Bof Loader implemented
This commit is contained in:
marcos.luna
@@ -16,6 +16,7 @@ Complete documentation for all Cazalla agent commands.
|
||||
- [Token Operations](#token-operations)
|
||||
- [Network Tunneling](#network-tunneling)
|
||||
- [System Operations](#system-operations)
|
||||
- [Code Execution](#code-execution)
|
||||
- [Control Commands](#control-commands)
|
||||
|
||||
---
|
||||
@@ -789,6 +790,145 @@ desktop-abc\administrator
|
||||
|
||||
---
|
||||
|
||||
## Code Execution
|
||||
|
||||
### `inline_execute` - Execute Beacon Object File (BOF)
|
||||
|
||||
Execute a Beacon Object File (BOF) in the current process thread and capture its output.
|
||||
|
||||
**Syntax:**
|
||||
```
|
||||
inline_execute -BOF <bof_file> [-Arguments <arguments>]
|
||||
```
|
||||
|
||||
**Parameters:**
|
||||
- `-BOF` or `bof_name` (required): Name of an already uploaded BOF file (e.g., `whoami.x64.o`)
|
||||
- `bof_file` (required for new uploads): A new BOF file to upload and execute
|
||||
- `-Arguments` or `bof_arguments` (optional): Arguments to pass to the BOF
|
||||
|
||||
**Argument Types:**
|
||||
- `int16:123` or `-s:123` - 16-bit integer
|
||||
- `int32:1234` or `-i:1234` - 32-bit integer
|
||||
- `string:hello` or `-z:hello` - Null-terminated string
|
||||
- `wchar:hello` or `-Z:hello` - Wide character string
|
||||
- `base64:abc==` or `-b:abc==` - Base64-encoded binary data
|
||||
|
||||
**Examples:**
|
||||
```
|
||||
inline_execute -BOF whoami.x64.o
|
||||
inline_execute -BOF listmods.x64.o -Arguments int32:1234
|
||||
inline_execute -BOF netstat.x64.o -Arguments int32:4 string:TCP
|
||||
```
|
||||
|
||||
**Features:**
|
||||
- In-memory execution: BOFs are executed directly in the current process memory without creating new processes
|
||||
- COFF loader: Full COFF loader implementation supporting x64 BOFs with relocations and symbol resolution
|
||||
- Beacon API compatibility: Compatible with Cobalt Strike BOF API (BeaconPrintf, BeaconOutput, etc.)
|
||||
- Output capture: Automatically captures and returns BOF output
|
||||
- Argument parsing: Supports multiple argument types (int16, int32, string, wchar, base64)
|
||||
|
||||
**Output:**
|
||||
```
|
||||
[inline_execute] BOF execution requested
|
||||
[inline_execute] File ID: abc123...
|
||||
[BOF Output]
|
||||
Module Name: ntdll.dll
|
||||
Base Address: 0x7ffa12340000
|
||||
```
|
||||
|
||||
**OPSEC Considerations:**
|
||||
- Process Create artifact: BOF execution creates a "Process Create" artifact that is logged
|
||||
- Memory allocation: BOFs allocate executable memory which may be detected by EDR solutions
|
||||
- API hooking: Some EDR solutions monitor API calls that BOFs make
|
||||
- Symbol resolution: External symbol resolution (LoadLibraryA, GetProcAddress) may be logged
|
||||
- No new process: Unlike `shell` or `execute_assembly`, BOFs execute in-process, reducing some detection vectors
|
||||
|
||||
**Related:** [`inline_execute_assembly`](#inline_execute_assembly---execute-net-assembly-in-process), [`execute_assembly`](#execute_assembly---execute-net-assembly-in-remote-process), [Artifacts Support](features.md#artifacts-support)
|
||||
|
||||
---
|
||||
|
||||
### `inline_execute_assembly` - Execute .NET Assembly In-Process
|
||||
|
||||
Execute a .NET Assembly in the current process using the Inline-EA BOF (Beacon Object File).
