Bof Loader implemented
This commit is contained in:
marcos.luna
@@ -40,7 +40,12 @@ Complete documentation for all Cazalla agent commands, organized by category.
|
||||
- [`screenshot`](screenshot.md) - Capture desktop screenshot
|
||||
- [`keylog_start`](keylog_start.md) - Start keylogger
|
||||
- [`keylog_stop`](keylog_stop.md) - Stop keylogger
|
||||
- [`browser_info`](browser_info.md) - Identify installed browsers
|
||||
|
||||
## Code Execution
|
||||
|
||||
- [`inline_execute`](inline_execute.md) - Execute Beacon Object Files (BOFs)
|
||||
- [`inline_execute_assembly`](inline_execute_assembly.md) - Execute .NET assemblies in-process
|
||||
- [`execute_assembly`](execute_assembly.md) - Execute .NET assemblies in remote processes
|
||||
|
||||
## Control Commands
|
||||
|
||||
|
||||
@@ -0,0 +1,109 @@
|
||||
# execute_assembly - Execute .NET Assembly in Remote Process
|
||||
|
||||
Execute a .NET Assembly in a remote process and retrieve its output.
|
||||
|
||||
## Description
|
||||
|
||||
The `execute_assembly` command converts a .NET assembly to shellcode using Donut and injects it into a remote process (or the current process if no target is specified). The assembly is executed in the target process and its output is captured and returned.
|
||||
|
||||
## Syntax
|
||||
|
||||
```
|
||||
execute_assembly -Assembly <assembly_file> -Arguments <args>
|
||||
```
|
||||
|
||||
## Parameters
|
||||
|
||||
- `-Assembly` or `assembly_name` (required): Name of an already uploaded .NET assembly (e.g., `SharpUp.exe`)
|
||||
- `assembly_file` (required for new uploads): A new .NET assembly file to upload and execute
|
||||
- `-Arguments` or `assembly_arguments` (required): Arguments to pass to the assembly
|
||||
|
||||
## Examples
|
||||
|
||||
```
|
||||
# Execute assembly with arguments
|
||||
execute_assembly -Assembly SharpUp.exe -Arguments "audit"
|
||||
|
||||
# Execute Seatbelt with all checks
|
||||
execute_assembly -Assembly Seatbelt.exe -Arguments "all"
|
||||
|
||||
# Execute SharpHound for domain enumeration
|
||||
execute_assembly -Assembly SharpHound.exe -Arguments "-c All -d domain.local"
|
||||
```
|
||||
|
||||
## Features
|
||||
|
||||
- **Shellcode Conversion**: Automatically converts .NET assemblies to shellcode using Donut
|
||||
- **Process Injection**: Injects shellcode into a target process (defaults to current process)
|
||||
- **Output Capture**: Captures and returns assembly output
|
||||
- **No File System**: Assembly is executed entirely in memory without writing to disk
|
||||
|
||||
## How It Works
|
||||
|
||||
1. The command retrieves the .NET assembly from Mythic
|
||||
2. The assembly is converted to shellcode using Donut
|
||||
3. A subtask is created to call `inject_shellcode` with the generated shellcode
|
||||
4. The shellcode is injected into the target process
|
||||
5. The .NET assembly is loaded and executed in the target process
|
||||
6. Output is captured and returned to Mythic
|
||||
|
||||
## Output
|
||||
|
||||
```
|
||||
[execute_assembly] Converting .NET Assembly to Shellcode...
|
||||
[execute_assembly] Shellcode generated: 123456 bytes
|
||||
[execute_assembly] Injecting shellcode into process...
|
||||
[Assembly Output]
|
||||
SharpUp execution started...
|
||||
[*] Checking for insecure file permissions...
