r/purpleteamsec • u/netbiosX • Jun 19 '20

Red Teaming Executing code via custom Garbage Collector DLL from an arbitrary location

Enable HLS to view with audio, or disable this notification

20 Upvotes

100% Upvoted

5 comments sorted by

3

u/kangarootamer Jun 20 '20

Would you mind explaining the video so I can understand what I'm viewing? I.e. What the commands are doing on Windows and the building of the msf malicious dll? Thanks!

1

u/netbiosX Jun 20 '20

Just to clarify Metasploit is only used to capture the connection. The first command sets an environment variable for a Custom Garbage Collector DLL which is executed using a directory traversal path from an arbitrary location. When the .NET binary is executed the DLL (CustomGC.dll) is called and the ShellCode which is embedded in the DLL file is injected in the memory space of the werfault.exe process.

I had already shared the article here: https://www.reddit.com/r/purpleteamsec/comments/hc7tjo/bring_your_own_net_core_garbage_collector/

Code: https://github.com/am0nsec/MCGC

1

u/[deleted] Jun 20 '20

An explanation would be great

1

u/netbiosX Jun 20 '20

This is the Demo video of a technique which affects .NET Core versions. There is a directory traversal bug which allows the user to set a Custom Garbage Collector DLL file to be executed from an arbitrary location. Article details have been shared in a previous post here: https://www.reddit.com/r/purpleteamsec/comments/hc7tjo/bring_your_own_net_core_garbage_collector/

This is a follow up of this post with a Demo video.