kitos/Angerona
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bof and assemblies completed

Browse Source
This commit is contained in:
marcos.luna
2025-12-16 14:22:51 +01:00
parent e45375cbd5
commit 9351102878
18 changed files with 372 additions and 544 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation-payload/Cazalla/commands.md
+64 -64
View File
@@ -812,6 +812,7 @@ inline_execute -BOF <bof_file> [-Arguments <arguments>]
- `string:hello` or `-z:hello` - Null-terminated string
- `wchar:hello` or `-Z:hello` - Wide character string
- `base64:abc==` or `-b:abc==` - Base64-encoded binary data
- `bytes:hexstring` - Hexadecimal string of bytes
**Examples:**
```
@@ -821,29 +822,37 @@ inline_execute -BOF netstat.x64.o -Arguments int32:4 string:TCP
```
**Features:**
- In-memory execution: BOFs are executed directly in the current process memory without creating new processes
- COFF loader: Full COFF loader implementation supporting x64 BOFs with relocations and symbol resolution
- Beacon API compatibility: Compatible with Cobalt Strike BOF API (BeaconPrintf, BeaconOutput, etc.)
- Output capture: Automatically captures and returns BOF output
- Argument parsing: Supports multiple argument types (int16, int32, string, wchar, base64)
- **In-Memory Execution**: BOFs are executed directly in the current process memory without creating new processes
- **COFF Loader**: Full COFF loader implementation supporting x64 BOFs with relocations and symbol resolution
- **Beacon API Compatibility**: Compatible with Cobalt Strike BOF API (BeaconPrintf, BeaconOutput, etc.)
- **Output Capture**: Automatically captures and returns BOF output via BeaconPrintf/BeaconOutput
- **Argument Parsing**: Supports multiple argument types (int16, int32, string, wchar, base64, bytes)
- **Thread Isolation**: BOFs execute in a separate thread with 30-second timeout to prevent agent crashes
- **Process Create Artifact**: Automatically creates a "Process Create" artifact for tracking
**Output:**
```
[inline_execute] BOF execution requested
[inline_execute] File ID: abc123...
[BOF Output]
Module Name: ntdll.dll
Base Address: 0x7ffa12340000
Size: 0x1f0000
```
**OPSEC Considerations:**
- Process Create artifact: BOF execution creates a "Process Create" artifact that is logged
- Memory allocation: BOFs allocate executable memory which may be detected by EDR solutions
- API hooking: Some EDR solutions monitor API calls that BOFs make
- Symbol resolution: External symbol resolution (LoadLibraryA, GetProcAddress) may be logged
- No new process: Unlike `shell` or `execute_assembly`, BOFs execute in-process, reducing some detection vectors
- **MEDIUM OPSEC RISK**: In-process execution reduces some detection vectors compared to process spawning
- **Process Create Artifact**: BOF execution creates a "Process Create" artifact that is logged in Mythic
- **Memory Allocation**: BOFs allocate executable memory (PAGE_EXECUTE_READWRITE) which may be detected by EDR solutions
- **API Monitoring**: External symbol resolution (LoadLibraryA, GetProcAddress) may be logged by EDR/XDR
- **Memory Scanning**: Allocated executable memory may be scanned by EDR memory protection features
- **No New Process**: Unlike `shell`, BOFs execute in-process, reducing some detection vectors
- **Thread Isolation**: BOFs execute in a separate thread with timeout protection
**Related:** [`inline_execute_assembly`](#inline_execute_assembly---execute-net-assembly-in-process), [`execute_assembly`](#execute_assembly---execute-net-assembly-in-remote-process), [Artifacts Support](features.md#artifacts-support)
**Technical Details:**
- Arguments are serialized using Packer format: `[size:4 bytes LE][data]`
- Boolean values are automatically converted to integers (0 or 1) before serialization
- BOFs that hang will timeout after 30 seconds and output will still be captured
**Related:** [`inline_execute_assembly`](#inline_execute_assembly---execute-net-assembly-in-process), [Artifacts Support](features.md#artifacts-support), [Detailed Documentation](commands/inline_execute.md)
---
@@ -862,7 +871,7 @@ inline_execute_assembly -Assembly <assembly_file> [-Arguments <args>] [--patchex
- `-Arguments` or `assembly_arguments` (optional): Arguments to pass to the assembly
- `--patchexit` or `patch_exit` (optional, default: false): Patch `System.Environment.Exit` to prevent the Beacon process from exiting
- `--amsi` or `amsi` (optional, default: false): Bypass AMSI by patching `clr.dll` instead of `amsi.dll` to avoid common detections
- `--etw` or `etw` (optional, default: false): Bypass ETW by EAT hooking `advapi32.dll!EventWrite`
- `--etw` or `etw` (optional, default: false): Bypass ETW by EAT hooking `advapi32.dll!EventWrite` to point to a function that returns immediately
**Examples:**
```
@@ -872,60 +881,51 @@ inline_execute_assembly -Assembly SharpHound.exe -Arguments "-c All" --patchexit
```
**Features:**
- In-process execution: Executes .NET assemblies in the current process without spawning new processes
- AMSI bypass: Optional AMSI bypass by patching clr.dll (more evasive than patching amsi.dll)
- ETW bypass: Optional ETW bypass via EAT hooking
- Exit patch: Prevents assemblies from calling `System.Environment.Exit` and terminating the agent
- Output capture: Automatically captures and returns assembly output
- BOF-based: Uses the Inline-EA BOF under the hood (executed via `inline_execute`)
- **In-Process Execution**: Executes .NET assemblies in the current process without spawning new processes
- **AMSI Bypass**: Optional AMSI bypass by patching `clr.dll` (more evasive than patching `amsi.dll`)
- **ETW Bypass**: Optional ETW bypass via EAT hooking
- **Exit Patch**: Prevents assemblies from calling `System.Environment.Exit` and terminating the agent
- **Output Capture**: Automatically captures and returns assembly output via completion callback
- **BOF-Based**: Uses the Inline-EA BOF (`inline-ea.x64.o`) under the hood (executed via `inline_execute`)
- **Process Create Artifact**: Automatically creates a "Process Create" artifact for tracking
- **Subtask Integration**: Creates a subtask that calls `inline_execute`, with output aggregated via completion callback
**How It Works:**
1. Retrieves the .NET assembly from Mythic
2. Searches for the Inline-EA BOF (`inline-ea.x64.o`) in Mythic's file store
3. Creates a subtask that calls `inline_execute` with the Inline-EA BOF
4. Passes the .NET assembly as raw bytes (hex-encoded) to the BOF
5. BOF loads the assembly into memory using .NET CLR APIs
6. Optional bypasses (AMSI, ETW) are applied if requested via flags
7. Assembly's entry point is executed with the provided arguments
8. Output is captured via `BeaconPrintf` and returned to the parent task through a completion callback
**Output:**
```
SharpUp execution started...