|
||||
[+] Found: C:\Program Files\Vulnerable Service\service.exe
|
||||
```
|
||||
|
||||
## OPSEC Considerations
|
||||
|
||||
- **HIGH OPSEC RISK**: Process injection is heavily monitored by EDR/XDR solutions
|
||||
- **Shellcode Injection**: Donut shellcode injection may trigger behavioral detections
|
||||
- **Process Create Artifact**: Creates a "Process Create" artifact
|
||||
- **Memory Scanning**: Injected shellcode may be scanned by EDR memory protection
|
||||
- **API Monitoring**: Process injection APIs (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) are monitored
|
||||
- **Donut Detection**: Donut shellcode patterns may be detected by advanced security solutions
|
||||
|
||||
## Technical Details
|
||||
|
||||
### Donut Integration
|
||||
|
||||
The command uses Donut to convert .NET assemblies to position-independent shellcode:
|
||||
- Automatically handles .NET assembly loading
|
||||
- Supports .NET Framework and .NET Core assemblies
|
||||
- Generates position-independent shellcode
|
||||
- Handles assembly dependencies
|
||||
|
||||
### Process Injection
|
||||
|
||||
The shellcode injection process:
|
||||
1. Shellcode is generated from the .NET assembly
|
||||
2. Shellcode is registered as a temporary file in Mythic
|
||||
3. `inject_shellcode` command is called via subtask
|
||||
4. Shellcode is injected into the target process
|
||||
5. Assembly executes and output is captured
|
||||
|
||||
## Error Handling
|
||||
|
||||
The command handles various error scenarios:
|
||||
- **Assembly Not Found**: Returns error if assembly file cannot be retrieved
|
||||
- **Donut Conversion Failure**: Returns error if assembly cannot be converted to shellcode
|
||||
- **Injection Failure**: Returns error if shellcode cannot be injected
|
||||
- **Execution Failure**: Returns error if assembly fails to execute
|
||||
|
||||
## Related
|
||||
|
||||
- [`inline_execute_assembly`](inline_execute_assembly.md) - Execute .NET assemblies in-process (better OPSEC)
|
||||
- [`inline_execute`](inline_execute.md) - Execute BOFs directly
|
||||
- [Artifacts Support](../features.md#artifacts-support)
|
||||
|
||||
---
|
||||
|
||||
**Command Category:** Execution & Control
|
||||
**Requires Admin:** No (unless injecting into protected process)
|
||||
**MITRE ATT&CK:** [T1055 - Process Injection](https://attack.mitre.org/techniques/T1055/), [T1620 - Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)
|
||||
|
||||
@@ -0,0 +1,114 @@
|
||||
# inline_execute - Execute Beacon Object File (BOF)
|
||||
|
||||
Execute a Beacon Object File (BOF) in the current process thread and capture its output.
|
||||
|
||||
## Description
|
||||
|
||||
The `inline_execute` command loads and executes a COFF (Common Object File Format) file, commonly known as a Beacon Object File (BOF), directly in the memory of the current process. BOFs are lightweight, position-independent code objects that can be executed without creating new processes, making them useful for stealthy operations.
|
||||
|
||||
## Syntax
|
||||
|
||||
```
|
||||
inline_execute -BOF <bof_file> [-Arguments <arguments>]
|
||||
```
|
||||
|
||||
## Parameters
|
||||
|
||||
- `-BOF` or `bof_name` (required): Name of an already uploaded BOF file (e.g., `whoami.x64.o`)
|
||||
- `bof_file` (required for new uploads): A new BOF file to upload and execute
|
||||
- `-Arguments` or `bof_arguments` (optional): Arguments to pass to the BOF
|
||||
|
||||
### Argument Types
|
||||
|
||||
BOF arguments can be specified using the following format:
|
||||
- `int16:123` or `-s:123` - 16-bit integer
|
||||
- `int32:1234` or `-i:1234` - 32-bit integer
|
||||
- `string:hello` or `-z:hello` - Null-terminated string
|
||||
- `wchar:hello` or `-Z:hello` - Wide character string
|
||||
- `base64:abc==` or `-b:abc==` - Base64-encoded binary data
|
||||
|
||||
## Examples
|
||||
|
||||
```
|
||||
# Execute a BOF with no arguments
|
||||
inline_execute -BOF whoami.x64.o
|
||||
|
||||
# Execute a BOF with integer argument
|
||||
inline_execute -BOF listmods.x64.o -Arguments int32:1234
|
||||
|
||||
# Execute a BOF with multiple arguments
|
||||
inline_execute -BOF netstat.x64.o -Arguments int32:4 string:TCP
|
||||
|
||||
# Upload and execute a new BOF
|
||||
inline_execute -BOF custom_bof.x64.o -Arguments int32:5678
|
||||
```
|
||||
|
||||
## Features
|
||||
|
||||
- **In-Memory Execution**: BOFs are executed directly in the current process memory without creating new processes
|
||||
- **COFF Loader**: Full COFF loader implementation supporting x64 BOFs with relocations and symbol resolution
|
||||
- **Beacon API Compatibility**: Compatible with Cobalt Strike BOF API (BeaconPrintf, BeaconOutput, etc.)
|
||||
- **Output Capture**: Automatically captures and returns BOF output
|
||||
- **Argument Parsing**: Supports multiple argument types (int16, int32, string, wchar, base64)
|
||||
|
||||
## Output
|
||||
|
||||
```
|
||||
[inline_execute] BOF execution requested
|
||||
[inline_execute] File ID: abc123...
