CyberWART maintains custom implants for use in our penetration testing services — and for a few customers. Sometimes we have need to conduct assessments where the testing is “black” to all but the most senior leadership. In these cases, we need to leverage real-world techniques. An ongoing problem has been loading generic exe and executing them.
Most binders and similar tools out there use the MS CreateProcess() function. It’s a lovely function, but it’s argument is a file on disk. LoadLibrary() has a similar problem. These functions get the job done, but needing to write them on disk creates too much noise for me.
Next all the leet hackers will talk about writing a custom loader. It’s not all to hard to load a simple exe or dll but it’s difficult to do it for general EXEs. Fortunately, I found a wonderful MS class to help out! The Assembly Class Load() method does just the trick.
Assembly..::.Load Method (array<Byte>[])Loads the assembly with a common object file format (COFF)-based image containing an emitted assembly. The assembly is loaded into the domain of the caller.
public:
static Assembly^ Load(
array<unsigned char>^ rawAssembly
)
Leave it up to Microsoft to give the badguy the tools they need. 