A POC using a dynamic compiler (CodeDOM) and TCPListener to run in memory and remotely malicius instructions

Evade AV detection using dynamic compiler

• tcp/ip
• http rest
• Unamaged ressources / Managed Ressources

• To compile he can use:
• Roslyn (+4.0 Framework)
• CodeDOM (+2.0 Framework)
• Mono

Run a shellcode msgbox over network from a file appenrently trusted. In my case i have used :

• A TCP Listener on port 444 (Often open in compagny) on the attacker computer
• The C# CodeDOM compiler for most compatibility
• Differents unsafe C# instructions to loading the msgbox shellcode

Detections Ratio

• First try 1/37 (Avira threats found)

• Second try 0/37 (No threats found

• Note: To bypass Avira i have make differents manipulation (Merge assembly, and export sensible code to a library)

• Execute a RunPe fully in memory to run a knowed malware
• Use this network implement to run c# remotely
• Make differents variant of malwares (signature, and polymorph)

I used Protocol Buffer for serialize/deserialize data sended over network. I used System.CodeDom.Compiler to compile C# instructions. I used System.Reflection Namespace to run compiled assembly in memory and evade AV.

• **Quentin Martinez - Initial work

This project is licensed under the MIT License - see the LICENSE.md file for details