[*] Checking for insecure file permissions...
[*] Checking for unquoted service paths...
[+] Found: C:\Program Files\Vulnerable Service\service.exe
[*] Completed Privesc Checks in 17 seconds
```
**OPSEC Considerations:**
- Process Create artifact: Assembly execution creates a "Process Create" artifact
- CLR loading: Loading .NET assemblies into memory may be detected by EDR solutions
- AMSI bypass: Patching clr.dll for AMSI bypass may trigger behavioral detections
- ETW bypass: EAT hooking may be detected by advanced EDR solutions
- No new process: Executes in-process, reducing some detection vectors compared to `execute_assembly`
- **MEDIUM OPSEC RISK**: In-process execution provides better OPSEC than process spawning (no process injection)
- **Process Create Artifact**: Assembly execution creates a "Process Create" artifact that is logged in Mythic
- **CLR Loading**: Loading .NET assemblies into memory may be detected by EDR solutions
- **AMSI Bypass**: Patching `clr.dll` for AMSI bypass may trigger behavioral detections (more evasive than patching `amsi.dll`)
- **ETW Bypass**: EAT hooking `advapi32.dll!EventWrite` may be detected by advanced EDR solutions
- **No New Process**: Executes in-process, reducing some detection vectors compared to process spawning
- **Memory Allocation**: Allocates executable memory for the assembly, which may be scanned by EDR
- **Thread Isolation**: BOF execution runs in a separate thread with timeout protection
**Related:** [`inline_execute`](#inline_execute---execute-beacon-object-file-bof), [`execute_assembly`](#execute_assembly---execute-net-assembly-in-remote-process), [Artifacts Support](features.md#artifacts-support)
**Technical Details:**
- Uses Inline-EA BOF developed by @EricEsquivel (https://github.com/EricEsquivel/Inline-EA)
- Boolean flags (`--amsi`, `--etw`, `--patchexit`) are automatically converted to integers (0 or 1) for the BOF
- If BOF execution hangs, it will timeout after 30 seconds and output will still be captured
- Output is aggregated from the subtask and displayed directly in the main command (not as a subtask)
---
### `execute_assembly` - Execute .NET Assembly in Remote Process
Execute a .NET Assembly in a remote process and retrieve its output.
**Syntax:**
```
execute_assembly -Assembly <assembly_file> -Arguments <args>
```
**Parameters:**
- `-Assembly` or `assembly_name` (required): Name of an already uploaded .NET assembly (e.g., `SharpUp.exe`)
- `assembly_file` (required for new uploads): A new .NET assembly file to upload and execute
- `-Arguments` or `assembly_arguments` (required): Arguments to pass to the assembly
**Examples:**
```
execute_assembly -Assembly SharpUp.exe -Arguments "audit"
execute_assembly -Assembly Seatbelt.exe -Arguments "all"
execute_assembly -Assembly SharpHound.exe -Arguments "-c All -d domain.local"
```
**Features:**
- Shellcode conversion: Automatically converts .NET assemblies to shellcode using Donut
- Process injection: Injects shellcode into a target process (defaults to current process)
- Output capture: Captures and returns assembly output
- No file system: Assembly is executed entirely in memory without writing to disk
**OPSEC Considerations:**
- **HIGH OPSEC RISK**: Process injection is heavily monitored by EDR/XDR solutions
- Shellcode injection: Donut shellcode injection may trigger behavioral detections
- Process Create artifact: Creates a "Process Create" artifact
- Memory scanning: Injected shellcode may be scanned by EDR memory protection
- API monitoring: Process injection APIs (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) are monitored
- Donut detection: Donut shellcode patterns may be detected by advanced security solutions
**Related:** [`inline_execute_assembly`](#inline_execute_assembly---execute-net-assembly-in-process) (better OPSEC), [`inline_execute`](#inline_execute---execute-beacon-object-file-bof), [Artifacts Support](features.md#artifacts-support)
**Related:** [`inline_execute`](#inline_execute---execute-beacon-object-file-bof), [Artifacts Support](features.md#artifacts-support), [Detailed Documentation](commands/inline_execute_assembly.md)
---