Bof Loader implemented
This commit is contained in:
marcos.luna
@@ -16,6 +16,7 @@ Complete documentation for all Cazalla agent commands.
|
||||
- [Token Operations](#token-operations)
|
||||
- [Network Tunneling](#network-tunneling)
|
||||
- [System Operations](#system-operations)
|
||||
- [Code Execution](#code-execution)
|
||||
- [Control Commands](#control-commands)
|
||||
|
||||
---
|
||||
@@ -789,6 +790,145 @@ desktop-abc\administrator
|
||||
|
||||
---
|
||||
|
||||
## Code Execution
|
||||
|
||||
### `inline_execute` - Execute Beacon Object File (BOF)
|
||||
|
||||
Execute a Beacon Object File (BOF) in the current process thread and capture its output.
|
||||
|
||||
**Syntax:**
|
||||
```
|
||||
inline_execute -BOF <bof_file> [-Arguments <arguments>]
|
||||
```
|
||||
|
||||
**Parameters:**
|
||||
- `-BOF` or `bof_name` (required): Name of an already uploaded BOF file (e.g., `whoami.x64.o`)
|
||||
- `bof_file` (required for new uploads): A new BOF file to upload and execute
|
||||
- `-Arguments` or `bof_arguments` (optional): Arguments to pass to the BOF
|
||||
|
||||
**Argument Types:**
|
||||
- `int16:123` or `-s:123` - 16-bit integer
|
||||
- `int32:1234` or `-i:1234` - 32-bit integer
|
||||
- `string:hello` or `-z:hello` - Null-terminated string
|
||||
- `wchar:hello` or `-Z:hello` - Wide character string
|
||||
- `base64:abc==` or `-b:abc==` - Base64-encoded binary data
|
||||
|
||||
**Examples:**
|
||||
```
|
||||
inline_execute -BOF whoami.x64.o
|
||||
inline_execute -BOF listmods.x64.o -Arguments int32:1234
|
||||
inline_execute -BOF netstat.x64.o -Arguments int32:4 string:TCP
|
||||
```
|
||||
|
||||
**Features:**
|
||||
- In-memory execution: BOFs are executed directly in the current process memory without creating new processes
|
||||
- COFF loader: Full COFF loader implementation supporting x64 BOFs with relocations and symbol resolution
|
||||
- Beacon API compatibility: Compatible with Cobalt Strike BOF API (BeaconPrintf, BeaconOutput, etc.)
|
||||
- Output capture: Automatically captures and returns BOF output
|
||||
- Argument parsing: Supports multiple argument types (int16, int32, string, wchar, base64)
|
||||
|
||||
**Output:**
|
||||
```
|
||||
[inline_execute] BOF execution requested
|
||||
[inline_execute] File ID: abc123...
|
||||
[BOF Output]
|
||||
Module Name: ntdll.dll
|
||||
Base Address: 0x7ffa12340000
|
||||
```
|
||||
|
||||
**OPSEC Considerations:**
|
||||
- Process Create artifact: BOF execution creates a "Process Create" artifact that is logged
|
||||
- Memory allocation: BOFs allocate executable memory which may be detected by EDR solutions
|
||||
- API hooking: Some EDR solutions monitor API calls that BOFs make
|
||||
- Symbol resolution: External symbol resolution (LoadLibraryA, GetProcAddress) may be logged
|
||||
- No new process: Unlike `shell` or `execute_assembly`, BOFs execute in-process, reducing some detection vectors
|
||||
|
||||
**Related:** [`inline_execute_assembly`](#inline_execute_assembly---execute-net-assembly-in-process), [`execute_assembly`](#execute_assembly---execute-net-assembly-in-remote-process), [Artifacts Support](features.md#artifacts-support)
|
||||
|
||||
---
|
||||
|
||||
### `inline_execute_assembly` - Execute .NET Assembly In-Process
|
||||
|
||||
Execute a .NET Assembly in the current process using the Inline-EA BOF (Beacon Object File).
