Angerona/documentation-payload/Cazalla/commands/inline_execute_assembly.md

# inline_execute_assembly - Execute .NET Assembly In-Process

Execute a .NET Assembly in the current process using the Inline-EA BOF (Beacon Object File).

## Description

The `inline_execute_assembly` command executes a .NET assembly directly in the current process memory using the Inline-EA BOF developed by @EricEsquivel. This method loads and executes .NET assemblies without creating new processes, providing better OPSEC than traditional process spawning methods.

## Syntax

```
inline_execute_assembly -Assembly <assembly_file> [-Arguments <args>] [--patchexit] [--amsi] [--etw]
```

## Parameters

- `-Assembly` or `assembly_name` (required): Name of an already uploaded .NET assembly (e.g., `SharpUp.exe`)
- `assembly_file` (required for new uploads): A new .NET assembly file to upload and execute
- `-Arguments` or `assembly_arguments` (optional): Arguments to pass to the assembly
- `--patchexit` or `patch_exit` (optional, default: false): Patch `System.Environment.Exit` to prevent the Beacon process from exiting
- `--amsi` or `amsi` (optional, default: false): Bypass AMSI by patching `clr.dll` instead of `amsi.dll` to avoid common detections
- `--etw` or `etw` (optional, default: false): Bypass ETW by EAT hooking `advapi32.dll!EventWrite` to point to a function that returns immediately

## Examples

```
# Execute assembly with arguments
inline_execute_assembly -Assembly SharpUp.exe -Arguments "audit"

# Execute with AMSI and ETW bypass
inline_execute_assembly -Assembly Seatbelt.exe -Arguments "all" --amsi --etw

# Execute with all bypasses enabled
inline_execute_assembly -Assembly SharpHound.exe -Arguments "-c All" --patchexit --amsi --etw
```

## Features

- **In-Process Execution**: Executes .NET assemblies in the current process without spawning new processes
- **AMSI Bypass**: Optional AMSI bypass by patching clr.dll (more evasive than patching amsi.dll)
- **ETW Bypass**: Optional ETW bypass via EAT hooking
- **Exit Patch**: Prevents assemblies from calling `System.Environment.Exit` and terminating the agent
- **Output Capture**: Automatically captures and returns assembly output
- **BOF-Based**: Uses the Inline-EA BOF under the hood (executed via `inline_execute`)

## How It Works

1. The command retrieves the .NET assembly from Mythic
2. The command searches for the Inline-EA BOF (`inline-ea.x64.o`) in Mythic's file store
3. A subtask is created that calls `inline_execute` with the Inline-EA BOF
4. The .NET assembly is passed to the BOF as raw bytes (hex-encoded)
5. The BOF loads the assembly into memory using .NET CLR APIs
6. Optional bypasses (AMSI, ETW) are applied if requested via flags
7. The assembly's entry point is executed with the provided arguments
8. Output is captured via `BeaconPrintf` and returned to the parent task through a completion callback
9. The completion callback aggregates the output and displays it in the main command

## Output

The command returns the output from the .NET assembly execution:

```
SharpUp execution started...
[*] Checking for insecure file permissions...
[*] Checking for unquoted service paths...
[+] Found: C:\Program Files\Vulnerable Service\service.exe
[*] Completed Privesc Checks in 17 seconds
```

The output is captured from the Inline-EA BOF execution and displayed directly in the main command (not as a subtask).

## OPSEC Considerations

- **MEDIUM OPSEC RISK**: In-process execution provides better OPSEC than process spawning (no process injection)
- **Process Create Artifact**: Assembly execution creates a "Process Create" artifact that is logged in Mythic
- **CLR Loading**: Loading .NET assemblies into memory may be detected by EDR solutions
- **AMSI Bypass**: Patching `clr.dll` for AMSI bypass may trigger behavioral detections (more evasive than patching `amsi.dll`)
- **ETW Bypass**: EAT hooking `advapi32.dll!EventWrite` may be detected by advanced EDR solutions
- **No New Process**: Executes in-process, reducing some detection vectors compared to process spawning
- **Memory Allocation**: Allocates executable memory for the assembly, which may be scanned by EDR
- **Thread Isolation**: BOF execution runs in a separate thread with timeout protection

## Technical Details

### Inline-EA BOF

This command uses the Inline-EA BOF developed by @EricEsquivel:
- GitHub: https://github.com/EricEsquivel/Inline-EA
- Loads .NET assemblies directly into memory
- Supports AMSI and ETW bypasses
- Prevents assembly from exiting the process

### Bypass Options

- **--patchexit**: Patches `System.Environment.Exit` to prevent the assembly from terminating the agent process. Default: `false`
- **--amsi**: Bypasses AMSI by patching `clr.dll` instead of `amsi.dll` (more evasive than traditional AMSI bypasses). Default: `false`
- **--etw**: Bypasses ETW by hooking `advapi32.dll!EventWrite` via Export Address Table (EAT) hooking. Default: `false`

**Note**: Boolean flags (`--amsi`, `--etw`, `--patchexit`) are automatically converted to integers (0 or 1) for the BOF.

## Error Handling

The command handles various error scenarios:
- **Assembly Not Found**: Returns error if assembly file cannot be retrieved from Mythic
- **BOF Not Found**: Returns error if Inline-EA BOF (`inline-ea.x64.o`) is not found in Mythic's file store
- **BOF Execution Failure**: Returns error if Inline-EA BOF cannot be executed
- **Assembly Load Failure**: Returns error if .NET assembly cannot be loaded
- **Bypass Failure**: May fail silently if bypasses cannot be applied
- **Timeout**: If BOF execution hangs, it will timeout after 30 seconds and output will still be captured

## Related

- [`inline_execute`](inline_execute.md) - Execute BOFs directly
- [Artifacts Support](../features.md#artifacts-support)

---

**Command Category:** Execution & Control  
**Requires Admin:** No  
**MITRE ATT&CK:** [T1055 - Process Injection](https://attack.mitre.org/techniques/T1055/), [T1620 - Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)