diff --git a/atomics/T1500/T1500.yaml b/atomics/T1500/T1500.yaml index 5d5c0d02..6e54bfad 100644 --- a/atomics/T1500/T1500.yaml +++ b/atomics/T1500/T1500.yaml @@ -30,7 +30,6 @@ atomic_tests: New-Item -Type Directory (split-path #{input_file}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1500/src/calc.cs" -OutFile "#{input_file}" - executor: name: command_prompt elevation_required: false @@ -38,3 +37,34 @@ atomic_tests: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:#{output_file} #{input_file} cleanup_command: | del #{output_file} >nul 2>&1 + +- name: Dynamic C# Compile + description: | + When C# is compiled dynamically, a .cmdline file will be created as a part of the process. + Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution. + The exe file that will be executed is named as T1500_DynamicCompile.exe is containted in the 'bin' folder of this atomic, and the source code to the file is in the 'src' folder. + Upon execution, the exe will print 'T1500 Dynamic Compile'. + + supported_platforms: + - windows + + input_arguments: + input_file: + description: exe program containing dynamically compiled C# code + type: Path + default: PathToAtomicsFolder\T1500\bin\T1500_DynamicCompile.exe + + dependency_executor_name: powershell + dependencies: + - description: | + exe file must exist on disk at specified location (#{input_file}) + prereq_command: | + if (Test-Path #{input_file}) {exit 0} else {exit 1} + get_prereq_command: | + Invoke-WebRequest https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1500/bin/T1500_DynamicCompile.exe -OutFile #{input_file} + + executor: + name: powershell + elevation_required: false + command: | + Invoke-Expression #{input_file} diff --git a/atomics/T1500/bin/T1500_DynamicCompile.exe b/atomics/T1500/bin/T1500_DynamicCompile.exe new file mode 100644 index 00000000..deb3f676 Binary files /dev/null and b/atomics/T1500/bin/T1500_DynamicCompile.exe differ diff --git a/atomics/T1500/src/DynamicCompile.cs b/atomics/T1500/src/DynamicCompile.cs new file mode 100644 index 00000000..554c79c3 --- /dev/null +++ b/atomics/T1500/src/DynamicCompile.cs @@ -0,0 +1,43 @@ +using Microsoft.CSharp; +using System.CodeDom.Compiler; +using System.Reflection; + + +namespace T1500_DynamicCompile +{ + class Program + { + static void Main(string[] args) + { + CSharpCodeProvider provider = new CSharpCodeProvider(); + CompilerParameters parameters = new CompilerParameters(); + parameters.GenerateInMemory = true; + parameters.ReferencedAssemblies.Add("System.dll"); + + CompilerResults results = provider.CompileAssemblyFromSource(parameters, GetCode()); + + var cls = results.CompiledAssembly.GetType("DynamicNS.DynamicCode"); + var method = cls.GetMethod("DynamicMethod", BindingFlags.Static | BindingFlags.Public); + method.Invoke(null, null); + } + + static string[] GetCode() + { + return new string[] + { + @"using System; + + namespace DynamicNS + { + public static class DynamicCode + { + public static void DynamicMethod() + { + Console.WriteLine(""T1500 Dynamic Compile""); + } + } + }" + }; + } + } +}