|
||||
|
||||
**Syntax:**
|
||||
```
|
||||
inline_execute_assembly -Assembly <assembly_file> [-Arguments <args>] [--patchexit] [--amsi] [--etw]
|
||||
```
|
||||
|
||||
**Parameters:**
|
||||
- `-Assembly` or `assembly_name` (required): Name of an already uploaded .NET assembly (e.g., `SharpUp.exe`)
|
||||
- `assembly_file` (required for new uploads): A new .NET assembly file to upload and execute
|
||||
- `-Arguments` or `assembly_arguments` (optional): Arguments to pass to the assembly
|
||||
- `--patchexit` or `patch_exit` (optional, default: false): Patch `System.Environment.Exit` to prevent the Beacon process from exiting
|
||||
- `--amsi` or `amsi` (optional, default: false): Bypass AMSI by patching `clr.dll` instead of `amsi.dll` to avoid common detections
|
||||
- `--etw` or `etw` (optional, default: false): Bypass ETW by EAT hooking `advapi32.dll!EventWrite`
|
||||
|
||||
**Examples:**
|
||||
```
|
||||
inline_execute_assembly -Assembly SharpUp.exe -Arguments "audit"
|
||||
inline_execute_assembly -Assembly Seatbelt.exe -Arguments "all" --amsi --etw
|
||||
inline_execute_assembly -Assembly SharpHound.exe -Arguments "-c All" --patchexit --amsi --etw
|
||||
```
|
||||
|
||||
**Features:**
|
||||
- In-process execution: Executes .NET assemblies in the current process without spawning new processes
|
||||
- AMSI bypass: Optional AMSI bypass by patching clr.dll (more evasive than patching amsi.dll)
|
||||
- ETW bypass: Optional ETW bypass via EAT hooking
|
||||
- Exit patch: Prevents assemblies from calling `System.Environment.Exit` and terminating the agent
|
||||
- Output capture: Automatically captures and returns assembly output
|
||||
- BOF-based: Uses the Inline-EA BOF under the hood (executed via `inline_execute`)
|
||||
|
||||
**OPSEC Considerations:**
|
||||
- Process Create artifact: Assembly execution creates a "Process Create" artifact
|
||||
- CLR loading: Loading .NET assemblies into memory may be detected by EDR solutions
|
||||
- AMSI bypass: Patching clr.dll for AMSI bypass may trigger behavioral detections
|
||||
- ETW bypass: EAT hooking may be detected by advanced EDR solutions
|
||||
- No new process: Executes in-process, reducing some detection vectors compared to `execute_assembly`
|
||||
|
||||
**Related:** [`inline_execute`](#inline_execute---execute-beacon-object-file-bof), [`execute_assembly`](#execute_assembly---execute-net-assembly-in-remote-process), [Artifacts Support](features.md#artifacts-support)
|
||||
|
||||
---
|
||||
|
||||
### `execute_assembly` - Execute .NET Assembly in Remote Process
|
||||
|
||||
Execute a .NET Assembly in a remote process and retrieve its output.
|
||||
|
||||
**Syntax:**
|
||||
```
|
||||
execute_assembly -Assembly <assembly_file> -Arguments <args>
|
||||
```
|
||||
|
||||
**Parameters:**
|
||||
- `-Assembly` or `assembly_name` (required): Name of an already uploaded .NET assembly (e.g., `SharpUp.exe`)
|
||||
- `assembly_file` (required for new uploads): A new .NET assembly file to upload and execute
|
||||
- `-Arguments` or `assembly_arguments` (required): Arguments to pass to the assembly
|
||||
|
||||
**Examples:**
|
||||
```
|
||||
execute_assembly -Assembly SharpUp.exe -Arguments "audit"
|
||||
execute_assembly -Assembly Seatbelt.exe -Arguments "all"
|
||||
execute_assembly -Assembly SharpHound.exe -Arguments "-c All -d domain.local"
|
||||
```
|
||||
|
||||
**Features:**
|
||||
- Shellcode conversion: Automatically converts .NET assemblies to shellcode using Donut
|
||||
- Process injection: Injects shellcode into a target process (defaults to current process)
|
||||
- Output capture: Captures and returns assembly output
|
||||
- No file system: Assembly is executed entirely in memory without writing to disk
|
||||
|
||||
**OPSEC Considerations:**
|
||||
- **HIGH OPSEC RISK**: Process injection is heavily monitored by EDR/XDR solutions
|
||||
- Shellcode injection: Donut shellcode injection may trigger behavioral detections
|
||||
- Process Create artifact: Creates a "Process Create" artifact
|
||||
- Memory scanning: Injected shellcode may be scanned by EDR memory protection
|
||||
- API monitoring: Process injection APIs (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) are monitored
|
||||
- Donut detection: Donut shellcode patterns may be detected by advanced security solutions
|
||||
|
||||
**Related:** [`inline_execute_assembly`](#inline_execute_assembly---execute-net-assembly-in-process) (better OPSEC), [`inline_execute`](#inline_execute---execute-beacon-object-file-bof), [Artifacts Support](features.md#artifacts-support)
|
||||
|
||||
---
|
||||
|
||||
### `screenshot` - Capture Screenshot
|
||||
|
||||
Capture a screenshot of the primary desktop display and upload it to the Mythic server.
