GCIH · Question #815
Which step would an attacker likely take before using MSBuild.exe?
The correct answer is B. Translate attack code into C#. MSBuild.exe executes inline C# code from project files, so an attacker must first encode their shellcode as a C# wrapper before invoking it as a living-off-the-land binary.
Question
Which step would an attacker likely take before using MSBuild.exe?
Options
- AInstall MSBuild.exe to %SYSTEMROOT%
- BTranslate attack code into C#
- CMake changes to Windows Firewall
How the community answered
(37 responses)- A5% (2)
- B81% (30)
- C14% (5)
Why each option
MSBuild.exe executes inline C# code from project files, so an attacker must first encode their shellcode as a C# wrapper before invoking it as a living-off-the-land binary.
MSBuild.exe is included natively with the .NET Framework and is already present on Windows systems, so no installation step is required before it can be abused as a LOLBin.
MSBuild.exe processes .csproj or inline task XML files that contain C# source code; an attacker must translate their payload (such as msfvenom shellcode) into a valid C# class or inline build task so MSBuild can compile and execute it in memory, bypassing application whitelisting controls.
MSBuild is a local code compilation tool and does not require outbound network access to function as a LOLBin, making firewall modifications unnecessary for this attack technique.
Concept tested: Living-off-the-land MSBuild.exe shellcode execution
Source: https://attack.mitre.org/techniques/T1127/001/
Topics
Community Discussion
No community discussion yet for this question.