execute_assembly - Execute .NET Assembly in Remote Process

Execute a .NET Assembly in a remote process and retrieve its output.

Description

The execute_assembly command converts a .NET assembly to shellcode using Donut and injects it into a remote process (or the current process if no target is specified). The assembly is executed in the target process and its output is captured and returned.

Syntax

execute_assembly -Assembly <assembly_file> -Arguments <args>

Parameters

-Assembly or assembly_name (required): Name of an already uploaded .NET assembly (e.g., SharpUp.exe)
assembly_file (required for new uploads): A new .NET assembly file to upload and execute
-Arguments or assembly_arguments (required): Arguments to pass to the assembly

Examples

# Execute assembly with arguments
execute_assembly -Assembly SharpUp.exe -Arguments "audit"

# Execute Seatbelt with all checks
execute_assembly -Assembly Seatbelt.exe -Arguments "all"

# Execute SharpHound for domain enumeration
execute_assembly -Assembly SharpHound.exe -Arguments "-c All -d domain.local"

Features

Shellcode Conversion: Automatically converts .NET assemblies to shellcode using Donut
Process Injection: Injects shellcode into a target process (defaults to current process)
Output Capture: Captures and returns assembly output
No File System: Assembly is executed entirely in memory without writing to disk

How It Works

The command retrieves the .NET assembly from Mythic
The assembly is converted to shellcode using Donut
A subtask is created to call inject_shellcode with the generated shellcode
The shellcode is injected into the target process
The .NET assembly is loaded and executed in the target process
Output is captured and returned to Mythic

Output

[execute_assembly] Converting .NET Assembly to Shellcode...
[execute_assembly] Shellcode generated: 123456 bytes
[execute_assembly] Injecting shellcode into process...
[Assembly Output]
SharpUp execution started...
[*] Checking for insecure file permissions...
[+] Found: C:\Program Files\Vulnerable Service\service.exe

OPSEC Considerations

HIGH OPSEC RISK: Process injection is heavily monitored by EDR/XDR solutions
Shellcode Injection: Donut shellcode injection may trigger behavioral detections
Process Create Artifact: Creates a "Process Create" artifact
Memory Scanning: Injected shellcode may be scanned by EDR memory protection
API Monitoring: Process injection APIs (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) are monitored
Donut Detection: Donut shellcode patterns may be detected by advanced security solutions

Technical Details

Donut Integration

The command uses Donut to convert .NET assemblies to position-independent shellcode:

Automatically handles .NET assembly loading
Supports .NET Framework and .NET Core assemblies
Generates position-independent shellcode
Handles assembly dependencies

Process Injection

The shellcode injection process:

Shellcode is generated from the .NET assembly
Shellcode is registered as a temporary file in Mythic
inject_shellcode command is called via subtask
Shellcode is injected into the target process
Assembly executes and output is captured

Error Handling

The command handles various error scenarios:

Assembly Not Found: Returns error if assembly file cannot be retrieved
Donut Conversion Failure: Returns error if assembly cannot be converted to shellcode
Injection Failure: Returns error if shellcode cannot be injected
Execution Failure: Returns error if assembly fails to execute

inline_execute_assembly - Execute .NET assemblies in-process (better OPSEC)
inline_execute - Execute BOFs directly
Artifacts Support

Command Category: Execution & Control
Requires Admin: No (unless injecting into protected process)
MITRE ATT&CK: T1055 - Process Injection, T1620 - Reflective Code Loading

4.1 KiB Raw Blame History