mvelazc0/defcon27_csharp_workshop

Writing custom backdoor payloads with C# - Defcon 27 Workshop

Hi there 👋

I'm Mauricio. Currently, I'm a threat researcher at Splunk's Threat Research Team. My areas of focus include detection engineering, threat hunting and adversary simulation.

I (ocassionally) maintain a blog at https://medium.com/@mvelazco/.

I have presented and hosted workshops at conferences including BlackHat Arsenal, Defcon, DerbyCon, BSides, X33fcon, BruCON, Splunk .conf, SANS, MITRE ATT&CKcon, and others. Most of these can be found here: Talks-Presentations.

You can also find me on Twitter and LinkedIn.

---

defcon27_csharp_workshop's Issues

defcon27_csharp_workshop + invoke-obfuscate

Hey i have tested your tool in different payloads and applications and it all went pretty well.. love your work...
so i went one step forward and i used invoke-obfuscate to obfuscate my powershell payload or script... i encoded it to base64 myself (cause its not encoded its only obfuscated)
and i put it into 2.cs "string script = 'encodedblabla' and no errors were displayed while creating and running the exe but no session was created
Like u said i did not specify the "powershell -nop -w 1 -enc ......." only the "......"

wanna say i used venom to create powershell payload and it worked :) but when tried to obfuscate it no session was created :(

if i could use your help thankx you very much :)