Introduction to Windows Evasion Techniques

Stuck at Static Analysis Lab. In the target machine there is no C:\Tools folder (esclusion) so I can’t compile my script because it immediately get detected. How did you guys managed to transfer the NotMalware file to the target machine ? Thanks.

UPDATE: I have successfully managed to compile the cs file and evaded the detection (as confirmed in the log.txt file) but no flag.txt file is created. Anybody can help ? thanks.

UPDATE: I have really made sure that everything works properly on my machine, and re-generated the correct shellcode fot htb machine. But nonetheless the file flag.txt will not appear.

1 Like

I had the same problem a couple of days ago. Contacted support and they couldn’t test it at the time due to problem with RDP.
You can DM me and I’ll tell you some stuff to check.

Same problem here.
All checks passed, still no flag.txt created

I have the same issue. Is anyone on the HTB team interested in fixing these bugs?

I had the same problem. I fixed it by changing the way I compiled it. Originally I compiled from the terminal. Then I switched to visual studio and made sure to publish, selecting win-x64 and ‘produce single file’, and then get the file from the listed publish location.

I talked with an HTB helper and he mentioned that the payload shouldn’t have newlines in it, otherwise the sed command -likely used in the process checking our code, would not find all the contents in curly braces. That was not my problem but is something to look out for as well.

1 Like

i solved too but this lab is annoying as f… full of bugs. RDP loosing connection very often, log.txt that disappears for minutes. I tried to contact the support and people was absolutey out of world. Quality of HTB support is going down, my 2cents

I’ve been running into lots of problems in this lab. This is the only question about the Windows Evasion module so I haven’t seen much help in the forum. I might ask some questions though. If you figured out the InstallUtil section I have a question about that.
Introduction to Windows Evasion: LOLBAS: InstallUtil, The module was expected to contain an assembly manifest - HTB Content - Hack The Box :: Forums

1 Like