marcos.luna
110 lines
4.1 KiB
Markdown
110 lines
4.1 KiB
Markdown
# execute_assembly - Execute .NET Assembly in Remote Process
|
|
|
|
Execute a .NET Assembly in a remote process and retrieve its output.
|
|
|
|
## Description
|
|
|
|
The `execute_assembly` command converts a .NET assembly to shellcode using Donut and injects it into a remote process (or the current process if no target is specified). The assembly is executed in the target process and its output is captured and returned.
|
|
|
|
## Syntax
|
|
|
|
```
|
|
execute_assembly -Assembly <assembly_file> -Arguments <args>
|
|
```
|
|
|
|
## Parameters
|
|
|
|
- `-Assembly` or `assembly_name` (required): Name of an already uploaded .NET assembly (e.g., `SharpUp.exe`)
|
|
- `assembly_file` (required for new uploads): A new .NET assembly file to upload and execute
|
|
- `-Arguments` or `assembly_arguments` (required): Arguments to pass to the assembly
|
|
|
|
## Examples
|
|
|
|
```
|
|
# Execute assembly with arguments
|
|
execute_assembly -Assembly SharpUp.exe -Arguments "audit"
|
|
|
|
# Execute Seatbelt with all checks
|
|
execute_assembly -Assembly Seatbelt.exe -Arguments "all"
|
|
|
|
# Execute SharpHound for domain enumeration
|
|
execute_assembly -Assembly SharpHound.exe -Arguments "-c All -d domain.local"
|
|
```
|
|
|
|
## Features
|
|
|
|
- **Shellcode Conversion**: Automatically converts .NET assemblies to shellcode using Donut
|
|
- **Process Injection**: Injects shellcode into a target process (defaults to current process)
|
|
- **Output Capture**: Captures and returns assembly output
|
|
- **No File System**: Assembly is executed entirely in memory without writing to disk
|
|
|
|
## How It Works
|
|
|
|
1. The command retrieves the .NET assembly from Mythic
|
|
2. The assembly is converted to shellcode using Donut
|
|
3. A subtask is created to call `inject_shellcode` with the generated shellcode
|
|
4. The shellcode is injected into the target process
|
|
5. The .NET assembly is loaded and executed in the target process
|
|
6. Output is captured and returned to Mythic
|
|
|
|
## Output
|
|
|
|
```
|
|
[execute_assembly] Converting .NET Assembly to Shellcode...
|
|
[execute_assembly] Shellcode generated: 123456 bytes
|
|
[execute_assembly] Injecting shellcode into process...
|
|
[Assembly Output]
|
|
SharpUp execution started...
|
|
[*] Checking for insecure file permissions...
|
|
[+] Found: C:\Program Files\Vulnerable Service\service.exe
|
|
```
|
|
|
|
## OPSEC Considerations
|
|
|
|
- **HIGH OPSEC RISK**: Process injection is heavily monitored by EDR/XDR solutions
|
|
- **Shellcode Injection**: Donut shellcode injection may trigger behavioral detections
|
|
- **Process Create Artifact**: Creates a "Process Create" artifact
|
|
- **Memory Scanning**: Injected shellcode may be scanned by EDR memory protection
|
|
- **API Monitoring**: Process injection APIs (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) are monitored
|
|
- **Donut Detection**: Donut shellcode patterns may be detected by advanced security solutions
|
|
|
|
## Technical Details
|
|
|
|
### Donut Integration
|
|
|
|
The command uses Donut to convert .NET assemblies to position-independent shellcode:
|
|
- Automatically handles .NET assembly loading
|
|
- Supports .NET Framework and .NET Core assemblies
|
|
- Generates position-independent shellcode
|
|
- Handles assembly dependencies
|
|
|
|
### Process Injection
|
|
|
|
The shellcode injection process:
|
|
1. Shellcode is generated from the .NET assembly
|
|
2. Shellcode is registered as a temporary file in Mythic
|
|
3. `inject_shellcode` command is called via subtask
|
|
4. Shellcode is injected into the target process
|
|
5. Assembly executes and output is captured
|
|
|
|
## Error Handling
|
|
|
|
The command handles various error scenarios:
|
|
- **Assembly Not Found**: Returns error if assembly file cannot be retrieved
|
|
- **Donut Conversion Failure**: Returns error if assembly cannot be converted to shellcode
|
|
- **Injection Failure**: Returns error if shellcode cannot be injected
|
|
- **Execution Failure**: Returns error if assembly fails to execute
|
|
|
|
## Related
|
|
|
|
- [`inline_execute_assembly`](inline_execute_assembly.md) - Execute .NET assemblies in-process (better OPSEC)
|
|
- [`inline_execute`](inline_execute.md) - Execute BOFs directly
|
|
- [Artifacts Support](../features.md#artifacts-support)
|
|
|
|
---
|
|
|
|
**Command Category:** Execution & Control
|
|
**Requires Admin:** No (unless injecting into protected process)
|
|
**MITRE ATT&CK:** [T1055 - Process Injection](https://attack.mitre.org/techniques/T1055/), [T1620 - Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)
|
|
|