inline_execute_assembly - Execute .NET Assembly In-Process

Execute a .NET Assembly in the current process using the Inline-EA BOF (Beacon Object File).

Description

The inline_execute_assembly command executes a .NET assembly directly in the current process memory using the Inline-EA BOF developed by @EricEsquivel. This method loads and executes .NET assemblies without creating new processes, providing better OPSEC than traditional process spawning methods.

Syntax

inline_execute_assembly -Assembly <assembly_file> [-Arguments <args>] [--patchexit] [--amsi] [--etw]

Parameters

-Assembly or assembly_name (required): Name of an already uploaded .NET assembly (e.g., SharpUp.exe)
assembly_file (required for new uploads): A new .NET assembly file to upload and execute
-Arguments or assembly_arguments (optional): Arguments to pass to the assembly
--patchexit or patch_exit (optional, default: false): Patch System.Environment.Exit to prevent the Beacon process from exiting
--amsi or amsi (optional, default: false): Bypass AMSI by patching clr.dll instead of amsi.dll to avoid common detections
--etw or etw (optional, default: false): Bypass ETW by EAT hooking advapi32.dll!EventWrite to point to a function that returns immediately

Examples

# Execute assembly with arguments
inline_execute_assembly -Assembly SharpUp.exe -Arguments "audit"

# Execute with AMSI and ETW bypass
inline_execute_assembly -Assembly Seatbelt.exe -Arguments "all" --amsi --etw

# Execute with all bypasses enabled
inline_execute_assembly -Assembly SharpHound.exe -Arguments "-c All" --patchexit --amsi --etw

Features

In-Process Execution: Executes .NET assemblies in the current process without spawning new processes
AMSI Bypass: Optional AMSI bypass by patching clr.dll (more evasive than patching amsi.dll)
ETW Bypass: Optional ETW bypass via EAT hooking
Exit Patch: Prevents assemblies from calling System.Environment.Exit and terminating the agent
Output Capture: Automatically captures and returns assembly output
BOF-Based: Uses the Inline-EA BOF under the hood (executed via inline_execute)

How It Works

The command creates a subtask that calls inline_execute with the Inline-EA BOF
The .NET assembly is passed to the BOF as raw bytes
The BOF loads the assembly into memory using .NET CLR APIs
Optional bypasses (AMSI, ETW) are applied if requested
The assembly's entry point is executed with the provided arguments
Output is captured and returned to Mythic

Output

[inline_execute_assembly] Assembly execution requested
[BOF Output from Inline-EA]
SharpUp execution started...
[*] Checking for insecure file permissions...
[*] Checking for unquoted service paths...
[+] Found: C:\Program Files\Vulnerable Service\service.exe

OPSEC Considerations

Process Create Artifact: Assembly execution creates a "Process Create" artifact
CLR Loading: Loading .NET assemblies into memory may be detected by EDR solutions
AMSI Bypass: Patching clr.dll for AMSI bypass may trigger behavioral detections
ETW Bypass: EAT hooking may be detected by advanced EDR solutions
No New Process: Executes in-process, reducing some detection vectors compared to execute_assembly
Memory Allocation: Allocates executable memory for the assembly, which may be scanned

Technical Details

Inline-EA BOF

This command uses the Inline-EA BOF developed by @EricEsquivel:

GitHub: https://github.com/EricEsquivel/Inline-EA
Loads .NET assemblies directly into memory
Supports AMSI and ETW bypasses
Prevents assembly from exiting the process

Bypass Options

--patchexit: Patches System.Environment.Exit to prevent the assembly from terminating the agent process
--amsi: Bypasses AMSI by patching clr.dll instead of amsi.dll (more evasive)
--etw: Bypasses ETW by hooking advapi32.dll!EventWrite via Export Address Table (EAT) hooking

Error Handling

The command handles various error scenarios:

Assembly Not Found: Returns error if assembly file cannot be retrieved from Mythic
BOF Execution Failure: Returns error if Inline-EA BOF cannot be executed
Assembly Load Failure: Returns error if .NET assembly cannot be loaded
Bypass Failure: May fail silently if bypasses cannot be applied

inline_execute - Execute BOFs directly
execute_assembly - Execute .NET assemblies in remote processes
Artifacts Support

Command Category: Execution & Control
Requires Admin: No
MITRE ATT&CK: T1055 - Process Injection, T1620 - Reflective Code Loading

4.8 KiB Raw Blame History