|
||||
|
||||
@@ -40,7 +40,12 @@ Complete documentation for all Cazalla agent commands, organized by category.
|
||||
- [`screenshot`](screenshot.md) - Capture desktop screenshot
|
||||
- [`keylog_start`](keylog_start.md) - Start keylogger
|
||||
- [`keylog_stop`](keylog_stop.md) - Stop keylogger
|
||||
- [`browser_info`](browser_info.md) - Identify installed browsers
|
||||
|
||||
## Code Execution
|
||||
|
||||
- [`inline_execute`](inline_execute.md) - Execute Beacon Object Files (BOFs)
|
||||
- [`inline_execute_assembly`](inline_execute_assembly.md) - Execute .NET assemblies in-process
|
||||
- [`execute_assembly`](execute_assembly.md) - Execute .NET assemblies in remote processes
|
||||
|
||||
## Control Commands
|
||||
|
||||
|
||||
@@ -0,0 +1,109 @@
|
||||
# execute_assembly - Execute .NET Assembly in Remote Process
|
||||
|
||||
Execute a .NET Assembly in a remote process and retrieve its output.
|
||||
|
||||
## Description
|
||||
|
||||
The `execute_assembly` command converts a .NET assembly to shellcode using Donut and injects it into a remote process (or the current process if no target is specified). The assembly is executed in the target process and its output is captured and returned.
|
||||
|
||||
## Syntax
|
||||
|
||||
```
|
||||
execute_assembly -Assembly <assembly_file> -Arguments <args>
|
||||
```
|
||||
|
||||
## Parameters
|
||||
|
||||
- `-Assembly` or `assembly_name` (required): Name of an already uploaded .NET assembly (e.g., `SharpUp.exe`)
|
||||
- `assembly_file` (required for new uploads): A new .NET assembly file to upload and execute
|
||||
- `-Arguments` or `assembly_arguments` (required): Arguments to pass to the assembly
|
||||
|
||||
## Examples
|
||||
|
||||
```
|
||||
# Execute assembly with arguments
|
||||
execute_assembly -Assembly SharpUp.exe -Arguments "audit"
|
||||
|
||||
# Execute Seatbelt with all checks
|
||||
execute_assembly -Assembly Seatbelt.exe -Arguments "all"
|
||||
|
||||
# Execute SharpHound for domain enumeration
|
||||
execute_assembly -Assembly SharpHound.exe -Arguments "-c All -d domain.local"
|
||||
```
|
||||
|
||||
## Features
|
||||
|
||||
- **Shellcode Conversion**: Automatically converts .NET assemblies to shellcode using Donut
|
||||
- **Process Injection**: Injects shellcode into a target process (defaults to current process)
|
||||
- **Output Capture**: Captures and returns assembly output
|
||||
- **No File System**: Assembly is executed entirely in memory without writing to disk
|
||||
|
||||
## How It Works
|
||||
|
||||
1. The command retrieves the .NET assembly from Mythic
|
||||
2. The assembly is converted to shellcode using Donut
|
||||
3. A subtask is created to call `inject_shellcode` with the generated shellcode
|
||||
4. The shellcode is injected into the target process
|
||||
5. The .NET assembly is loaded and executed in the target process
|
||||
6. Output is captured and returned to Mythic
|
||||
|
||||
## Output
|
||||
|
||||
```
|
||||
[execute_assembly] Converting .NET Assembly to Shellcode...
