{
  "name": "assemblyExec",
  "display_name": "assemblyExec",
  "kind": "module",
  "description": "Execute shellcode in the current beacon using a thread, process, or spoofed-parent process mode. Donut inputs are prepared by the TeamServer shellcode service before the task is sent to the beacon.",
  "command_template": "assemblyExec [--mode {mode}] [--raw {raw:q}] [--donut-exe {donut_exe:q}] [--donut-dll {donut_dll:q}] [--method {method:q}] [-- {arguments:raw}]",
  "target": "beacon",
  "requires_session": true,
  "platforms": ["windows"],
  "archs": ["x86", "x64", "arm64"],
  "args": [
    {
      "name": "--mode",
      "type": "flag",
      "required": false,
      "description": "Execution mode. Defaults to process.",
      "values": ["thread", "process", "processWithSpoofedParent"]
    },
    {
      "name": "--raw",
      "type": "flag",
      "required": false,
      "description": "Use an existing raw shellcode file on the TeamServer.",
      "artifact_filter": {
        "category": "tool",
        "scope": "server",
        "target": "teamserver",
        "platform": "windows",
        "arch": "session.arch",
        "runtime": "any",
        "format": "bin",
        "name_contains": ".bin"
      }
    },
    {
      "name": "--donut-exe",
      "type": "flag",
      "required": false,
      "description": "Generate shellcode from a .NET executable on the TeamServer.",
      "artifact_filter": {
        "category": "tool",
        "scope": "server",
        "target": "teamserver",
        "platform": "windows",
        "arch": "session.arch",
        "runtime": "any",
        "format": "exe",
        "name_contains": ".exe"
      }
    },
    {
      "name": "--donut-dll",
      "type": "flag",
      "required": false,
      "description": "Generate shellcode from a .NET DLL on the TeamServer.",
      "artifact_filter": {
        "category": "tool",
        "scope": "server",
        "target": "teamserver",
        "platform": "windows",
        "arch": "session.arch",
        "runtime": "any",
        "format": "dll",
        "name_contains": ".dll"
      }
    },
    {
      "name": "source_path",
      "type": "path",
      "required": true,
      "description": "Raw shellcode, .NET executable, or .NET DLL path on the TeamServer."
    },
    {
      "name": "--method",
      "type": "flag",
      "required": false,
      "description": "Required for --donut-dll."
    },
    {
      "name": "arguments",
      "type": "text",
      "required": false,
      "description": "Arguments passed to the Donut source after --.",
      "variadic": true
    }
  ],
  "examples": [
    "assemblyExec --mode process --raw shellcode.bin",
    "assemblyExec --mode thread --donut-exe Seatbelt.exe -- -group=system",
    "assemblyExec --mode process --donut-dll Tool.dll --method EntryPoint -- arg1 arg2"
  ],
  "source": "manifest"
}