search

mgeeky / Stracciatella

OpSec-safe Powershell runspace from within C# (aka SharpPick) with AMSI, Constrained Language Mode and Script Block Logging disabled at startup
GNU General Public License v3.0
495 stars 64 forks source link

Remove lower-case conversion of assemblyName var due execution problem #11

Closed Kucharskov closed 2 years ago

Kucharskov commented 2 years ago

Hi (again)! Im playing with that tool and notices strange problem with running via BOF.NET (this fork https://github.com/williamknows/BOF.NET)

When i loaded an BOF.NET and Stracciatella using "bofnet_init" and "bofnet_loadstracciatella" im trying to run simply "pwd" command. But im getting error message "[!] Cannot continue execution, specified .NET assembly not loaded". So i just copied command after "via" keyword and changed "s" in "Straciatella" to uppercase (as Stracciatella.exe filename) the execution works perfectly image

I fixed it locally just commenting out the line mentioned below and it works perfectly! https://github.com/mgeeky/Stracciatella/blob/a7d3d252ef0c24ea0bbb45b49dc231be8a1b8f80/stracciatella.cna#L274

You can merge it or analyze why i this problem appear

Amazing tool! Purple regards ;)

mgeeky commented 2 years ago

Hi Michał! :)

Amazing catch you found here! The reason we never experienced the issue mentioned is because our BOF.NET fork has special logic implemented letting us refer to loaded .NET assemblies in a case-insensitive manner. If not for that, I can imagine current CNA form could have been broking Stracciatella's integration with publicly shared BOF.NET.

Thanks again for the PR, its landed now! :)