Bof Loader implemented

2025-12-11 15:41:44 +01:00
parent e688609c0e
commit 3978a16fab
24 changed files with 2135 additions and 6 deletions
@@ -0,0 +1,110 @@
+# inline_execute_assembly - Execute .NET Assembly In-Process
+
+Execute a .NET Assembly in the current process using the Inline-EA BOF (Beacon Object File).
+
+## Description
+
+The `inline_execute_assembly` command executes a .NET assembly directly in the current process memory using the Inline-EA BOF developed by @EricEsquivel. This method loads and executes .NET assemblies without creating new processes, providing better OPSEC than traditional process spawning methods.
+
+## Syntax
+
+```
+inline_execute_assembly -Assembly <assembly_file> [-Arguments <args>] [--patchexit] [--amsi] [--etw]
+```
+
+## Parameters
+
+- `-Assembly` or `assembly_name` (required): Name of an already uploaded .NET assembly (e.g., `SharpUp.exe`)
+- `assembly_file` (required for new uploads): A new .NET assembly file to upload and execute
+- `-Arguments` or `assembly_arguments` (optional): Arguments to pass to the assembly
+- `--patchexit` or `patch_exit` (optional, default: false): Patch `System.Environment.Exit` to prevent the Beacon process from exiting
+- `--amsi` or `amsi` (optional, default: false): Bypass AMSI by patching `clr.dll` instead of `amsi.dll` to avoid common detections
+- `--etw` or `etw` (optional, default: false): Bypass ETW by EAT hooking `advapi32.dll!EventWrite` to point to a function that returns immediately
+
+## Examples
+
+```
+# Execute assembly with arguments
+inline_execute_assembly -Assembly SharpUp.exe -Arguments "audit"
+
+# Execute with AMSI and ETW bypass
+inline_execute_assembly -Assembly Seatbelt.exe -Arguments "all" --amsi --etw
+
+# Execute with all bypasses enabled
+inline_execute_assembly -Assembly SharpHound.exe -Arguments "-c All" --patchexit --amsi --etw
+```
+
+## Features
+
+- **In-Process Execution**: Executes .NET assemblies in the current process without spawning new processes
+- **AMSI Bypass**: Optional AMSI bypass by patching clr.dll (more evasive than patching amsi.dll)
+- **ETW Bypass**: Optional ETW bypass via EAT hooking
+- **Exit Patch**: Prevents assemblies from calling `System.Environment.Exit` and terminating the agent
+- **Output Capture**: Automatically captures and returns assembly output
+- **BOF-Based**: Uses the Inline-EA BOF under the hood (executed via `inline_execute`)
+
+## How It Works
+
+1. The command creates a subtask that calls `inline_execute` with the Inline-EA BOF
+2. The .NET assembly is passed to the BOF as raw bytes
+3. The BOF loads the assembly into memory using .NET CLR APIs
+4. Optional bypasses (AMSI, ETW) are applied if requested
+5. The assembly's entry point is executed with the provided arguments
+6. Output is captured and returned to Mythic
+
+## Output
+
+```
+[inline_execute_assembly] Assembly execution requested
+[BOF Output from Inline-EA]
+SharpUp execution started...
+[*] Checking for insecure file permissions...
+[*] Checking for unquoted service paths...
+[+] Found: C:\Program Files\Vulnerable Service\service.exe
+```
+
+## OPSEC Considerations
+
+- **Process Create Artifact**: Assembly execution creates a "Process Create" artifact
+- **CLR Loading**: Loading .NET assemblies into memory may be detected by EDR solutions
+- **AMSI Bypass**: Patching clr.dll for AMSI bypass may trigger behavioral detections
+- **ETW Bypass**: EAT hooking may be detected by advanced EDR solutions
+- **No New Process**: Executes in-process, reducing some detection vectors compared to `execute_assembly`
+- **Memory Allocation**: Allocates executable memory for the assembly, which may be scanned
+
+## Technical Details
+
+### Inline-EA BOF
+
+This command uses the Inline-EA BOF developed by @EricEsquivel:
+- GitHub: https://github.com/EricEsquivel/Inline-EA
+- Loads .NET assemblies directly into memory
+- Supports AMSI and ETW bypasses
+- Prevents assembly from exiting the process
+
+### Bypass Options
+
+- **--patchexit**: Patches `System.Environment.Exit` to prevent the assembly from terminating the agent process
+- **--amsi**: Bypasses AMSI by patching `clr.dll` instead of `amsi.dll` (more evasive)
+- **--etw**: Bypasses ETW by hooking `advapi32.dll!EventWrite` via Export Address Table (EAT) hooking
+
+## Error Handling
+
+The command handles various error scenarios:
+- **Assembly Not Found**: Returns error if assembly file cannot be retrieved from Mythic
+- **BOF Execution Failure**: Returns error if Inline-EA BOF cannot be executed
+- **Assembly Load Failure**: Returns error if .NET assembly cannot be loaded
+- **Bypass Failure**: May fail silently if bypasses cannot be applied
+
+## Related
+
+- [`inline_execute`](inline_execute.md) - Execute BOFs directly
+- [`execute_assembly`](execute_assembly.md) - Execute .NET assemblies in remote processes
+- [Artifacts Support](../features.md#artifacts-support)
+
+---
+
+**Command Category:** Execution & Control  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1055 - Process Injection](https://attack.mitre.org/techniques/T1055/), [T1620 - Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)
+