Typo squash, Readme updates, added Invoke-IronPython.ps1

Invoke-JumpScare.ps1

@@ -10,7 +10,7 @@ License: BSD 3-Clause
 
 .DESCRIPTION
 This is a PoC script that executes shellcode using an embedded Boolang compiler:
- - The required Boolang Assemblied are loaded on runtime
+ - The required Boolang Assemblies are loaded on runtime
  - Boolang script is dynamically compiled and executed on the fly
 
 From an offensive perspective this has an insane amount of flexibility and has a lot of advantages, to name a couple:
@@ -18,7 +18,7 @@ From an offensive perspective this has an insane amount of flexibility and has a
 
  - When compiling Boolang source code if you specify the "CompileToMemory" pipline, no calls to csc.exe are made and nothing seems to touch disk (?)
    This allows you to call native methods (!!) from Boolang thorugh PowerShell without the pitfalls of using Add-Type or IronPython's C# Compilation function
-   looking at the source, it seems it's doing this by generating the resulting Assmebly of the Boolang script directly through IL code.
+   looking at the source, it seems it's doing this by generating the resulting Assembly of the Boolang script directly through IL code.
 
 .PARAMETER Arch
 Default = x64: Shellcode Architeture to inject.
@@ -36,9 +36,9 @@ Invoke-JumpScare
 Invoke-JumpScare -Arch x64 -Method InjectRemote -Path .\shellcode.boo
 
 .LINK
-https://github.com/byt3bl33d3r
+https://github.com/byt3bl33d3r/OffensiveDLR
 https://github.com/boo-lang/boo/
-https://github.com/boo-lang/boo/wiki/
+https://github.com/boo-lang/boo/wiki/Scripting-with-the-Boo.Lang.Compiler-API
 #>
 
     param (

README.md

@@ -1 +1,55 @@
 # OffensiveDLR
+
+Toolbox containing research notes & PoC code for weaponizing .NET's DLR
+
+## Contents
+
+| Script | Description|
+| --- | --- |
+| `Invoke-JumpScare.ps1` | Executes shellcode using an embedded Boolang compiler, nothing touches disk (at least from what I've seen) and no calls to csc.exe are made :) |
+| `Invoke-IronPython.ps1`  | Executes IronPython code using the embedded IPY engine. Same concept as `Invoke-JumpScare` only using IronPython. |
+| `runBoo.cs` | C# version of `Invoke-JumpScare`. Executes shellcode using an embedded Boolang compiler.|
+| `minidump.boo` | Native Boolang script to dump memory using `MiniDumpWriteDump` |
+| `shellcode.boo`| Native Boolang script that executes shellcode. Currently contains 3 diffrent techniques (QueueUserAPC, CreateThread/WaitForSingleObject, WriteProcessMemory/CreateRemoteThread) |
+
+## Why?
+The .NET DLR is just straight up bonkers, it allows you to do crazy things like embed freaking compilers/engines within other .NET languages (e.g PowerShell & C#) while still remaining Opsec safe & staying in memory.
+In IronPython's case, you can even have what I call 'engine inception': wanna embed a IPY engine within an IPY engine within another IPY engine? (yo dawg, I heard you liked IPY engines...).
+
+From an offensive perspective this has an insane amount of flexibility and a number of advantages, to name a few:
+
+1. Crazy amounts of reflection/embedding going on all the time, which means more evasion.
+
+2. Using the DLR you always bypass AMSI (if you properly instrument your payloads), no need to obfuscate, patch stuff etc..
+
+3. All your 'evil' can be coded in the language of your embedded engine/compiler. If you do this using PowerShell, ScriptBlock Logging sees nothing since all the magic happens in the DLR.
+
+4. Usually, all of the DLR languages have a way of calling native methods either through the language itself or by dynamically compiling C# (e.g PowerShell's Add-Type).
+   If you go with the former method, no calls to `csc.exe` are made and usually nothing is dropped to disk as the languages generate everything needed in memory through IL code.
+   We can go as "...low and high as we want.." (@Op_nomad) & this allows us to do all the good stuff we all love (inject shellcode, unmanaged DLLs, load PEs etc..)
+
+5. Allows for quick re-tooling and weaponization of payloads. No manual compilation is necessary.
+
+# Other Offensive DLR projects
+
+If you're interested in this, here's some other tools that also try to weponize the DLR:
+
+- https://github.com/dsnezhkov/typhoon
+- https://github.com/byt3bl33d3r/SILENTTRINITY
+
+# Credits
+ - @Op_nomad
+ - @subtee
+ - @pwndizzle
+ - @malcomvetter
+ - @harmj0y
+
+##  References
+
+Fair warning, if you start reading this stuff it's gonna send you down a hellish rabbit hole (with actual deamon rabbits)
+
+- https://github.com/boo-lang/boo/wiki/Scripting-with-the-Boo.Lang.Compiler-API
+- https://github.com/boo-lang/boo/wiki/Invoke-Native-Methods-with-DllImport
+- https://github.com/pwndizzle/c-sharp-memory-injection
+- http://www.voidspace.org.uk/ironpython/winforms/part10.shtm
+- https://www.codeproject.com/Articles/53611/%2FArticles%2F53611%2FEmbedding-IronPython-in-a-C-Application

minidump.boo

@@ -6,7 +6,7 @@ from System.IO import FileStream, FileMode, FileAccess,FileShare
 Author: Marcello Salvati (@byt3bl33d3r)
 License: BSD 3-Clause
 
-This Boolang source file can be run directly with the booi.exe interpreter or using the embedded compiler in runBoo.cs
+This Boolang source file can be run directly with the booi.exe interpreter or using the embedded compiler in runBoo.cs/Invoke-JumpScare.ps1
 
 */