|
||||
[execute_assembly] Shellcode generated: 123456 bytes
|
||||
[execute_assembly] Injecting shellcode into process...
|
||||
[Assembly Output]
|
||||
SharpUp execution started...
|
||||
[*] Checking for insecure file permissions...
|
||||
[+] Found: C:\Program Files\Vulnerable Service\service.exe
|
||||
```
|
||||
|
||||
## OPSEC Considerations
|
||||
|
||||
- **HIGH OPSEC RISK**: Process injection is heavily monitored by EDR/XDR solutions
|
||||
- **Shellcode Injection**: Donut shellcode injection may trigger behavioral detections
|
||||
- **Process Create Artifact**: Creates a "Process Create" artifact
|
||||
- **Memory Scanning**: Injected shellcode may be scanned by EDR memory protection
|
||||
- **API Monitoring**: Process injection APIs (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) are monitored
|
||||
- **Donut Detection**: Donut shellcode patterns may be detected by advanced security solutions
|
||||
|
||||
## Technical Details
|
||||
|
||||
### Donut Integration
|
||||
|
||||
The command uses Donut to convert .NET assemblies to position-independent shellcode:
|
||||
- Automatically handles .NET assembly loading
|
||||
- Supports .NET Framework and .NET Core assemblies
|
||||
- Generates position-independent shellcode
|
||||
- Handles assembly dependencies
|
||||
|
||||
### Process Injection
|
||||
|
||||
The shellcode injection process:
|
||||
1. Shellcode is generated from the .NET assembly
|
||||
2. Shellcode is registered as a temporary file in Mythic
|
||||
3. `inject_shellcode` command is called via subtask
|
||||
4. Shellcode is injected into the target process
|
||||
5. Assembly executes and output is captured
|
||||
|
||||
## Error Handling
|
||||
|
||||
The command handles various error scenarios:
|
||||
- **Assembly Not Found**: Returns error if assembly file cannot be retrieved
|
||||
- **Donut Conversion Failure**: Returns error if assembly cannot be converted to shellcode
|
||||
- **Injection Failure**: Returns error if shellcode cannot be injected
|
||||
- **Execution Failure**: Returns error if assembly fails to execute
|
||||
|
||||
## Related
|
||||
|
||||
- [`inline_execute_assembly`](inline_execute_assembly.md) - Execute .NET assemblies in-process (better OPSEC)
|
||||
- [`inline_execute`](inline_execute.md) - Execute BOFs directly
|
||||
- [Artifacts Support](../features.md#artifacts-support)
|
||||
|
||||
---
|
||||
|
||||
**Command Category:** Execution & Control
|
||||
**Requires Admin:** No (unless injecting into protected process)
|
||||
**MITRE ATT&CK:** [T1055 - Process Injection](https://attack.mitre.org/techniques/T1055/), [T1620 - Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)
|
||||
|
||||
@@ -0,0 +1,114 @@
|
||||
# inline_execute - Execute Beacon Object File (BOF)
|
||||
|
||||
Execute a Beacon Object File (BOF) in the current process thread and capture its output.
|
||||
|
||||
## Description
|
||||
|
||||
The `inline_execute` command loads and executes a COFF (Common Object File Format) file, commonly known as a Beacon Object File (BOF), directly in the memory of the current process. BOFs are lightweight, position-independent code objects that can be executed without creating new processes, making them useful for stealthy operations.
