bytecode77/r77-rootkit

ControlPipe using Powershell

APT-ZERO opened this issue · 3 comments

APT-ZERO commented

Hi, Is it possible to control r77 using Powershell?

bytecode77 commented

Sure. Since PowerShell allows you to use C#, you have full .NET capabilities. The example I have prodived is in C++, so you have to write it in .NET within PowerShell instead.

  • 👍1
APT-ZERO commented

That is great, but is it possible to control r77 using pure PowerShell 2.0 script/command

bytecode77 commented

I guess you want to avoid a .NET DLL being compiled and written to disk, because in your workflow, you access the control pipe in a fileless manner? ;) I needed to avoid cmdlets, too, in the AMSI bypass. It was a pain...

Anyway, I saw a PS example here that shows code for writing to a named pipe. So it should be entirely possible.

  • ❤️1