RedSiege / EXCELntDonut

Excel 4.0 (XLM) Macro Generator for injecting DLLs and EXEs into memory.
GNU General Public License v3.0
500 stars 96 forks source link

The type or namespace name `Automation' does not exist in the namespace `System.Management' #5

Closed stormyordos closed 4 years ago

stormyordos commented 4 years ago

Hi, Using EXCELntDonut on Kali with a standard distro installed, I generated a CSharp payload from PowerShell Empire and tried using this project to compile and embed it into an XLS. However, the compilation gives me this error:

The type or namespace nameAutomation' does not exist in the namespace System.Management'. Are you missing an assembly reference?

My command is as follows: `` EXCELntDonut -f test.cs -r System.Windows.Forms.dll,System.Management --sandbox --obfuscate

The test program contains the following uses:

using System; using System.Text; using System.Management.Automation; using System.Management.Automation.Runspaces;

Adding "System.Management.Automation" to references doesn't work as the assembly doesn't seem to exist in the mono installation, and adding the assembly manually creates further problems with runspaces. Is there something simple I'm missing?

joeleonjr commented 4 years ago

If you can send the C# payload in a gist, we'd be happy to take a closer look. But from what you mentioned, here's what I'd try:

  1. Install pwsh on Kali. (Instructions are here: https://docs.microsoft.com/en-us/powershell/scripting/install/installing-powershell-core-on-linux?view=powershell-7#debian-10)
  2. When you run EXCELntDonut, try referencing the /microsoft/powershell/6/pwsh.dll file. Note that the version of powershell and the location where you install it might differ from what I just put there, but the path should look similar. No guarantee that works, but mono didn't seem to complain when I provided it that path. But again, if you send over a gist, we'll investigate more.
joeleonjr commented 4 years ago

Going to close this for now. Please re-open if you're still having an issue after following the comment above. Thank you!