|
||||
|
||||
## Syntax
|
||||
|
||||
```
|
||||
inline_execute -BOF <bof_file> [-Arguments <arguments>]
|
||||
```
|
||||
|
||||
## Parameters
|
||||
|
||||
- `-BOF` or `bof_name` (required): Name of an already uploaded BOF file (e.g., `whoami.x64.o`)
|
||||
- `bof_file` (required for new uploads): A new BOF file to upload and execute
|
||||
- `-Arguments` or `bof_arguments` (optional): Arguments to pass to the BOF
|
||||
|
||||
### Argument Types
|
||||
|
||||
BOF arguments can be specified using the following format:
|
||||
- `int16:123` or `-s:123` - 16-bit integer
|
||||
- `int32:1234` or `-i:1234` - 32-bit integer
|
||||
- `string:hello` or `-z:hello` - Null-terminated string
|
||||
- `wchar:hello` or `-Z:hello` - Wide character string
|
||||
- `base64:abc==` or `-b:abc==` - Base64-encoded binary data
|
||||
|
||||
## Examples
|
||||
|
||||
```
|
||||
# Execute a BOF with no arguments
|
||||
inline_execute -BOF whoami.x64.o
|
||||
|
||||
# Execute a BOF with integer argument
|
||||
inline_execute -BOF listmods.x64.o -Arguments int32:1234
|
||||
|
||||
# Execute a BOF with multiple arguments
|
||||
inline_execute -BOF netstat.x64.o -Arguments int32:4 string:TCP
|
||||
|
||||
# Upload and execute a new BOF
|
||||
inline_execute -BOF custom_bof.x64.o -Arguments int32:5678
|
||||
```
|
||||
|
||||
## Features
|
||||
|
||||
- **In-Memory Execution**: BOFs are executed directly in the current process memory without creating new processes
|
||||
- **COFF Loader**: Full COFF loader implementation supporting x64 BOFs with relocations and symbol resolution
|
||||
- **Beacon API Compatibility**: Compatible with Cobalt Strike BOF API (BeaconPrintf, BeaconOutput, etc.)
|
||||
- **Output Capture**: Automatically captures and returns BOF output
|
||||
- **Argument Parsing**: Supports multiple argument types (int16, int32, string, wchar, base64)
|
||||
|
||||
## Output
|
||||
|
||||
```
|
||||
[inline_execute] BOF execution requested
|
||||
[inline_execute] File ID: abc123...
|
||||
[inline_execute] Arguments: int32:1234
|
||||
[BOF Output]
|
||||
Module Name: ntdll.dll
|
||||
Base Address: 0x7ffa12340000
|
||||
Size: 0x1f0000
|
||||
```
|
||||
|
||||
## OPSEC Considerations
|
||||
|
||||
- **Process Create Artifact**: BOF execution creates a "Process Create" artifact that is logged
|
||||
- **Memory Allocation**: BOFs allocate executable memory which may be detected by EDR solutions
|
||||
- **API Hooking**: Some EDR solutions monitor API calls that BOFs make
|
||||
- **Symbol Resolution**: External symbol resolution (LoadLibraryA, GetProcAddress) may be logged
|
||||
- **No New Process**: Unlike `shell` or `execute_assembly`, BOFs execute in-process, reducing some detection vectors
|
||||
|
||||
## Technical Details
|
||||
|
||||
### COFF Loader
|
||||
|
||||
The COFF loader implementation:
|
||||
- Supports x64 COFF files (IMAGE_FILE_MACHINE_AMD64)
|
||||
- Handles relocations (IMAGE_REL_AMD64_ADDR64, IMAGE_REL_AMD64_ADDR32NB, IMAGE_REL_AMD64_REL32)
|
||||
- Resolves internal Beacon API functions
|
||||
- Resolves external symbols via LoadLibraryA/GetProcAddress
|
||||
- Maps sections with PAGE_EXECUTE_READWRITE permissions
|
||||
|
||||
### Beacon API Compatibility
|
||||
|
||||
The following Beacon API functions are supported:
|
||||
- `BeaconPrintf` - Formatted output
|
||||
- `BeaconOutput` - Raw output
|
||||
- `BeaconDataParse` - Parse input data
|
||||
- `BeaconDataInt`, `BeaconDataShort`, `BeaconDataExtract` - Data extraction
|
||||
- `BeaconUseToken`, `BeaconRevertToken` - Token manipulation
|
||||
- `BeaconIsAdmin` - Admin check
|
||||
|
||||
## Error Handling
|
||||
|
||||
The command handles various error scenarios:
|
||||
- **File Not Found**: Returns error if BOF file cannot be retrieved from Mythic
|
||||
- **Invalid COFF**: Returns error if file is not a valid COFF or unsupported architecture
|
||||
- **Symbol Resolution Failure**: Warns if external symbols cannot be resolved
|
||||
- **Execution Failure**: Returns error if BOF entry point cannot be found or execution fails
|
||||
|
||||
## Related
|
||||
|
||||
- [`inline_execute_assembly`](inline_execute_assembly.md) - Execute .NET assemblies in-process
|
||||
- [`execute_assembly`](execute_assembly.md) - Execute .NET assemblies in remote processes
|
||||
- [Artifacts Support](../features.md#artifacts-support)
|
||||
|
||||
---
|
||||
|
||||
**Command Category:** Execution & Control
|
||||
**Requires Admin:** No
|
||||
**MITRE ATT&CK:** [T1055 - Process Injection](https://attack.mitre.org/techniques/T1055/)
|
||||
|
||||
@@ -0,0 +1,110 @@
|
||||
# inline_execute_assembly - Execute .NET Assembly In-Process
|
||||
|
||||
Execute a .NET Assembly in the current process using the Inline-EA BOF (Beacon Object File).