|
||||
[inline_execute] Arguments: int32:1234
|
||||
[BOF Output]
|
||||
Module Name: ntdll.dll
|
||||
Base Address: 0x7ffa12340000
|
||||
Size: 0x1f0000
|
||||
```
|
||||
|
||||
## OPSEC Considerations
|
||||
|
||||
- **Process Create Artifact**: BOF execution creates a "Process Create" artifact that is logged
|
||||
- **Memory Allocation**: BOFs allocate executable memory which may be detected by EDR solutions
|
||||
- **API Hooking**: Some EDR solutions monitor API calls that BOFs make
|
||||
- **Symbol Resolution**: External symbol resolution (LoadLibraryA, GetProcAddress) may be logged
|
||||
- **No New Process**: Unlike `shell` or `execute_assembly`, BOFs execute in-process, reducing some detection vectors
|
||||
|
||||
## Technical Details
|
||||
|
||||
### COFF Loader
|
||||
|
||||
The COFF loader implementation:
|
||||
- Supports x64 COFF files (IMAGE_FILE_MACHINE_AMD64)
|
||||
- Handles relocations (IMAGE_REL_AMD64_ADDR64, IMAGE_REL_AMD64_ADDR32NB, IMAGE_REL_AMD64_REL32)
|
||||
- Resolves internal Beacon API functions
|
||||
- Resolves external symbols via LoadLibraryA/GetProcAddress
|
||||
- Maps sections with PAGE_EXECUTE_READWRITE permissions
|
||||
|
||||
### Beacon API Compatibility
|
||||
|
||||
The following Beacon API functions are supported:
|
||||
- `BeaconPrintf` - Formatted output
|
||||
- `BeaconOutput` - Raw output
|
||||
- `BeaconDataParse` - Parse input data
|
||||
- `BeaconDataInt`, `BeaconDataShort`, `BeaconDataExtract` - Data extraction
|
||||
- `BeaconUseToken`, `BeaconRevertToken` - Token manipulation
|
||||
- `BeaconIsAdmin` - Admin check
|
||||
|
||||
## Error Handling
|
||||
|
||||
The command handles various error scenarios:
|
||||
- **File Not Found**: Returns error if BOF file cannot be retrieved from Mythic
|
||||
- **Invalid COFF**: Returns error if file is not a valid COFF or unsupported architecture
|
||||
- **Symbol Resolution Failure**: Warns if external symbols cannot be resolved
|
||||
- **Execution Failure**: Returns error if BOF entry point cannot be found or execution fails
|
||||
|
||||
## Related
|
||||
|
||||
- [`inline_execute_assembly`](inline_execute_assembly.md) - Execute .NET assemblies in-process
|
||||
- [`execute_assembly`](execute_assembly.md) - Execute .NET assemblies in remote processes
|
||||
- [Artifacts Support](../features.md#artifacts-support)
|
||||
|
||||
---
|
||||
|
||||
**Command Category:** Execution & Control
|
||||
**Requires Admin:** No
|
||||
**MITRE ATT&CK:** [T1055 - Process Injection](https://attack.mitre.org/techniques/T1055/)
|
||||
|
||||
@@ -0,0 +1,110 @@
|
||||
# inline_execute_assembly - Execute .NET Assembly In-Process
|
||||
|
||||
Execute a .NET Assembly in the current process using the Inline-EA BOF (Beacon Object File).
|
||||
|
||||
## Description
|
||||
|
||||
The `inline_execute_assembly` command executes a .NET assembly directly in the current process memory using the Inline-EA BOF developed by @EricEsquivel. This method loads and executes .NET assemblies without creating new processes, providing better OPSEC than traditional process spawning methods.
