rapid7/metasploit-framework — pull request #701 by sempervictus (2012-08-18 04:16:48+00:00)
Title: Dynamic Executables via .NET with Hostess' DotNetAvBypass

This pull request adds the following end user functionality:
dynamic .NET code builder module: builds .NET code with powershell
.NET AV Bypass: uses Matt Andreko's .NET AV Bypass as a template and compiles on the remote host
Service template has some additional AV evasion built in (localhost:445 check for sandboxing, delay)
Original sources at https://github.com/mandreko/DotNetAVBypass
Current user psexec: modified to use on-host payloads

Changes in lib allow for cleaner execution of powershell scripts, along with greedy cleanup. Added core methods for generating .NET compiler scripts and powershell .NET elevators (to load different .NET CLR versions into the shell).

At present, the generated payloads pass VT with 0/43 hits. Once in trunk these binaries will be flagged pretty quickly, but additional obfuscation is possible and we request that programmatic obfuscation methods be submitted for pull request. I've not yet found a reasonable way to parse and obfuscate c#/vb.net with ruby or powershell, so suggestions are welcome.