TL;DR - dotnet-memshell is a set of three .NET memory shells at three different insertion positions, delivered as single-file payloads armed by one deserialization.
Most public .NET memory shells (module, handler, route, VirtualPathProvider) sit inside the HTTP request pipeline at well-known positions. dotnet-memshell spreads across three different layers instead.
The three shells
- HttpModuleShell - mounted on the HttpApplication module-event pipeline and triggered by a request carrying an MSH-Cmd header
- WsTakeoverShell - mounted at the HTTP to WebSocket upgrade transition and triggered by a handshake using the msh subprotocol
- RemotingUriShell - registered in the AppDomain-global URI table of an existing Remoting channel and triggered by a remoting call to the channel endpoint
Design properties
- No new listening port - the shells ride the site existing 80/443 or the business channel
- No web.config, registry, or URLACL changes
- No files dropped - payloads are single .cs sources compiled into the deserialization, with the assembly loaded from bytes
- Unmarked traffic passes through untouched - each trigger checks a magic marker first and returns immediately
- Pool coverage through the HttpApplicationFactory free-list broadcast