|
||||
|
||||
## Description
|
||||
|
||||
The `inline_execute_assembly` command executes a .NET assembly directly in the current process memory using the Inline-EA BOF developed by @EricEsquivel. This method loads and executes .NET assemblies without creating new processes, providing better OPSEC than traditional process spawning methods.
|
||||
|
||||
## Syntax
|
||||
|
||||
```
|
||||
inline_execute_assembly -Assembly <assembly_file> [-Arguments <args>] [--patchexit] [--amsi] [--etw]
|
||||
```
|
||||
|
||||
## Parameters
|
||||
|
||||
- `-Assembly` or `assembly_name` (required): Name of an already uploaded .NET assembly (e.g., `SharpUp.exe`)
|
||||
- `assembly_file` (required for new uploads): A new .NET assembly file to upload and execute
|
||||
- `-Arguments` or `assembly_arguments` (optional): Arguments to pass to the assembly
|
||||
- `--patchexit` or `patch_exit` (optional, default: false): Patch `System.Environment.Exit` to prevent the Beacon process from exiting
|
||||
- `--amsi` or `amsi` (optional, default: false): Bypass AMSI by patching `clr.dll` instead of `amsi.dll` to avoid common detections
|
||||
- `--etw` or `etw` (optional, default: false): Bypass ETW by EAT hooking `advapi32.dll!EventWrite` to point to a function that returns immediately
|
||||
|
||||
## Examples
|
||||
|
||||
```
|
||||
# Execute assembly with arguments
|
||||
inline_execute_assembly -Assembly SharpUp.exe -Arguments "audit"
|
||||
|
||||
# Execute with AMSI and ETW bypass
|
||||
inline_execute_assembly -Assembly Seatbelt.exe -Arguments "all" --amsi --etw
|
||||
|
||||
# Execute with all bypasses enabled
|
||||
inline_execute_assembly -Assembly SharpHound.exe -Arguments "-c All" --patchexit --amsi --etw
|
||||
```
|
||||
|
||||
## Features
|
||||
|
||||
- **In-Process Execution**: Executes .NET assemblies in the current process without spawning new processes
|
||||
- **AMSI Bypass**: Optional AMSI bypass by patching clr.dll (more evasive than patching amsi.dll)
|
||||
- **ETW Bypass**: Optional ETW bypass via EAT hooking
|
||||
- **Exit Patch**: Prevents assemblies from calling `System.Environment.Exit` and terminating the agent
|
||||
- **Output Capture**: Automatically captures and returns assembly output
|
||||
- **BOF-Based**: Uses the Inline-EA BOF under the hood (executed via `inline_execute`)
|
||||
|
||||
## How It Works
|
||||
|
||||
1. The command creates a subtask that calls `inline_execute` with the Inline-EA BOF
|
||||
2. The .NET assembly is passed to the BOF as raw bytes
|
||||
3. The BOF loads the assembly into memory using .NET CLR APIs
|
||||
4. Optional bypasses (AMSI, ETW) are applied if requested
|
||||
5. The assembly's entry point is executed with the provided arguments
|
||||
6. Output is captured and returned to Mythic
|
||||
|
||||
## Output
|
||||
|
||||
```
|
||||
[inline_execute_assembly] Assembly execution requested
|
||||
[BOF Output from Inline-EA]
|
||||
SharpUp execution started...
