Project writeup

ExecuteAssemblyPICO

Runs .NET assemblies and captures their output using a position-independent execute-assembly implementation built with Crystal Palace.

1 min readPrimo
View on GitHub

About

A Position Independent Code (PIC) implementation of the execute-assembly command, using Crysta Palace linker.

How it Works?

  • The loader creates a named pipe and sets it as the current process’s stdout to capture the executed .NET assembly output.
  • It then loads the PICO “.NET assembly runner”.
  • Finally, it passes the .NET assembly and its arguments to the PICO’s exported function “ExecuteAssembly”.

Build

  • You will need first to install the crystal palace linker by follow this documentation.
# release
make x64 ASSEMBLY_PATH="/path/to/Rubeus.exe" ASSEMBLY_ARGS="triage" PIPE_NAME="\\\\.\\pipe\\abc" 

# debug 
make x64-debug ASSEMBLY_PATH="/path/to/Rubeus.exe" ASSEMBLY_ARGS="triage"

Credits