Missing warning when incorrect flags are used for `execute-assembly` or aliases

[senzee1984]

Describe the bug The execute-assembly command supports -M option, which patches ETW. However, it does not actually patch ETW for the forked process.

To Reproduce Steps to reproduce the behavior:

1. In a session, execute execute-assembly -M -E -p gpupdate.exe sharpup.exe audit
2. Open Process Hacker, select the new child process gpupdate.exe
3. Click .NET assmeblies tab, still can see sharpup

Expected behavior In .NET assemblies tab, the output should be Unable to start the event tracing session: This operation returned beacause the timeout period expired.

Screenshots

[server] sliver (WIDE_HURRY) > execute-assembly -M -E -p gpupdate.exe  /opt/red/sharpup.exe audit

[*] Output:

=== SharpUp: Running Privilege Escalation Checks ===

[*] Already in high integrity, no need to privesc!

[*] Audit mode: running an additional 13 check(s).
[*] Note: Running audit mode in high integrity will yield a large number of false positives.

=== Modifiable Folders in %PATH% ===
        C:\Program Files\Scripts\
        C:\Program Files\
        C:\Windows\system32
        C:\Windows
        C:\Windows\System32\Wbem
        C:\Windows\System32\WindowsPowerShell\v1.0\
        C:\Windows\System32\OpenSSH\
............

Desktop (please complete the following information):

• OS: Kali Linux 2022
• Version v 1.5.33

Additional context If use in-process execute-assembly, the issue does not exist.

[senzee1984]

The issue also applies to aliases.

[rkervella]

The execute-assembly command supports -M option, which patches ETW. However, it does not actually patch ETW for the forked process.

These flags (-M and -E) are only used in conjunction of the --in-process flag, as per the help execute-assembly command:

Usage:
======
  execute-assembly [flags] filepath [arguments...]

Args:
=====
  filepath   string         path the assembly file
  arguments  string list    arguments to pass to the assembly entrypoint (default: [])

Flags:
======
  -M, --amsi-bypass                 Bypass AMSI on Windows (only supported when used with --in-process)
  -E, --etw-bypass                  Bypass ETW on Windows (only supported when used with --in-process)
  -i, --in-process                  Run in the current sliver process
...

When not using the --in-process flag, the Sliver server will convert the assembly to shellcode using go-donut, and instruct the Donut loader to try to patch AMSI/ETW, but continue on failure. When using the --in-process flag, we're manually patching the implant's process instead.

[moloch--]

@rkervella should we add a warning when the flags are used incorrectly?

[rkervella]

Yes, it will help avoid some confusion.