mirror of https://github.com/Accenture/CLRvoyance synced 2026-06-08 10:19:14 +00:00

T

Bryan Alexander 03ca4e02cb Fix Main args, code cleanup

* General
  -- Fixed a disparity between 32/64 bit shellcode requiring or not
  requiring arguments to Main. Now support either or; Main() or
  Main(string[] args). Submit an issue if you want to actually control
  the arguments
  -- Refactored code to remove tons and tons of redundancy
  -- Fixed sc-64-clr-rwx to invoke correct lookup functions

2021-03-19 16:17:29 -07:00

CLRvoyance

Fix Main args, code cleanup

2021-03-19 16:17:29 -07:00

ExampleAssembly

Initial commit

2020-05-04 15:02:19 -07:00

README.md

Fix Main args, code cleanup

2021-03-19 16:17:29 -07:00

README.md

CLRvoyance

CLRvoyance is a shellcode kit that supports bootstrapping managed assemblies into unmanaged (or managed) processes. It provides three different implementations of position independent shellcode for CLR hosting, as well as a generator script for quickly embedding a managed assembly in position independent shellcode.

Please see the release blogpost here for technical information.

Usage

$ py clrvoyance.py -h
usage: clrvoyance.py [-h] -a [executable] [-p [32|64]] [-d [net|c]] [-n] [--apc]

optional arguments:
  -h, --help       show this help message and exit
  -a [executable]  Assembly
  -p [32|64]       Platform
  -d [net|c]       Dump binary shellcode of assembly
  -n               Load assembly into a new domain
  --apc            Use safe APC shellcode

CLRvoyance requires Python 3.6+ to generate embedded payloads. Using our included ExampleAssembly, we can generate 32-bit raw shellcode using the following:

$ py clrvoyance.py -a ExampleAssembly.exe -p 32
[+] 4608 byte assembly
[+] 1381 byte bootstrap
[+] 5988 byte shellcode written out (c:\users\bja\Desktop\project\clrvoyance\ExampleAssembly\ExampleAssembly\bin\Debug\ExampleAssembly.exe.shellcode)

ExampleAssembly.exe.shellcode can then be used as your shellcode payload.

If we want to view the shellcode for programmatic consumption, the -d flag can be used:

$ py clrvoyance.py -a ExampleAssembly.exe.shellcode -p 32 -d net
byte[] shellcode={
0xe8,0x00,0x00,0x00,0x00,0x5b,0x68,0x42,0x31,0x0e,0x00,0x68,0x88,0x4e,0x0d,0x00,
0xe8,0x23,0x04,0x00,0x00,0x6a,0x04,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x03,0x00,
0x00,0x6a,0x00,0xff,0xd0,0x85,0xc0,0x0f,0x84,0x46,0x03,0x00,0x00,0x64,0x8b,0x35,
0x18,0x00,0x00,0x00,0x89,0x46,0x14,0x68,0x86,0x57,0x0d,0x00,0x68,0x88,0x4e,0x0d,
0x00,0xe8,0xf2,0x03,0x00,0x00,0x64,0x8b,0x35,0x14,0x00,0x00,0x00,0x83,0xc6,0x38,
...snip...

The provided assemblies were compiled using nasm 2.14. If you modify the shellcode, please ensure you update offsets in clrvoyance.py.

Code

The project is broken up into multiple files described below:

clrvoyance.py  	    - Generator script
sc-*-clr.asm 	    - Primary CLR loader; RX page support
sc-*-clr-apc.asm    - APC CLR loader
sc-*-clr-rwx.asm    - RWX version of CLR loader
sc-*-clrnd.asm      - CLR loader with new domain
sc-*-clrnd-apc.asm  - APC CLR loader with new domain
sc-*-api-functions  - Helper functions
sc-32-jscript.asm   - Executes JScript instead of an assembly
sc-64-macros.asm    - 64-bit helper macros