ayplusllc / D-Pwn

D/Invoke standalone shellcode runners

D-Pwn

Code repository where I can practice AV/EDR evasion with D/Invoke. Since I am not a developer, this is a patchwork of code from different repositories (feel free to optimize it) :

• Osep Code Snippets
• Evasion Practice
• SharpSploit
• DInjector

When trying to load SharpSploit.dll to execute my shellcode with D/Invoke, my app was instantly flagged. Therefore I decided to make it stealthier and standalone.

USAGE

• Generate a shellcode with your favorite C2
• XOR it
• Compile it with your favorite C# compiler
• Call main method with reflection, or launch the .exe
• You can scramble, and obfuscate the code with ConfuserEx

drunner.cs

Simple shellcode runner with D/Invoke

dinject.cs

Process injection technique with D/Invoke

dhollow.cs

Process hollowing with D/Invoke

TODO

• Process hollowing with no env (Token grab + Environment structure) in D/Invoke so it can launch without having a GUI (Perfect for lateral movement)
• Port other and more "stealthier" techniques
• Correct spelling and typos
• Use NT Functions and change DLLs loading technique

DISCLAIMER

This code/project is only for educational/redteam operations purposes. I am not responsible for any illegal use of this code.

!! DO NOT USE VIRUSTOTAL TO TEST THE COMPILED CODE !!