GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → byt3bl33d3r → Offensivedlr

byt3bl33d3r / Offensivedlr

Licence: bsd-3-clause
Toolbox containing research notes & PoC code for weaponizing .NET's DLR

Programming Languages

powershell
5483 projects

Labels

dotnetsecurity-tools

Projects that are alternatives of or similar to Offensivedlr

Ssh Mitm
ssh mitm server for security audits supporting public key authentication, session hijacking and file manipulation
Stars: ✭ 335 (-7.97%)
Mutual labels:  security-tools
Awesome Ruby Security
Awesome Ruby Security resources
Stars: ✭ 360 (-1.1%)
Mutual labels:  security-tools
Patrowlmanager
PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform
Stars: ✭ 363 (-0.27%)
Mutual labels:  security-tools
Syzkaller
syzkaller is an unsupervised coverage-guided kernel fuzzer
Stars: ✭ 3,841 (+955.22%)
Mutual labels:  security-tools
Katana
A Python Tool For google Hacking
Stars: ✭ 355 (-2.47%)
Mutual labels:  security-tools
Taipan
Web application vulnerability scanner
Stars: ✭ 359 (-1.37%)
Mutual labels:  security-tools
Awesome Dotnet Security
Awesome .NET Security Resources
Stars: ✭ 325 (-10.71%)
Mutual labels:  security-tools
Aiodnsbrute
Python 3.5+ DNS asynchronous brute force utility
Stars: ✭ 370 (+1.65%)
Mutual labels:  security-tools
Webshell Sniper
🔨 Manage your website via terminal
Stars: ✭ 359 (-1.37%)
Mutual labels:  security-tools
Unsign
Remove code signatures from OSX Mach-O binaries (note: unsigned binaries cannot currently be re-codesign'ed. Patches welcome!)
Stars: ✭ 362 (-0.55%)
Mutual labels:  security-tools
Super
Secure, Unified, Powerful and Extensible Rust Android Analyzer
Stars: ✭ 340 (-6.59%)
Mutual labels:  security-tools
Impost3r
👻Impost3r -- A linux password thief
Stars: ✭ 355 (-2.47%)
Mutual labels:  security-tools
Wssat
WEB SERVICE SECURITY ASSESSMENT TOOL
Stars: ✭ 360 (-1.1%)
Mutual labels:  security-tools
Shodansploit
🔎 shodansploit > v1.3.0
Stars: ✭ 342 (-6.04%)
Mutual labels:  security-tools
Spicypass
A light-weight password manager with a focus on simplicity and security
Stars: ✭ 367 (+0.82%)
Mutual labels:  security-tools
Htrace.sh
My simple Swiss Army knife for http/https troubleshooting and profiling.
Stars: ✭ 3,465 (+851.92%)
Mutual labels:  security-tools
Rta
Red team Arsenal - An intelligent scanner to detect security vulnerabilities in company's layer 7 assets.
Stars: ✭ 358 (-1.65%)
Mutual labels:  security-tools
Android Api Securekeys
Store data in a simple and secure way
Stars: ✭ 372 (+2.2%)
Mutual labels:  security-tools
W5
Security Orchestration, Automation and Response (SOAR) Platform. 安全编排与自动化响应平台，无需编写代码的安全自动化，使用 SOAR 可以让团队工作更加高效
Stars: ✭ 367 (+0.82%)
Mutual labels:  security-tools
Threatmapper
Identify vulnerabilities in running containers, images, hosts and repositories
Stars: ✭ 361 (-0.82%)
Mutual labels:  security-tools
View All Similar Projects ➔

OffensiveDLR

Toolbox containing research notes & PoC code for weaponizing .NET's DLR

Contents

Script Description
Kukulkan A slimmed down version of SILENTTRINITY, C# DLL & EXE that embed an IPY engine. Comms are encrypted and can be used with CobaltStrike
Invoke-JumpScare.ps1 Executes shellcode using an embedded Boolang compiler, nothing touches disk (at least from what I've seen) and no calls to csc.exe are made :)
Invoke-IronPython.ps1 Executes IronPython code using the embedded IPY engine. Same concept as Invoke-JumpScare only using IronPython.
Invoke-ClearScript.ps1 Executes JScript (or VBScript) using the embedded ClearScript engine
SharpSnek.cs C# code that embedes an IronPython engine and executes embedded IPY code. Hooks AppDomain.CurrentDomain.AssemblyResolve to resolve needed Assemblies at runtime.
runBoo.cs C# version of Invoke-JumpScare. Executes shellcode using an embedded Boolang compiler.
runBooAssemblyResolve.cs C# code that embeds a Boolang compiler and executes embedded Boolang code. Hooks AppDomain.CurrentDomain.AssemblyResolve to resolve needed Assemblies at runtime.
minidump.boo Native Boolang script to dump memory using MiniDumpWriteDump
shellcode.boo Native Boolang script that executes shellcode. Currently contains 3 diffrent techniques (QueueUserAPC, CreateThread/WaitForSingleObject, WriteProcessMemory/CreateRemoteThread)
Invoke-SSharp.ps1 Executes SSharp from an embedded compiler within PowerShell. Compilation does not call csc.exe
Invoke-Boolang.ps1 Executes Boo code from an embedded compiler. It also provides workarounds for some bugs I discovered when the Boolang compiler get's embedded within PowerShell.
Invoke-NeoLua.ps1 Executes Lua code from an embedded compiler within PowerShell.

Why?

The .NET DLR is just straight up bonkers, it allows you to do crazy things like embed freaking compilers/engines within other .NET languages (e.g PowerShell & C#) while still remaining Opsec safe & staying in memory. In IronPython's case, you can even have what I call 'engine inception': wanna embed a IPY engine within an IPY engine within another IPY engine? (yo dawg, I heard you liked IPY engines...).

From an offensive perspective this has an insane amount of flexibility and a number of advantages, to name a few:

  1. Out-of-the-box access to the .NET API, without going through Powershell in anyway. Essentially, using the DLR allows you to have all the power of Powershell, only without Powershell and in a language that's (usually) easier to script in (e.g. Python)

  2. Crazy amounts of reflection/embedding going on all the time, which means more evasion.

  3. Using the DLR you always bypass AMSI (if you properly instrument your payloads), no need to obfuscate, patch stuff etc..

  4. All your 'evil' can be coded in the language of your embedded engine/compiler. If you do this using PowerShell, ScriptBlock Logging sees nothing since all the magic happens in the DLR.

  5. Usually, all of the DLR languages have a way of calling native methods either through the language itself or by dynamically compiling C# (e.g PowerShell's Add-Type). If you go with the former method no calls to csc.exe are made and usually nothing is dropped to disk as the languages generate everything needed in memory through IL code. We can go as "...low and high as we want.." (@Op_nomad) & this allows us to do all the good stuff we all love (inject shellcode, unmanaged DLLs, load PEs etc..)

  6. Allows for quick re-tooling and weaponization of payloads. No manual compilation is necessary.

Other Offensive DLR projects

If you're interested in this, here's some other tools that also try to weponize the DLR:

Credits

References

Fair warning, if you start reading this stuff it's gonna send you down a hellish rabbit hole (with actual deamon rabbits).

Talks

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].