This research has been possibile with the support of Shielder who has sponsored this research with the goal to discover new ways of blend-in within legitimate applications and raise awareness about uncovered sophisticated attack venues, contributing to the security of the digital ecosystem. Shielder invests from 25% to 100% of employees time into Security Research and R&D, whose output can be seen in its advisories and blog. If you like the type of research that is being published, and you would like to uncover unexplored attacks and vulnerabilities, do not hesitate to reach out.
An App Domain Manager Injection
DLL PoC on steroids with a clean Thread Call Stack and no direct WinAPI calls.
More information about this tool can be found in the Let Me Manage Your AppDomain blogpost.
This project already contains a
key.snk
and anenc.bin
msfvenom messagebox payload
- Create a raw format
.bin
shellcode and encrypt it withxor3.py
- Install microsoft SDK and navigate into
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools
- Run
sn.exe -k key.snk
and copy your newkey.snk
to whatever folder you prefer - Open the
DirtyCLR
solution, right click onProject Properties
, selectProperties
, navigate onSigning
and then<Browse...>
to upload yourkey.snk
- Right click again on
Project Properties
, selectAdd
=>Existing Item...
to upload yourenc.bin
- Click on the newly addedd
enc.bin
and in itsProperties
selectEmbedded Resource
from theBuild Action
dropdown menu - Save everything and build
- Casey Smith (@subTee)
- Charles Hamilton (@MrUn1k0d3r)
- Adam Chester (@_xpn_)
- @daem0nc0re
- Dylan Tran (@d_tranman)