Bof Loader implemented

2025-12-11 15:41:44 +01:00
parent e688609c0e
commit 3978a16fab
24 changed files with 2135 additions and 6 deletions
@@ -0,0 +1,109 @@
+# execute_assembly - Execute .NET Assembly in Remote Process
+
+Execute a .NET Assembly in a remote process and retrieve its output.
+
+## Description
+
+The `execute_assembly` command converts a .NET assembly to shellcode using Donut and injects it into a remote process (or the current process if no target is specified). The assembly is executed in the target process and its output is captured and returned.
+
+## Syntax
+
+```
+execute_assembly -Assembly <assembly_file> -Arguments <args>
+```
+
+## Parameters
+
+- `-Assembly` or `assembly_name` (required): Name of an already uploaded .NET assembly (e.g., `SharpUp.exe`)
+- `assembly_file` (required for new uploads): A new .NET assembly file to upload and execute
+- `-Arguments` or `assembly_arguments` (required): Arguments to pass to the assembly
+
+## Examples
+
+```
+# Execute assembly with arguments
+execute_assembly -Assembly SharpUp.exe -Arguments "audit"
+
+# Execute Seatbelt with all checks
+execute_assembly -Assembly Seatbelt.exe -Arguments "all"
+
+# Execute SharpHound for domain enumeration
+execute_assembly -Assembly SharpHound.exe -Arguments "-c All -d domain.local"
+```
+
+## Features
+
+- **Shellcode Conversion**: Automatically converts .NET assemblies to shellcode using Donut
+- **Process Injection**: Injects shellcode into a target process (defaults to current process)
+- **Output Capture**: Captures and returns assembly output
+- **No File System**: Assembly is executed entirely in memory without writing to disk
+
+## How It Works
+
+1. The command retrieves the .NET assembly from Mythic
+2. The assembly is converted to shellcode using Donut
+3. A subtask is created to call `inject_shellcode` with the generated shellcode
+4. The shellcode is injected into the target process
+5. The .NET assembly is loaded and executed in the target process
+6. Output is captured and returned to Mythic
+
+## Output
+
+```
+[execute_assembly] Converting .NET Assembly to Shellcode...
+[execute_assembly] Shellcode generated: 123456 bytes
+[execute_assembly] Injecting shellcode into process...
+[Assembly Output]
+SharpUp execution started...
+[*] Checking for insecure file permissions...
+[+] Found: C:\Program Files\Vulnerable Service\service.exe
+```
+
+## OPSEC Considerations
+
+- **HIGH OPSEC RISK**: Process injection is heavily monitored by EDR/XDR solutions
+- **Shellcode Injection**: Donut shellcode injection may trigger behavioral detections
+- **Process Create Artifact**: Creates a "Process Create" artifact
+- **Memory Scanning**: Injected shellcode may be scanned by EDR memory protection
+- **API Monitoring**: Process injection APIs (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) are monitored
+- **Donut Detection**: Donut shellcode patterns may be detected by advanced security solutions
+
+## Technical Details
+
+### Donut Integration
+
+The command uses Donut to convert .NET assemblies to position-independent shellcode:
+- Automatically handles .NET assembly loading
+- Supports .NET Framework and .NET Core assemblies
+- Generates position-independent shellcode
+- Handles assembly dependencies
+
+### Process Injection
+
+The shellcode injection process:
+1. Shellcode is generated from the .NET assembly
+2. Shellcode is registered as a temporary file in Mythic
+3. `inject_shellcode` command is called via subtask
+4. Shellcode is injected into the target process
+5. Assembly executes and output is captured
+
+## Error Handling
+
+The command handles various error scenarios:
+- **Assembly Not Found**: Returns error if assembly file cannot be retrieved
+- **Donut Conversion Failure**: Returns error if assembly cannot be converted to shellcode
+- **Injection Failure**: Returns error if shellcode cannot be injected
+- **Execution Failure**: Returns error if assembly fails to execute
+
+## Related
+
+- [`inline_execute_assembly`](inline_execute_assembly.md) - Execute .NET assemblies in-process (better OPSEC)
+- [`inline_execute`](inline_execute.md) - Execute BOFs directly
+- [Artifacts Support](../features.md#artifacts-support)
+
+---
+
+**Command Category:** Execution & Control  
+**Requires Admin:** No (unless injecting into protected process)  
+**MITRE ATT&CK:** [T1055 - Process Injection](https://attack.mitre.org/techniques/T1055/), [T1620 - Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)
+