GadgetToJScript: generating .NET serialized gadgets that can trigger .NET assembly load/execution
GadgetToJScript
A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS based scripts.
The gadget being used triggers a call to Assembly.Load when deserialized via jscript/vbscript, this means it can be used in the same way to trigger the in-memory load of your own shellcode loader at runtime.
Lastly, the tool was created mainly for automating WSH scripts weaponization for RT engagements (LT, Persistence), the shellcode loader which was used for PoC is removed and replaced by an example assembly implemented in the “TestAssemblyLoader.cs” class for PoC purpose.
TLDR
- Generates js, vbs, hta, vba.
- Bypasses AMSI without having to update the AmsiEnable registry key or Hijack loadlibrary (AMSI.dll), basically, it is more of a signature-based bypass at the moment.
- Bypasses .NET 4.8+ newly introduced controls for blocking “Assembly.Load”
Details
- Leverages ActivitySurrogateSelector to create a Surrogate class which act as a wrapper to deserialize a gadget built in a way to trigger a call to “Activator.CreateInstance(Assembly.Load(your_assembly_bytes).GetType())”.
- Bypasses AMSI (to be specific, bypasses AMSI signature based detection) => Does not require “d.DynamicInvoke(al.ToArray()).CreateInstance(entry_class)”
- Leveraging TextFormattingRunProperties based gadget as a first deserialization stage to disable ActivitySurrogateSelector Type check therefore bypassing fixes introduced recently in (.NET Framework 4.8+)
- Doesn’t rely mainly on exposing a .NET based COM object hence no need to call d.DynamicInvoke(al.ToArray()).CreateInstance(entry_class)
- Delegates are being used only to trigger payload execution during deserialization (Func<Assembly, IEnumerable>),a requirement for proper chaining of the gadget elements.
- Serialized gadgets or Streams length is calculated at runtime and automatically populated in the generated WSH scripts.
- Generates JS/HTA scripts relying on registration-free activation of .NET based COM components, may help in case of generating VBA or registering unregistered COM objects. (In the future maybe, not a requirement unless you wanna avoid “New ActiveXObject” for AV evasion or want to use another alternative of BinaryFormatter which requires registration )
Download & Use
Copyright (C) 2019 med0x2e
