🪟 LOLBAS / Msbuild.exe

Msbuild.exe

Used to compile and execute code

Paths

  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\Msbuild.exe
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Msbuild.exe
  • C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
  • C:\Windows\Microsoft.NET\Framework64\v3.5\Msbuild.exe
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Msbuild.exe
  • C:\Program Files (x86)\MSBuild\14.0\bin\MSBuild.exe

Commands

AWL Bypass

Build and execute a C# project stored in the target XML file.

Use case: Compile and run code

Privileges: User

msbuild.exe {PATH:.xml}

Execute

Build and execute a C# project stored in the target csproj file.

Use case: Compile and run code

Privileges: User

msbuild.exe {PATH:.csproj}

Execute

Executes generated Logger DLL file with TargetLogger export.

Use case: Execute DLL

Privileges: User

msbuild.exe /logger:TargetLogger,{PATH_ABSOLUTE:.dll};MyParameters,Foo

Execute

Execute JScript/VBScript code through XML/XSL Transformation. Requires Visual Studio MSBuild v14.0+.

Use case: Execute project file that contains XslTransformation tag parameters

Privileges: User

msbuild.exe {PATH:.proj}

Execute

By putting any valid msbuild.exe command-line options in an RSP file and calling it as above will interpret the options as if they were passed on the command line.

Use case: Bypass command-line based detections

Privileges: User

msbuild.exe @{PATH:.rsp}

Detection

Resources