byt3bl33d3r/OffensiveDLR byt3bl33d3r/OffensiveDLR

  • Stars
    star
    492
  • Rank 89,476 (Top 2 %)
  • Language
    PowerShell
  • License
    BSD 3-Clause "New...
  • Created almost 6 years ago
  • Updated almost 3 years ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
byt3bl33d3r/OffensiveDLR
github

byt3bl33d3r

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Toolbox containing research notes & PoC code for weaponizing .NET's DLR

OffensiveDLR

Toolbox containing research notes & PoC code for weaponizing .NET's DLR

Contents

Script Description
Kukulkan A slimmed down version of SILENTTRINITY, C# DLL & EXE that embed an IPY engine. Comms are encrypted and can be used with CobaltStrike
Invoke-JumpScare.ps1 Executes shellcode using an embedded Boolang compiler, nothing touches disk (at least from what I've seen) and no calls to csc.exe are made :)
Invoke-IronPython.ps1 Executes IronPython code using the embedded IPY engine. Same concept as Invoke-JumpScare only using IronPython.
Invoke-ClearScript.ps1 Executes JScript (or VBScript) using the embedded ClearScript engine
SharpSnek.cs C# code that embedes an IronPython engine and executes embedded IPY code. Hooks AppDomain.CurrentDomain.AssemblyResolve to resolve needed Assemblies at runtime.
runBoo.cs C# version of Invoke-JumpScare. Executes shellcode using an embedded Boolang compiler.
runBooAssemblyResolve.cs C# code that embeds a Boolang compiler and executes embedded Boolang code. Hooks AppDomain.CurrentDomain.AssemblyResolve to resolve needed Assemblies at runtime.
minidump.boo Native Boolang script to dump memory using MiniDumpWriteDump
shellcode.boo Native Boolang script that executes shellcode. Currently contains 3 diffrent techniques (QueueUserAPC, CreateThread/WaitForSingleObject, WriteProcessMemory/CreateRemoteThread)
Invoke-SSharp.ps1 Executes SSharp from an embedded compiler within PowerShell. Compilation does not call csc.exe
Invoke-Boolang.ps1 Executes Boo code from an embedded compiler. It also provides workarounds for some bugs I discovered when the Boolang compiler get's embedded within PowerShell.
Invoke-NeoLua.ps1 Executes Lua code from an embedded compiler within PowerShell.

Why?

The .NET DLR is just straight up bonkers, it allows you to do crazy things like embed freaking compilers/engines within other .NET languages (e.g PowerShell & C#) while still remaining Opsec safe & staying in memory. In IronPython's case, you can even have what I call 'engine inception': wanna embed a IPY engine within an IPY engine within another IPY engine? (yo dawg, I heard you liked IPY engines...).

From an offensive perspective this has an insane amount of flexibility and a number of advantages, to name a few:

  1. Out-of-the-box access to the .NET API, without going through Powershell in anyway. Essentially, using the DLR allows you to have all the power of Powershell, only without Powershell and in a language that's (usually) easier to script in (e.g. Python)

  2. Crazy amounts of reflection/embedding going on all the time, which means more evasion.

  3. Using the DLR you always bypass AMSI (if you properly instrument your payloads), no need to obfuscate, patch stuff etc..

  4. All your 'evil' can be coded in the language of your embedded engine/compiler. If you do this using PowerShell, ScriptBlock Logging sees nothing since all the magic happens in the DLR.

  5. Usually, all of the DLR languages have a way of calling native methods either through the language itself or by dynamically compiling C# (e.g PowerShell's Add-Type). If you go with the former method no calls to csc.exe are made and usually nothing is dropped to disk as the languages generate everything needed in memory through IL code. We can go as "...low and high as we want.." (@Op_nomad) & this allows us to do all the good stuff we all love (inject shellcode, unmanaged DLLs, load PEs etc..)

  6. Allows for quick re-tooling and weaponization of payloads. No manual compilation is necessary.

Other Offensive DLR projects

If you're interested in this, here's some other tools that also try to weponize the DLR:

Credits

  • @Op_nomad
  • @subtee
  • @pwndizzle
  • @malcomvetter
  • @harmj0y
  • @elitest

References

Fair warning, if you start reading this stuff it's gonna send you down a hellish rabbit hole (with actual deamon rabbits).