|
||||
|
||||
## Syntax
|
||||
|
||||
```
|
||||
inline_execute_assembly -Assembly <assembly_file> [-Arguments <args>] [--patchexit] [--amsi] [--etw]
|
||||
```
|
||||
|
||||
## Parameters
|
||||
|
||||
- `-Assembly` or `assembly_name` (required): Name of an already uploaded .NET assembly (e.g., `SharpUp.exe`)
|
||||
- `assembly_file` (required for new uploads): A new .NET assembly file to upload and execute
|
||||
- `-Arguments` or `assembly_arguments` (optional): Arguments to pass to the assembly
|
||||
- `--patchexit` or `patch_exit` (optional, default: false): Patch `System.Environment.Exit` to prevent the Beacon process from exiting
|
||||
- `--amsi` or `amsi` (optional, default: false): Bypass AMSI by patching `clr.dll` instead of `amsi.dll` to avoid common detections
|
||||
- `--etw` or `etw` (optional, default: false): Bypass ETW by EAT hooking `advapi32.dll!EventWrite` to point to a function that returns immediately
|
||||
|
||||
## Examples
|
||||
|
||||
```
|
||||
# Execute assembly with arguments
|
||||
inline_execute_assembly -Assembly SharpUp.exe -Arguments "audit"
|
||||
|
||||
# Execute with AMSI and ETW bypass
|
||||
inline_execute_assembly -Assembly Seatbelt.exe -Arguments "all" --amsi --etw
|
||||
|
||||
# Execute with all bypasses enabled
|
||||
inline_execute_assembly -Assembly SharpHound.exe -Arguments "-c All" --patchexit --amsi --etw
|
||||
```
|
||||
|
||||
## Features
|
||||
|
||||
- **In-Process Execution**: Executes .NET assemblies in the current process without spawning new processes
|
||||
- **AMSI Bypass**: Optional AMSI bypass by patching clr.dll (more evasive than patching amsi.dll)
|
||||
- **ETW Bypass**: Optional ETW bypass via EAT hooking
|
||||
- **Exit Patch**: Prevents assemblies from calling `System.Environment.Exit` and terminating the agent
|
||||
- **Output Capture**: Automatically captures and returns assembly output
|
||||
- **BOF-Based**: Uses the Inline-EA BOF under the hood (executed via `inline_execute`)
|
||||
|
||||
## How It Works
|
||||
|
||||
1. The command creates a subtask that calls `inline_execute` with the Inline-EA BOF
|
||||
2. The .NET assembly is passed to the BOF as raw bytes
|
||||
3. The BOF loads the assembly into memory using .NET CLR APIs
|
||||
4. Optional bypasses (AMSI, ETW) are applied if requested
|
||||
5. The assembly's entry point is executed with the provided arguments
|
||||
6. Output is captured and returned to Mythic
|
||||
|
||||
## Output
|
||||
|
||||
```
|
||||
[inline_execute_assembly] Assembly execution requested
|
||||
[BOF Output from Inline-EA]
|
||||
SharpUp execution started...
|
||||
[*] Checking for insecure file permissions...
|
||||
[*] Checking for unquoted service paths...
|
||||
[+] Found: C:\Program Files\Vulnerable Service\service.exe
|
||||
```
|
||||
|
||||
## OPSEC Considerations
|
||||
|
||||
- **Process Create Artifact**: Assembly execution creates a "Process Create" artifact
|
||||
- **CLR Loading**: Loading .NET assemblies into memory may be detected by EDR solutions
|
||||
- **AMSI Bypass**: Patching clr.dll for AMSI bypass may trigger behavioral detections
|
||||
- **ETW Bypass**: EAT hooking may be detected by advanced EDR solutions
|
||||
- **No New Process**: Executes in-process, reducing some detection vectors compared to `execute_assembly`
|
||||
- **Memory Allocation**: Allocates executable memory for the assembly, which may be scanned
|
||||
|
||||
## Technical Details
|
||||
|
||||
### Inline-EA BOF
|
||||
|
||||
This command uses the Inline-EA BOF developed by @EricEsquivel:
|
||||
- GitHub: https://github.com/EricEsquivel/Inline-EA
|
||||
- Loads .NET assemblies directly into memory
|
||||
- Supports AMSI and ETW bypasses
|
||||
- Prevents assembly from exiting the process
|
||||
|
||||
### Bypass Options
|
||||
|
||||
- **--patchexit**: Patches `System.Environment.Exit` to prevent the assembly from terminating the agent process
|
||||
- **--amsi**: Bypasses AMSI by patching `clr.dll` instead of `amsi.dll` (more evasive)
|
||||
- **--etw**: Bypasses ETW by hooking `advapi32.dll!EventWrite` via Export Address Table (EAT) hooking
|
||||
|
||||
## Error Handling
|
||||
|
||||
The command handles various error scenarios:
|
||||
- **Assembly Not Found**: Returns error if assembly file cannot be retrieved from Mythic
|
||||
- **BOF Execution Failure**: Returns error if Inline-EA BOF cannot be executed
|
||||
- **Assembly Load Failure**: Returns error if .NET assembly cannot be loaded
|
||||
- **Bypass Failure**: May fail silently if bypasses cannot be applied
|
||||
|
||||
## Related
|
||||
|
||||
- [`inline_execute`](inline_execute.md) - Execute BOFs directly
|
||||
- [`execute_assembly`](execute_assembly.md) - Execute .NET assemblies in remote processes
|
||||
- [Artifacts Support](../features.md#artifacts-support)
|
||||
|
||||
---
|
||||
|
||||
**Command Category:** Execution & Control
|
||||
**Requires Admin:** No
|
||||
**MITRE ATT&CK:** [T1055 - Process Injection](https://attack.mitre.org/techniques/T1055/), [T1620 - Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)
|
||||
|
||||
Reference in New Issue
Block a user