DCOMIllusionist — fileless lateral movement via DCOM and .NET deserialization

At the x33fcon conference, Synacktiv introduced a tool for stealthy remote code execution on Windows hosts with administrative privileges. The tool leverages .NET DCOM servers that automatically deserialize incoming objects, enabling command execution or DLL loading entirely in memory without writing files to disk. It's useful for post‑exploitation activities and moving between sessions within a domain.

Features: • Execute commands via --exec and --ps-exec with session selection (--session) • Load a DLL and invoke a class method directly in memory via --load-dll, --dll-class, --dll-method • Create HTTP requests under another session's context (--curl) for NTLM relay attacks • Generate and execute ysoserial payloads (--yso-b64) • Manage local and remote registry modifications (--local-registry-only, --remote-registry-only) • Display a list of remote interactive and active sessions on the target device (--list-sessions) • Test network connectivity to the target from the attacker's host (--test-network)

Tool: https://github.com/synacktiv/DCOMIllusionist