Talks

More Repositories

1

CrackMapExec

A swiss army knife for pentesting networks
Python
7,779
star
2

MITMf

Framework for Man-In-The-Middle attacks
Python
3,472
star
3

OffensiveNim

My experiments in weaponizing Nim (https://nim-lang.org/)
Nim
2,438
star
4

SILENTTRINITY

An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR
Boo
2,054
star
5

DeathStar

Uses Empire's (https://github.com/BC-SECURITY/Empire) RESTful API to automate gaining Domain and/or Enterprise Admin rights in Active Directory environments using some of the most common offensive TTPs.
Python
1,520
star
6

SprayingToolkit

Scripts to make password spraying attacks against Lync/S4B, OWA & O365 a lot quicker, less painful and more efficient
Python
1,334
star
7

gcat

A PoC backdoor that uses Gmail as a C&C server
Python
1,302
star
8

ItWasAllADream

A PrintNightmare (CVE-2021-34527) Python Scanner. Scan entire subnets for hosts vulnerable to the PrintNightmare RCE
Python
725
star
9

WitnessMe

Web Inventory tool, takes screenshots of webpages using Pyppeteer (headless Chrome/Chromium) and provides some extra bells & whistles to make life easier.
Python
683
star
10

pth-toolkit

Modified version of the passing-the-hash tool collection made to work straight out of the box
Python
508
star
11

SpamChannel

Spoof emails from any of the +2 Million domains using MailChannels (DEFCON 31 Talk)
JavaScript
315
star
12

chrome-decrypter

Python script to decrypt saved Chrome usernames and passwords on windows
Python
265
star
13

arpspoof

Python clone of arpspoof that can poison hosts via arp-requests as well as arp-replies
Python
184
star
14

sslstrip2

A mirror of the original SSLstrip+ code by Leonardo Nve
Python
175
star
15

AnsiblePlaybooks

A collection of Ansible Playbooks that configure Kali to use Fish & install a number of tools
156
star
16

NimDllSideload

DLL sideloading/proxying with Nim!
Nim
144
star
17

duckhunter

Converts a USB Rubber ducky script into a Kali Nethunter friendly format for the HID attack
Python
117
star
18

Slides

Slides from various talks that I've given over the years
116
star
19

DHCPShock

Spoofs a DHCP server and exploits all clients vulnerable to the 'ShellShock' bug
Python
83
star
20

BOF-Nim

Cobalt Strike BOF Files with Nim!
Nim
79
star
21

BeEF-API

Python library that facilitates interfacing with BeEF via it's RESTful API
Python
76
star
22

webview_d3

Generate graphs with NetworkX, natively visualize with D3.js and pywebview
Python
69
star
23

Naga

A C# stager for SILENTTRINITY (https://github.com/byt3bl33d3r/SILENTTRINITY)
C#
62
star
24

Invoke-AutoIt

Loads the AutoIt DLL and PowerShell assemblies into memory and executes the specified keystrokes
PowerShell
59
star
25

wifi-graper

Automatically get internetz from access points that have MAC based filtering enabled
Python
53
star
26

toby

Recursively searches a directory for any file containing a specified string
Python
44
star
27

CME-PowerShell-Scripts

A collection of modifed PowerShell Scripts for CrackMapExec (https://github.com/byt3bl33d3r/CrackMapExec)
PowerShell
43
star
28

MemeGenerator

Modern problems require modern solutions
Python
31
star
29

pythoncookie

My Python Cookiecutter project template
Dockerfile
30
star
30

tailscalesd

Prometheus Service Discovery for Tailscale (Python Edition)
Python
23
star
31

SponsorMonitor

Monitor Github Sponsors and automatically add/remove them to/from a Github Organization Team.
Python
23
star
32

Kaliya

A cross-platform stager for SILENTTRINITY (https://github.com/byt3bl33d3r/SILENTTRINITY)
C#
23
star
33

cmd2powershell

Converts a command to a base64 powershell compatible string
Python
22
star
34

Utinni

An async Python client library for Empire's RESTful API
Python
21
star
35

MITMf-opt-plugins

Optional plugins for MITMf
Python
14
star
36

hookme

Automatically exported from code.google.com/p/hookme
C#
13
star
37

jamaal-re-tools

Automatically exported from code.google.com/p/jamaal-re-tools
HTML
12
star
38

byt3bl33d3r.github.io

Trying to take the dum-dum out of security
HTML
10
star
39

BOF-Zig

Cobalt Strike BOF with Zig!
C
9
star
40

byt3bl33d3r

Github Profile Readme
8
star
41

LocoCrack

A loco version of BozoCrack with some improvements (https://github.com/juuso/BozoCrack)
Python
8
star
42

sergio-proxy

Original Sergio-Proxy code written by Ben Schmidt (@_supernothing)
Python
7
star
43

externalip

Prometheus client that exposes your external IP address
Python
6
star
44

conky-gr33n

Conky config for everyone who likes a lot of green
Lua
4
star
45

conky-r3d

Conky config for everyone who likes a lot of red
Lua
2
star
46

playwright-heap-snapshot

API and CLI tool to fetch and query Chome DevTools heap snapshots (Python & Playwright)
Python
2
star