|
||||
[*] Checking for insecure file permissions...
|
||||
[*] Checking for unquoted service paths...
|
||||
[+] Found: C:\Program Files\Vulnerable Service\service.exe
|
||||
```
|
||||
|
||||
## OPSEC Considerations
|
||||
|
||||
- **Process Create Artifact**: Assembly execution creates a "Process Create" artifact
|
||||
- **CLR Loading**: Loading .NET assemblies into memory may be detected by EDR solutions
|
||||
- **AMSI Bypass**: Patching clr.dll for AMSI bypass may trigger behavioral detections
|
||||
- **ETW Bypass**: EAT hooking may be detected by advanced EDR solutions
|
||||
- **No New Process**: Executes in-process, reducing some detection vectors compared to `execute_assembly`
|
||||
- **Memory Allocation**: Allocates executable memory for the assembly, which may be scanned
|
||||
|
||||
## Technical Details
|
||||
|
||||
### Inline-EA BOF
|
||||
|
||||
This command uses the Inline-EA BOF developed by @EricEsquivel:
|
||||
- GitHub: https://github.com/EricEsquivel/Inline-EA
|
||||
- Loads .NET assemblies directly into memory
|
||||
- Supports AMSI and ETW bypasses
|
||||
- Prevents assembly from exiting the process
|
||||
|
||||
### Bypass Options
|
||||
|
||||
- **--patchexit**: Patches `System.Environment.Exit` to prevent the assembly from terminating the agent process
|
||||
- **--amsi**: Bypasses AMSI by patching `clr.dll` instead of `amsi.dll` (more evasive)
|
||||
- **--etw**: Bypasses ETW by hooking `advapi32.dll!EventWrite` via Export Address Table (EAT) hooking
|
||||
|
||||
## Error Handling
|
||||
|
||||
The command handles various error scenarios:
|
||||
- **Assembly Not Found**: Returns error if assembly file cannot be retrieved from Mythic
|
||||
- **BOF Execution Failure**: Returns error if Inline-EA BOF cannot be executed
|
||||
- **Assembly Load Failure**: Returns error if .NET assembly cannot be loaded
|
||||
- **Bypass Failure**: May fail silently if bypasses cannot be applied
|
||||
|
||||
## Related
|
||||
|
||||
- [`inline_execute`](inline_execute.md) - Execute BOFs directly
|
||||
- [`execute_assembly`](execute_assembly.md) - Execute .NET assemblies in remote processes
|
||||
- [Artifacts Support](../features.md#artifacts-support)
|
||||
|
||||
---
|
||||
|
||||
**Command Category:** Execution & Control
|
||||
**Requires Admin:** No
|
||||
**MITRE ATT&CK:** [T1055 - Process Injection](https://attack.mitre.org/techniques/T1055/), [T1620 - Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)
|
||||
|
||||
@@ -153,6 +153,9 @@ Cazalla automatically reports artifacts created during command execution, allowi
|
||||
| Artifact Type | Commands | Description |
|
||||
|--------------|----------|-------------|
|
||||
| **Process Create** | `shell` | Command execution via cmd.exe |
|
||||
| **Process Create** | `inline_execute` | BOF execution in current process |
|
||||
| **Process Create** | `inline_execute_assembly` | .NET assembly execution in-process |
|
||||
| **Process Create** | `execute_assembly` | .NET assembly execution via process injection |
|
||||
| **File Write** | `cp`, `mkdir`, `upload` | File creation or modification |
|
||||
| **File Delete** | `rm` | File or directory deletion |
|
||||
| **File Read** | `download` | File download operations |
|
||||
|
||||
@@ -78,6 +78,7 @@ These commands are **highly detectable** and require careful consideration:
|
||||
| Command | Risk Level | Detection Likelihood | Alternatives |
|
||||
|---------|-----------|---------------------|--------------|
|
||||
| `shell` | HIGH | High (cmd.exe spawn) | Use built-in Cazalla commands when possible |
|
||||
| `execute_assembly` | HIGH | High (process injection, Donut shellcode) | `inline_execute_assembly` for in-process execution |
|
||||
| `steal_token` | HIGH | High (EDR/XDR monitoring) | `make_token` when credentials available |
