SharpShooter is a payload creation framework for the retrieval and execution of arbitrary CSharp source code. SharpShooter is capable of creating payloads in a variety of formats, including HTA, JS, VBS and WSF. It leverages James Forshaw’s [ DotNetToJavaScript ]() tool to invoke methods from the SharpShooter DotNet serialised object. Payloads can be retrieved using Web or DNS delivery or both; SharpShooter is compatible with the MDSec ActiveBreach PowerDNS project. Alternatively, stageless payloads with embedded shellcode execution can also be generated for the same scripting formats. SharpShooter payloads are RC4 encrypted with a random key to provide some modest anti-virus evasion, and the project includes the capability to integrate sandbox detection and environment keying to assist in evading detection. SharpShooter includes a predefined CSharp template for executing shellcode with staged and stageless payloads, but any CSharp code can be compiled and invoked in memory using reflection, courtesy of CSharp’s CodeDom provider. Finally, SharpShooter provides the ability to bundle the payload inside an HTML file using the [ Demiguise HTML smuggling ]() technique. SharpShooter targets v2, v3 and v4 of the .NET framework which will be found on most end-user Windows workstations. Version 1.0 of SharpShooter introduced several new concepts, including COM staging, execution of Squiblydoo and Squiblytwo, as well as XSL execution. To acomplish this new functionality, several new flags were added; –com, –awl and –awlurl. ## Usage – Command Line Mode: SharpShooter is highly configurable, supporting a number of different payload types, sandbox evasions, delivery methods and output types. Running SharpShooter with the –help argument will produce the following output: usage: SharpShooter.py [-h] [--interactive] [--stageless] [--dotnetver ] [--com ] [--awl ] [--awlurl ] [--payload ] [--sandbox ] [--delivery ] [--rawscfile ] [--shellcode] [--scfile ] [--refs ] [--namespace ] [--entrypoint ] [--web ] [--dns ] [--output ] [--smuggle] [--template ] optional arguments: -h, --help show this help message and exit --interactive Use the interactive menu --stageless Create a stageless payload --dotnetver Target .NET Version: 2 or 4 --com COM Staging Technique: outlook, shellbrowserwin, wmi, wscript, xslremote --awl Application Whitelist Bypass Technique: wmic, regsvr32 --awlurl URL to retrieve XSL/SCT payload --payload Payload type: hta, js, jse, vba, vbe, vbs, wsf --sandbox Anti-sandbox techniques: [1] Key to Domain (e.g. 1=CONTOSO) [2] Ensure Domain Joined [3] Check for Sandbox Artifacts [4] Check for Bad MACs [5] Check for Debugging --delivery Delivery method: web, dns, both --rawscfile Path to raw shellcode file for stageless payloads --shellcode Use built in shellcode execution --scfile Path to shellcode file as CSharp byte array --refs References required to compile custom CSharp, e.g. mscorlib.dll,System.Windows.Forms.dll --namespace Namespace for custom CSharp, e.g. Foo.bar --entrypoint Method to execute, e.g. Main --web URI for web delivery --dns Domain for DNS delivery --output Name of output file (e.g. maldoc) --smuggle Smuggle file inside HTML --template Name of template file (e.g. mcafee) [ ![Payload Generation Framework: SharpShooter](https://d21ic6tdqjqnyw.cloudfront.net/wp-content/uploads/2016/04/08083124/documentation1.jpg) ]() [ ![Payload Generation Framework: SharpShooter](https://d21ic6tdqjqnyw.cloudfront.net/wp-content/uploads/2016/05/08082805/Download3-1024x154.png) ]()

Source	Link
github	www.github.com/tyranid/DotNetToJScript
github	www.github.com/nccgroup/demiguise
github	www.github.com/mdsecactivebreach/SharpShooter