kyleavery / ThirdEye

Weaponizing CLRvoyance for Post-Ex .NET Execution

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

ThirdEye

Weaponizing CLRvoyance by adding the following features:

  • Pass arguments to the target .NET assembly
  • Obfuscate shellcode with SGN

All the credit for this script goes to the Accenture team for their great tool. This repo also includes DonutTest for testing output shellcode.

Usage

  • python3 thirdeye.py PATH_TO_ASSEMBLY

Components

  • CLRvoyance - Generates PIC shellcode, created by Accenture
  • wrapper - .NET assembly wrapper, hardcodes arguments
  • thirdeye.py - Sets up wrapper and generates shellcode with CLRvoyanace

Requirements

  • Only works on Windows currently, should be easy enough to port
  • MSBuild and Python 3.X must be present on the system

About

Weaponizing CLRvoyance for Post-Ex .NET Execution


Languages

Language:Assembly 70.3%Language:C# 17.4%Language:Python 12.2%Language:PowerShell 0.1%