|
||||
| `rm` (system files) | HIGH | Blocked for safety | Never delete system files |
|
||||
| `screenshot` | HIGH | Screen capture detection | Use sparingly, consider timing |
|
||||
@@ -88,6 +89,8 @@ These commands have **moderate detection risk**:
|
||||
|
||||
| Command | Risk Level | Detection Likelihood | Notes |
|
||||
|---------|-----------|---------------------|-------|
|
||||
| `inline_execute` | MEDIUM | Memory allocation, API calls | In-process execution reduces some detection vectors |
|
||||
| `inline_execute_assembly` | MEDIUM | CLR loading, memory allocation | Better OPSEC than `execute_assembly` (no process injection) |
|
||||
| `download` | MEDIUM | File access logging | Large files may trigger DLP |
|
||||
| `upload` | MEDIUM | File write detection | Suspicious extensions monitored |
|
||||
| `socks` | MEDIUM | Network traffic analysis | High bandwidth usage |
|
||||
@@ -115,6 +118,9 @@ These commands have **low detection risk**:
|
||||
**Endpoint Detection and Response (EDR)** and **Extended Detection and Response (XDR)** solutions monitor:
|
||||
|
||||
- **Process Creation**: `shell` command spawns `cmd.exe` (highly monitored)
|
||||
- **Process Injection**: `execute_assembly` uses Donut shellcode injection (heavily monitored)
|
||||
- **Memory Allocation**: `inline_execute` and `inline_execute_assembly` allocate executable memory (may be scanned)
|
||||
- **CLR Loading**: Loading .NET assemblies into memory may trigger EDR detections
|
||||
- **Token Manipulation**: `steal_token` and `make_token` generate authentication events
|
||||
- **Memory Access**: Accessing LSASS memory triggers high-priority alerts
|
||||
- **API Hooking**: Keyloggers and screen capture use monitored APIs
|
||||
@@ -122,6 +128,8 @@ These commands have **low detection risk**:
|
||||
|
||||
**Mitigation Strategies:**
|
||||
- Use built-in Cazalla commands instead of `shell` when possible
|
||||
- Prefer `inline_execute_assembly` over `execute_assembly` for better OPSEC (in-process vs process injection)
|
||||
- Use `inline_execute` for BOFs when possible (no process creation)
|
||||
- Prefer `make_token` over `steal_token` when credentials are available
|
||||
- Avoid accessing LSASS or other critical system processes
|
||||
- Use keylogging only when absolutely necessary
|
||||
@@ -321,6 +329,23 @@ Built-in Cazalla commands:
|
||||
- **Detection**: Authentication event logging
|
||||
- **Best Practice**: Less detectable than `steal_token`, use when credentials available
|
||||
|
||||
### Code Execution Commands
|
||||
|
||||
#### `inline_execute`
|
||||
- **Risk**: MEDIUM
|
||||
- **Detection**: Memory allocation (executable pages), API calls (LoadLibraryA, GetProcAddress), symbol resolution
|
||||
- **Best Practice**: In-process execution reduces detection vectors compared to process spawning. Use for lightweight operations.
|
||||
|
||||
#### `inline_execute_assembly`
|
||||
- **Risk**: MEDIUM
|
||||
- **Detection**: CLR loading, memory allocation, AMSI/ETW bypass attempts may trigger behavioral detections
|
||||
- **Best Practice**: Better OPSEC than `execute_assembly` (no process injection). Use `--amsi` and `--etw` flags when needed, but be aware they may be detected.
|
||||
|
||||
#### `execute_assembly`
|
||||
- **Risk**: HIGH
|
||||
- **Detection**: Process injection (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread), Donut shellcode patterns, memory scanning
|
||||
- **Best Practice**: Use only when necessary. Prefer `inline_execute_assembly` for better OPSEC. High detection risk due to process injection techniques.
|
||||
|
||||
#### `rev2self`
|
||||
- **Risk**: LOW
|
||||
- **Detection**: Minimal
|
||||
|
||||
Reference in New Issue
Block a user