Skip to content

Latest commit

 

History

History
101 lines (59 loc) · 3.76 KB

T1127.001.md

File metadata and controls

101 lines (59 loc) · 3.76 KB
Raw

T1127.001 - MSBuild

Description from ATT&CK

Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild)

Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file.(Citation: MSDN MSBuild)(Citation: Microsoft MSBuild Inline Tasks 2017) MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.(Citation: LOLBAS Msbuild)

Atomic Tests


Atomic Test #1 - MSBuild Bypass Using Inline Tasks (C#)

Executes the code in a project file using msbuild.exe. The default C# project example file (T1127.001.csproj) will simply print "Hello From a Code Fragment" and "Hello From a Class." to the screen.

Supported Platforms: Windows

Inputs:

Name Description Type Default Value
filename Location of the project file Path PathToAtomicsFolder\T1127.001\src\T1127.001.csproj
msbuildpath Default location of MSBuild Path C:\Windows\Microsoft.NET\Framework\v4.0.30319
msbuildname Default name of MSBuild Path msbuild.exe

Attack Commands: Run with command_prompt!

#{msbuildpath}\#{msbuildname} #{filename}

Dependencies: Run with powershell!

Description: Project file must exist on disk at specified location (#{filename})
Check Prereq Commands:
if (Test-Path #{filename}) {exit 0} else {exit 1}
Get Prereq Commands:
New-Item -Type Directory (split-path #{filename}) -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1127.001/src/T1127.001.csproj" -OutFile "#{filename}"


Atomic Test #2 - MSBuild Bypass Using Inline Tasks (VB)

Executes the code in a project file using msbuild.exe. The default Visual Basic example file (vb.xml) will simply print "Hello from a Visual Basic inline task!" to the screen.

Supported Platforms: Windows

Inputs:

Name Description Type Default Value
filename Location of the project file Path PathToAtomicsFolder\T1127.001\src\vb.xml
msbuildpath Default location of MSBuild Path C:\Windows\Microsoft.NET\Framework\v4.0.30319
msbuildname Default name of MSBuild Path msbuild.exe

Attack Commands: Run with command_prompt!

#{msbuildpath}\#{msbuildname} #{filename}

Dependencies: Run with powershell!

Description: Project file must exist on disk at specified location (#{filename})
Check Prereq Commands:
if (Test-Path #{filename}) {exit 0} else {exit 1}
Get Prereq Commands:
New-Item -Type Directory (split-path #{filename}) -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1127.001/src/vb.xml" -OutFile "#{filename}"