A powerful CLR (Common Language Runtime) host tool written in Rust that allows you to execute .NET assemblies in-memory with advanced features like AMSI/ETW bypass and output capture. It uses Load_2 call, so it loads a name instead of a buffer, which avoids amsi being loaded. However, I added an AMSI-ETW Bypass using hardware breakpoints.
- In-Memory Execution: Load and execute .NET assemblies without writing to disk
- Multiple Runtime Support: Compatible with .NET Framework versions 2.0, 3.0, and 4.0
- AMSI/ETW Bypass: Optional bypass of Anti-Malware Scan Interface and Event Tracing for Windows
- Output Capture: Automatically captures and displays console output from executed assemblies
- Flexible Argument Passing: Supports passing command-line arguments to the target assembly
- Application Domain Isolation: Runs assemblies in isolated application domains
.\NautilusRuntime.exe [--amsi-etw] [Assembly_Path] -- [arg1 arg2 arg3...]
--amsi-etw: (Optional) Bypass AMSI and ETW before executing the assembly
Assembly_Path: Path to the .NET assembly (.exe) you want to execute
arg1 arg2 arg3...: Arguments to pass to the assembly's entry point (optional)
Basic Assembly Execution
.\NautilusRuntime.exe C:\Tools\MyAssembly.exe
Execute with AMSI/ETW Bypass
.\NautilusRuntime.exe --amsi-etw C:\Tools\RunasCs\RunasCs.exe
Execute with Arguments
.\NautilusRuntime.exe C:\Tools\RunasCs\RunasCs.exe -- hacker hacker123 "cmd /c whoami /all"
Full Example with All Features
.\NautilusRuntime.exe --amsi-etw C:\Tools\RunasCs\RunasCs.exe -- hacker hacker123 "cmd /c whoami /all"
This command will:
- Bypass AMSI and ETW protections
- Load RunasCs.exe in memory
- Execute it with the arguments: hacker, hacker123, and "cmd /c whoami /all"
How It Works
-
Runtime Initialization: Creates a CLR meta host and loads the specified .NET runtime version
-
Assembly Loading: Reads the target assembly into memory and extracts its identity
-
Domain Creation: Creates an isolated application domain for execution
-
Output Redirection: Captures stdout and stderr from the executed assembly
-
Entry Point Execution: Invokes the assembly's Main method with provided arguments
-
Result Display: Shows the captured output from the execution
Windows operating system
.NET Framework (v2.0, v3.0, or v4.0) installed on the target system
The target assembly must be a valid .NET executable
cargo build --release
The tool is designed for penetration testing, red team operations, and legitimate security research, the author is not responsible for the use you may give to the tool
Always ensure you have proper authorization before using this tool
If you encounter issues:
Verify the target .NET Framework version is installed
Much thanks to the following resources that were a must to avoid myself giving up in this learning project.