GadgetToJScript: generating .NET serialized gadgets that can trigger .NET assembly load/execution

by do son · Published October 14, 2019 · Updated October 14, 2019

GadgetToJScript

A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS based scripts.
The gadget being used triggers a call to Assembly.Load when deserialized via jscript/vbscript, this means it can be used in the same way to trigger the in-memory load of your own shellcode loader at runtime.

Lastly, the tool was created mainly for automating WSH scripts weaponization for RT engagements (LT, Persistence), the shellcode loader which was used for PoC is removed and replaced by an example assembly implemented in the “TestAssemblyLoader.cs” class for PoC purpose.

TLDR

Generates js, vbs, hta, vba.
Bypasses AMSI without having to update the AmsiEnable registry key or Hijack loadlibrary (AMSI.dll), basically, it is more of a signature-based bypass at the moment.
Bypasses .NET 4.8+ newly introduced controls for blocking “Assembly.Load”

Details

Leverages ActivitySurrogateSelector to create a Surrogate class which act as a wrapper to deserialize a gadget built in a way to trigger a call to “Activator.CreateInstance(Assembly.Load(your_assembly_bytes).GetType())”.
Bypasses AMSI (to be specific, bypasses AMSI signature based detection) => Does not require “d.DynamicInvoke(al.ToArray()).CreateInstance(entry_class)”
Leveraging TextFormattingRunProperties based gadget as a first deserialization stage to disable ActivitySurrogateSelector Type check therefore bypassing fixes introduced recently in (.NET Framework 4.8+)
Doesn’t rely mainly on exposing a .NET based COM object hence no need to call d.DynamicInvoke(al.ToArray()).CreateInstance(entry_class)
Delegates are being used only to trigger payload execution during deserialization (Func<Assembly, IEnumerable>),a requirement for proper chaining of the gadget elements.
Serialized gadgets or Streams length is calculated at runtime and automatically populated in the generated WSH scripts.
Generates JS/HTA scripts relying on registration-free activation of .NET based COM components, may help in case of generating VBA or registering unregistered COM objects. (In the future maybe, not a requirement unless you wanna avoid “New ActiveXObject” for AV evasion or want to use another alternative of BinaryFormatter which requires registration )