CLR-Persistence

April 17, 2021 ยท View on GitHub

Use CLR to inject all the .NET apps

  • Inspired by @subTee
  • No need Administrator rights
  • Need reboot or log off and re-logon
  • Inject all the .NET apps
  • Support x86 and x64

POC:

Alt text

When the system calls the .Net apps by default, the backdoor triggers automatically.

:D

Alt text

More details:

https://3gstudent.github.io/Use-CLR-to-maintain-persistence