inline_execute_assembly - Execute .NET Assembly In-Process

Execute a .NET Assembly in the current process using the Inline-EA BOF (Beacon Object File).

Description

The inline_execute_assembly command executes a .NET assembly directly in the current process memory using the Inline-EA BOF developed by @EricEsquivel. This method loads and executes .NET assemblies without creating new processes, providing better OPSEC than traditional process spawning methods.

Syntax

inline_execute_assembly -Assembly <assembly_file> [-Arguments <args>] [--patchexit] [--amsi] [--etw]

Parameters

-Assembly or assembly_name (required): Name of an already uploaded .NET assembly (e.g., SharpUp.exe)
assembly_file (required for new uploads): A new .NET assembly file to upload and execute
-Arguments or assembly_arguments (optional): Arguments to pass to the assembly
--patchexit or patch_exit (optional, default: false): Patch System.Environment.Exit to prevent the Beacon process from exiting
--amsi or amsi (optional, default: false): Bypass AMSI by patching clr.dll instead of amsi.dll to avoid common detections
--etw or etw (optional, default: false): Bypass ETW by EAT hooking advapi32.dll!EventWrite to point to a function that returns immediately

Examples

# Execute assembly with arguments
inline_execute_assembly -Assembly SharpUp.exe -Arguments "audit"

# Execute with AMSI and ETW bypass
inline_execute_assembly -Assembly Seatbelt.exe -Arguments "all" --amsi --etw

# Execute with all bypasses enabled
inline_execute_assembly -Assembly SharpHound.exe -Arguments "-c All" --patchexit --amsi --etw

Features

In-Process Execution: Executes .NET assemblies in the current process without spawning new processes
AMSI Bypass: Optional AMSI bypass by patching clr.dll (more evasive than patching amsi.dll)
ETW Bypass: Optional ETW bypass via EAT hooking
Exit Patch: Prevents assemblies from calling System.Environment.Exit and terminating the agent
Output Capture: Automatically captures and returns assembly output
BOF-Based: Uses the Inline-EA BOF under the hood (executed via inline_execute)

How It Works

The command retrieves the .NET assembly from Mythic
The command searches for the Inline-EA BOF (inline-ea.x64.o) in Mythic's file store
A subtask is created that calls inline_execute with the Inline-EA BOF
The .NET assembly is passed to the BOF as raw bytes (hex-encoded)
The BOF loads the assembly into memory using .NET CLR APIs
Optional bypasses (AMSI, ETW) are applied if requested via flags
The assembly's entry point is executed with the provided arguments
Output is captured via BeaconPrintf and returned to the parent task through a completion callback
The completion callback aggregates the output and displays it in the main command

Output

The command returns the output from the .NET assembly execution:

SharpUp execution started...
[*] Checking for insecure file permissions...
[*] Checking for unquoted service paths...
[+] Found: C:\Program Files\Vulnerable Service\service.exe
[*] Completed Privesc Checks in 17 seconds

The output is captured from the Inline-EA BOF execution and displayed directly in the main command (not as a subtask).

OPSEC Considerations

MEDIUM OPSEC RISK: In-process execution provides better OPSEC than process spawning (no process injection)
Process Create Artifact: Assembly execution creates a "Process Create" artifact that is logged in Mythic
CLR Loading: Loading .NET assemblies into memory may be detected by EDR solutions
AMSI Bypass: Patching clr.dll for AMSI bypass may trigger behavioral detections (more evasive than patching amsi.dll)
ETW Bypass: EAT hooking advapi32.dll!EventWrite may be detected by advanced EDR solutions
No New Process: Executes in-process, reducing some detection vectors compared to process spawning
Memory Allocation: Allocates executable memory for the assembly, which may be scanned by EDR
Thread Isolation: BOF execution runs in a separate thread with timeout protection

Technical Details

Inline-EA BOF

This command uses the Inline-EA BOF developed by @EricEsquivel:

GitHub: https://github.com/EricEsquivel/Inline-EA
Loads .NET assemblies directly into memory
Supports AMSI and ETW bypasses
Prevents assembly from exiting the process

Bypass Options

--patchexit: Patches System.Environment.Exit to prevent the assembly from terminating the agent process. Default: false
--amsi: Bypasses AMSI by patching clr.dll instead of amsi.dll (more evasive than traditional AMSI bypasses). Default: false
--etw: Bypasses ETW by hooking advapi32.dll!EventWrite via Export Address Table (EAT) hooking. Default: false

Note: Boolean flags (--amsi, --etw, --patchexit) are automatically converted to integers (0 or 1) for the BOF.

Error Handling

The command handles various error scenarios:

Assembly Not Found: Returns error if assembly file cannot be retrieved from Mythic
BOF Not Found: Returns error if Inline-EA BOF (inline-ea.x64.o) is not found in Mythic's file store
BOF Execution Failure: Returns error if Inline-EA BOF cannot be executed
Assembly Load Failure: Returns error if .NET assembly cannot be loaded
Bypass Failure: May fail silently if bypasses cannot be applied
Timeout: If BOF execution hangs, it will timeout after 30 seconds and output will still be captured

inline_execute - Execute BOFs directly
Artifacts Support

Command Category: Execution & Control
Requires Admin: No
MITRE ATT&CK: T1055 - Process Injection, T1620 - Reflective Code Loading

5.8 KiB Raw Blame History