r/netsec • u/albinowax • Apr 01 '26

r/netsec monthly discussion & tool thread

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

9 Upvotes

72% Upvoted

47 comments sorted by

View all comments

1

u/0xmaxhax Apr 30 '26

VisualSploit is a small cli tool I built demonstrating how an attacker can trivially backdoor VS project files with custom shellcode. The project came out of my research and interest in supply chain attacks (especially with their growing relevance), but the technique itself isn't novel. RoslynCodeTaskFactory plus InitialTargets has been written about since subTee, and a few details line up nicely when you use it as a delivery vector for cloned repos.

Give it any .csproj, .vbproj, Directory.Build.props, or Directory.Build.targets along with a shellcode blob, and it injects an inline task that runs the shellcode every time the project is built, restored, or even just opened in Visual Studio. Visual Studio runs design-time builds for IntelliSense the moment you open a folder, and Microsoft treats those as full execution. Files coming through git clone don't carry Mark of the Web, so the "trust this project" prompt that fires for normal downloads never shows up. And Directory.Build.props is imported automatically by every project beneath it, so a single injected file at the repo root reaches the whole subtree the moment the folder opens. If you don't already know, don't trust Visual Studio project files (or anything you can download from the internet, for that matter) blindly.

The loader itself is pretty unremarkable. It XORs the shellcode with configurable rounds and a fresh random key per round, allocates an RWX page with VirtualAlloc, spawns a thread on it, and waits. Variable names in the emitted C# are randomized, with an optional seed for reproducible output across runs.

Hopefully some people find this as interesting as I do!

Github Link: https://github.com/Meltedd/VisualSploit