Fun Ways to Run Code in .NET

No ratings

Presented at GrrCON Cyber Security Summit and Hacker Conference 2023 by

Nicholas Spagnola

The .NET framework provides offensive security experts with a plethora of ways to execute code. Some of these methods range from the .NET reflection library, DLL injection, and taking advantage of the .NET Just-In-Time Compiler. Offensive security practitioners can leverage these techniques to bypass security controls such as AppLocker or to find ways to load their malicious code in a different process, without being stopped by EDRs. This presentation will demonstrate multiple ways to run code with the .NET framework. Attendees will learn how to leverage the reflection library to load and execute code completely in memory. Attendees will also see how to leverage Microsoft signed programs (lolbins) to execute .NET code within the memory of those processes. Additionally, attendees will see how to abuse functionality of the .NET framework to execute code by performing actions such as leveraging .NET profiling and custom garbage collectors to load a DLL into .NET processes as well as abusing the way .NET code is compiled to hijack .NET methods.