DotNetInject icon indicating copy to clipboard operation
DotNetInject copied to clipboard

Code samples of .NET shellcode injections, weaponized for use via WebDav and mshta.exe.

.NET injection PoC

Repository contains code samples weaponized for use with Covenant (https://github.com/cobbr/Covenant) and donut (https://github.com/TheWover/donut) and TikiTorch (https://github.com/rasta-mouse/TikiTorch).

Techniques are partially described under this writing: https://medium.com/@ditrizna/red-team-use-case-of-open-source-weaponization-5b22b0e287a5

Injection that does not relies on RWX right permissions is located under PAYLOAD_INJECT/inject_rw_rx.cs.
Delivery that uses mshta.exe instead of WebDav is located under download_compile_and_exec.hta.

Potential improvements:
* adding an execution methods to PAYLOAD_INJECT samples in order to launch using installutil.exe, regsvr.exe
* adding a persistence already in PAYLOAD EXEC stage