshop, as this is a setup lab to get you up and ready. You can get it here: Lab0

* Skill Level: Intermediate

* Prerequisites: Basic to intermediate programming/scripting skills. Prior experience with C# helps but not required.

* Materials: Laptop/Desktop with software. A Windows 10 machine and a Kali Linux Machine.

Author:

Labs:

Lab1: Introduction
------
The goal of this lab is to introduce basic C# coding and use of .NETs Platform Invoke (p/invoke) to access the Win32 API. We will also look at how to use System.Reflection.Assembly in powershell to run one of the programs without having to touch disk.

Lab2: Simple shellcode runner
------
The goal of this lab is to be able to create a simple shellcode runner that will execute shellcode generated from msfvenom in csharp format on a Windows 10 device. We will look at the Win32 API calls needed and le p/invoke to achieve this.

Lab3: A and heuristic e
------
The goal of this lab is to enhance the shellcode runner to be able to use some beha tactics to bypass sandbox and A.

Lab4: Simple process injection
------
The goal of this lab is to understand process injection and enhance our shellcode runner to be able to spawn a notepad process and inject into it.

Lab5: RemoteThreadSuspended process injection
------
The goal of this lab is to enhance the Simple process injection code to create memory regions with lower malicious footprint.

Lab6: QueueUserAPC process injection
------
The goal of this lab is to le the Queue Asynchronus Procedure Call to do process injection.

Lab7: Let's bypass userland hooks [EDR]
------
The goal of this lab is to understand what hooking EDRs do on to ntdll.dll to detect use of malicious syscalls and block them. We will rewrite the QueueUserAPC process injection code to dynamically invoke the syscalls using d/invoke and effectively bypass any EDR that uses userland hooks only.

Goals:

Acknowledgments

All the code snippets in this workshop started from a Github repository/gist, a Stack O code snippet or a Google search. Special mention goes out to:

* Mauricio - defcon27_csharp_workshop | Github | Twitter
* Jean Francois Maes - Github | Twitter
* John Tear - Github
* Cas - Github | Twitter
* Chirag Savla - Github | Twitter

项目信息

开发语言：C#

Star 数：229

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Malware development for red teaming workshop展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。