This document summarizes techniques for red teaming using the .NET framework in 3 parts. It discusses [1] executing custom assemblies using Windows Script Host file smuggling techniques, [2] achieving persistence by hooking the Common Language Runtime, and [3] influencing applications to load arbitrary assemblies. References are provided for further related research on .NET instrumentation, offensive retooling, and GadgetToJScript.

1. A Study on .NET Framework for Red Team –
Part I
@ 若渴 2019.10.20
<ajblane0612@gmail.com>
AjMaChInE

2. Reference
[0] 2019, IronPython… OMFG Introducing BYOI
Payloads (Bring Your Own Interpreter)
[1] 2019, Common Language Runtime Hook for
Persistence
[2] 2019, .NET Manifesto
[3] 2019, Executing C# Assemblies from Jscript and
wscript with DotNetToJscript
[4] 2017, .NET HIJACKING to DEFEND POWERSHELL
[5] 2014, .NET Framework Rootkits

3. WSH – Window Script Host
DLR – Dynamic Language Runtime
CLR – Common Language Runtime
BYOI – Bring Your Own Interpreter
ADM – Application Domain Manager
MSIL – Microsoft Intermediate Language

4. [0]

6. [1]

7. [1]

8. BYOI – Bring Your Own Interpreter

9. [0]

10. [0]

11. [0]

12. WSH File Smuggling

13. Executing C# Assemblies from Jscript and
wscript with DotNetToJscript [3]
● WSH (Window Script Host)
● Embedded lanuage & binding, like .NET
● Jscript -> .NET
● File smuggling
● Jscript
– data (own assembly) -> save file -> load
file -> execution

14. Can it be used to reach file smuggling?
[2]

15. Persistence

16. CLR Profiler Dynamic DLL Hook Injection
Specifying the CLR environment
Defining the CLR Profiler
[4]

17. ModuleLoadFinished CLR Profiler for
Hooking
[4]

18. Common Language Runtime Hook for
Persistence [1] – Step 0

19. Common Language Runtime Hook for
Persistence [1] – Step 1

20. Common Language Runtime Hook for
Persistence [1] – Step 2

21. Common Language Runtime Hook for
Persistence [1] – Step 3

22. Common Language Runtime Hook for
Persistence [1] – Step 4

23. Common Language Runtime Hook for
Persistence [1] – Result

24. How to Influence/Encourage Any .NET Application in System32
to Load Arbitrary Assembly [2]

25. [2]

26. [2]

27. .NET-Spolit [5]
[5]
[Microsoft Docs]

28. Futher Study
● 2018, .NET Instrumentation via MSIL bytecode injection
● 2018, Offensive Retooling in donet for Red Team
● med0x2e/GadgetToJScript