D1T2 - Attacking Microsoft’s .NET Framework Through CLR
summary
Research maps concrete CLR attack paths and tools and shows working exploits and measurements. A SQL Server CLR exploit and automation load arbitrary MSIL into SQL Server and get administrator privileges. A backdoor via CLR hijack replaces assemblies to persist across .NET apps. Office VSTO documents convert from document‑level to program‑level customizations to execute quietly and a VSTO doc→program conversion yields ~40% success versus macros 11–14% and DDE ~30%. A fuzzer for MSIL injection finds an Office crash bug.
AI-written summary · about
chapters (8)
- 0:00Introduction to research
- 1:43Overview of .NET Framework
- 13:32CLR hosting and metadata
- 27:51Methodology for code injection
- 35:16VSTO attack surface
- 49:27Exploit kit analysis
- 55:27Fuzzing CLR for bugs
- 56:12Q&A session
related talks
43mHunting for Bugs, Catching Dragons
56mHacking .NET(C#) Applications: The Black Arts (ASM attacks)
49mDeserialization vulns: past, present, and future
36mGive Me a SQL Injection, I Shall PWN IIS and SQL Server
51mOffice in Wonderland
50m.NET Reversing and Exploitation for Cool Kids
21mBattle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
45mThe Code Behind The Vulnerability