Inject-assembly enables the injection and execution of .NET assemblies into running processes, offering an alternative to traditional methods like fork and run. It addresses the challenge of executing .NET code within a target process while maintaining control and communication with the Beacon. The project utilizes a two-component architecture: a BOF initializer for injecting the loader and a PIC assembly loader for executing the specified assembly.
This project provides features like environment.Exit() patching, assembly header manipulation, and random pipe name generation for enhanced evasion. It allows execution within the current Beacon process and offers a robust solution for bypassing standard execution limitations. The design emphasizes minimizing the footprint of the loader and enabling flexible deployment within Cobalt Strike.
- Process Injection: Supports injection into various processes, including the current Beacon process.
- Assembly Handling: Handles .NET assembly loading, execution, and AppDomain management.
- Evasion Techniques: Includes features to prevent premature process termination and facilitate evasion.
- Named Pipe Communication: Utilizes named pipes for communication between the target process and Beacon.
- Customizable Injection: The BOF initializer allows for custom injection configurations.
- x64 Support: Designed for .NET execution within x64 processes.
- Header Manipulation: Performs assembly header stomping to overcome potential security checks.
Inject-assembly is a mature project with a history of updates and active community discussion. The code base is well-structured and documented, indicating sustained maintenance. Recent commits and issue resolution demonstrate ongoing development efforts. While it has a limited scope, the project provides reliable functionality for advanced execution scenarios within Cobalt Strike.
Inject-assembly benefits penetration testers and red teams by enabling advanced .NET execution techniques within Cobalt Strike. It simplifies execution of custom .NET payloads, provides greater control over the execution environment, and allows for more sophisticated attack scenarios compared to standard execution methods. It's a valuable tool for tasks requiring fine-grained control over process execution and payload delivery.