• Stars
    star
    1,139
  • Rank 40,911 (Top 0.9 %)
  • Language
    C#
  • License
    GNU General Publi...
  • Created over 7 years ago
  • Updated almost 4 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

A tool to create a JScript file which loads a .NET v2 assembly from memory.
ο»ΏThis file is part of DotNetToJScript - A tool to generate a 
JScript which bootstraps an arbitrary .NET Assembly and class.
Copyright (C) James Forshaw 2017

DotNetToJScript is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

DotNetToJScript is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with DotNetToJScript.  If not, see <http://www.gnu.org/licenses/>.

Usage Notes:

This only works from full trust JScript(obviously), so should work in
scriptlets etc. By default it will only works if v2/v3/v3.5 is installed.
However if you specify the '-ver auto' switch when building the output it
will also work on v4+ only, however that will introduce a dependency on
WScript.Shell which you might not want.

To use this you'll need to create an assembly which targets .NET 2 (though
in most cases you can also use 3.5 as you don't tend to see .NET 2 installed
in isolation. In the assembly implement a class called TestClass which does
something you want to do in the public, parameterless constructor.

public class TestClass
{
    public TestClass()
    {
        /* Start notepad */
        Process.Start("notepad.exe");
    }
}

Ensure it's public. Then pass to this tool the path to the .NET assembly.
If you annotate the class with the ComVisible attribute you can even interact
with the object after it's created. e.g.

[ComVisible(true)]
public class TestClass
{
    public void DoSomething(string arg) { }
}

You can change the name of the entry class by using the -c switch and adding the name.
You can also get the tool to add additional code to interact with the object by
specifying the -s parameter with the path to a text file containing the additional
JScript. The created object is named 'o', so for example if you wanted to call
the DoSomething method load a file containing:

o.DoSomething("SomeArg");

The default mode is to output a JScript file which can be executed in Windows
Scripting Host. However if you want a scriptlet pass either -m (for a scriptlet
which can be used from a scriptlet moniker) or -u (for a scriptlet which can be
used from regsvr32). You can also specify the '-l vba' switch to output a VBA 
file which should work in Office Macros or '-l vbscript' for VBScript.

Finally by default the tool will output to stdout, you can output direct to a file
using the -o switch.

More Repositories

1

oleviewdotnet

A .net OLE/COM viewer and inspector to merge functionality of OleView and Test Container
C#
984
star
2

ExploitRemotingService

A tool to exploit .NET Remoting Services
C#
453
star
3

blackhat-usa-2022-demos

Demos for the Blackhat USA 2022 talk "Taking Kerberos to the Next Level"
PowerShell
260
star
4

WindowsRpcClients

This respository is a collection of C# class libraries which implement RPC clients for various versions of the Windows Operating System from 7 to Windows 10.
C#
252
star
5

windows-logical-eop-workshop

C
221
star
6

CANAPE.Core

A network proxy library written in C# for .NET Core based on CANAPE
C#
172
star
7

infosec-presentations

A repository of previous info-sec presentations I've presented.
145
star
8

IE11SandboxEscapes

Some example source code for fixed IE11 sandbox escapes.
Objective-C
137
star
9

DeviceGuardBypasses

A repository of some of my Windows 10 Device Guard Bypasses
C#
130
star
10

ExploitDotNetDCOM

A tool to exploit .NET DCOM for EoP and RCE. Is fixed in latest versions of the .NET.
C++
82
star
11

WindowsRuntimeSecurityDemos

Demos for Presentation on Windows Runtime Security
C#
69
star
12

DotNetInteropDemos

A set of demos and a PowerShell module to interact with DotNetInterop.
PowerShell
66
star
13

windows-attacksurface-workshop

Workshop material for a Windows Attack Surface Analysis Workshop
65
star
14

ZeroNights2017

Some sample code from my Zero Nights 2017 presentation.
C++
62
star
15

ExampleChatApplication

A simple example chat application written for .NET Core to learn network protocol analysis.
C#
37
star
16

Zer0Con_2018

Repository for my talk on Desktop Bridge at Zer0Con 2018.
PowerShell
33
star
17

DumpReparsePoints

This is a simple tool to dump all the reparse points on an NTFS volume.
C#
32
star
18

setsidmapping

Simple tool to use LsaManageSidNameMapping get LSA to add or remove SID to name mappings.
C#
22
star
19

44con_2014

Materials for 44con 2014 CANAPE Workshop
Python
22
star
20

SuperFunkyChat

An example binary protocol application for learning CANAPE
C#
19
star
21

bh2014

Built binaries for BH 2014 workshop
Python
18
star
22

AxHell

A simple exploitable ActiveX control for RE/VR
C++
18
star
23

canape-ssl-mitm-osx

A simple CANAPE extension to exploit iOS/OSX SSL vulnerability
C#
9
star
24

saturndebug

My old old sega saturn debugger, for information purposes
C
6
star
25

re

Some simple reverse engineering resources
Python
5
star
26

prxtool

C
3
star
27

Sourcey-Jack

Simple injection project to convert network connections to SOCKS
C#
3
star
28

psplinkusb

C
2
star
29

Kanjidic-OSX

A project to convert Jim Breen's Kanji Dictionary to the OSX dictionary.app format
1
star