|
||||
|
||||
**Syntax:**
|
||||
```
|
||||
inline_execute_assembly -Assembly <assembly_file> [-Arguments <args>] [--patchexit] [--amsi] [--etw]
|
||||
```
|
||||
|
||||
**Parameters:**
|
||||
- `-Assembly` or `assembly_name` (required): Name of an already uploaded .NET assembly (e.g., `SharpUp.exe`)
|
||||
- `assembly_file` (required for new uploads): A new .NET assembly file to upload and execute
|
||||
- `-Arguments` or `assembly_arguments` (optional): Arguments to pass to the assembly
|
||||
- `--patchexit` or `patch_exit` (optional, default: false): Patch `System.Environment.Exit` to prevent the Beacon process from exiting
|
||||
- `--amsi` or `amsi` (optional, default: false): Bypass AMSI by patching `clr.dll` instead of `amsi.dll` to avoid common detections
|
||||
- `--etw` or `etw` (optional, default: false): Bypass ETW by EAT hooking `advapi32.dll!EventWrite`
|
||||
|
||||
**Examples:**
|
||||
```
|
||||
inline_execute_assembly -Assembly SharpUp.exe -Arguments "audit"
|
||||
inline_execute_assembly -Assembly Seatbelt.exe -Arguments "all" --amsi --etw
|
||||
inline_execute_assembly -Assembly SharpHound.exe -Arguments "-c All" --patchexit --amsi --etw
|
||||
```
|
||||
|
||||
**Features:**
|
||||
- In-process execution: Executes .NET assemblies in the current process without spawning new processes
|
||||
- AMSI bypass: Optional AMSI bypass by patching clr.dll (more evasive than patching amsi.dll)
|
||||
- ETW bypass: Optional ETW bypass via EAT hooking
|
||||
- Exit patch: Prevents assemblies from calling `System.Environment.Exit` and terminating the agent
|
||||
- Output capture: Automatically captures and returns assembly output
|
||||
- BOF-based: Uses the Inline-EA BOF under the hood (executed via `inline_execute`)
|
||||
|
||||
**OPSEC Considerations:**
|
||||
- Process Create artifact: Assembly execution creates a "Process Create" artifact
|
||||
- CLR loading: Loading .NET assemblies into memory may be detected by EDR solutions
|
||||
- AMSI bypass: Patching clr.dll for AMSI bypass may trigger behavioral detections
|
||||
- ETW bypass: EAT hooking may be detected by advanced EDR solutions
|
||||
- No new process: Executes in-process, reducing some detection vectors compared to `execute_assembly`
|
||||
|
||||
**Related:** [`inline_execute`](#inline_execute---execute-beacon-object-file-bof), [`execute_assembly`](#execute_assembly---execute-net-assembly-in-remote-process), [Artifacts Support](features.md#artifacts-support)
|
||||
|
||||
---
|
||||
|
||||
### `execute_assembly` - Execute .NET Assembly in Remote Process
|
||||
|
||||
Execute a .NET Assembly in a remote process and retrieve its output.
|
||||
|
||||
**Syntax:**
|
||||
```
|
||||
execute_assembly -Assembly <assembly_file> -Arguments <args>
|
||||
```
|
||||
|
||||
**Parameters:**
|
||||
- `-Assembly` or `assembly_name` (required): Name of an already uploaded .NET assembly (e.g., `SharpUp.exe`)
|
||||
- `assembly_file` (required for new uploads): A new .NET assembly file to upload and execute
|
||||
- `-Arguments` or `assembly_arguments` (required): Arguments to pass to the assembly
|
||||
|
||||
**Examples:**
|
||||
```
|
||||
execute_assembly -Assembly SharpUp.exe -Arguments "audit"
|
||||
execute_assembly -Assembly Seatbelt.exe -Arguments "all"
|
||||
execute_assembly -Assembly SharpHound.exe -Arguments "-c All -d domain.local"
|
||||
```
|
||||
|
||||
**Features:**
|
||||
- Shellcode conversion: Automatically converts .NET assemblies to shellcode using Donut
|
||||
- Process injection: Injects shellcode into a target process (defaults to current process)
|
||||
- Output capture: Captures and returns assembly output
|
||||
- No file system: Assembly is executed entirely in memory without writing to disk
|
||||
|
||||
**OPSEC Considerations:**
|
||||
- **HIGH OPSEC RISK**: Process injection is heavily monitored by EDR/XDR solutions
|
||||
- Shellcode injection: Donut shellcode injection may trigger behavioral detections
|
||||
- Process Create artifact: Creates a "Process Create" artifact
|
||||
- Memory scanning: Injected shellcode may be scanned by EDR memory protection
|
||||
- API monitoring: Process injection APIs (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) are monitored
|
||||
- Donut detection: Donut shellcode patterns may be detected by advanced security solutions
|
||||
|
||||
**Related:** [`inline_execute_assembly`](#inline_execute_assembly---execute-net-assembly-in-process) (better OPSEC), [`inline_execute`](#inline_execute---execute-beacon-object-file-bof), [Artifacts Support](features.md#artifacts-support)
|
||||
|
||||
---
|
||||
|
||||
### `screenshot` - Capture Screenshot
|
||||
|
||||
Capture a screenshot of the primary desktop display and upload it to the Mythic server.
|
||||
|
||||
Reference in New Issue
Block a user