[JoshuaSmith]

So there was a post a while back that shows you how to backdoor vs project file, even know this was known and can be done with almost any IDE I'm going to show you a simple way to detect the backdoor. Also i use the term backdoor because i can't see why anyone would need to download and run software from the project header file but if you have a valid reason then cool idc.

What Components are used within this example:

1. 1 Richtextbox
   


2. 1 Textbox
   


3. 1 button
   


4. Openfiledialog(was lazy so i added this as a component but you can call it with programmatically)
   

Example:

Code

   Me.OpenFileDialog1.InitialDirectory = Application.StartupPath
       Me.OpenFileDialog1.FileName = ""
       Me.OpenFileDialog1.Filter = "C# Project File (*.csproj)|*.csproj|VB Project File (*.vbproj)|*.vbproj|ALL Files (*.*)|*.*"

       If OpenFileDialog1.ShowDialog = Windows.Forms.DialogResult.OK Then
           RichTextBox1.Text = System.IO.File.ReadAllText(OpenFileDialog1.FileName)
           Timer1.Enabled = True
           Label1.Text = "Status: Checking project file for backdoors...."
       Else

       End If

       If RichTextBox1.Text.Contains("Exec") Then
           Label1.Text = "Status: This source contains a backdoor."
           RichTextBox1.Clear()

       Else
           Label1.Text = "Status: This source is clean."
           RichTextBox1.Clear()

       End If

Image of it being used:


PS: idc about making this clean or nice its just an example so if you care more about how i call things then you will be talking to yourself.


Reason of making this example:
VS Code Execution

[Unknown]

I've heard of this type of exploit before, never really thought people used it.

It's really cool that you made a project scanner for it though, I would have never thought about that o.o
I'm amazed at how simplistic it is. Great release!

[Ninja]

I've heard of this type of exploit before, never really thought people used it.

It's really cool that you made a project scanner for it though, I would have never thought about that o.o
I'm amazed at how simplistic it is. Great release!

It's not really an exploit though. It is pretty much a feature in VS. The 'scanner' just looks for the string "Exec", which can be used without ill intend in a VS project. Would be better to have it flag project files that contain "Exec" and then have the user be able to download the files and scan them on an online virus scanner.

[JoshuaSmith]

It's not really an exploit though. It is pretty much a feature in VS. The 'scanner' just looks for the string "Exec", which can be used without ill intend in a VS project. Would be better to have it flag project files that contain "Exec" and then have the user be able to download the files and scan them on an online virus scanner.

you are right but i don't see what other purpose it would have. it would be simple to make a system to detect new headers and check them.

[Ninja]

you are right but i don't see what other purpose it would have. it would be simple to make a system to detect new headers and check them.

Maybe third party programs that are in executable form are required to work with the project? I can't think of many uses either, but since the Microsoft dev team decided to implement it I am sure there is a use.

[Barret]

Been a long time ive laughed so hard XD

[Washi]

PHP Code


<?php 
If RichTextBox1.Text.Contains("Exec") Then 


Whelp, suddenly all my projects consisting of files with a name containing Exec will be flagged.

It's like saying:

PHP Code


<?php 
If File.Contains("Virus") Then
   MessageBox.Show("Virus detected!")
End If 


And it would flag all anti virus programs too :/

[Ninja]

I kind of agree with the dude above me, and as harsh as it may sound, but this is ridiculous. A tutorial for checking a string for an occurrence of another string?

[JoshuaSmith]

PHP Code


<?php 
If RichTextBox1.Text.Contains("Exec") Then 


Whelp, suddenly all my projects consisting of files with a name containing Exec will be flagged.

It's like saying:

PHP Code


<?php 
If File.Contains("Virus") Then
   MessageBox.Show("Virus detected!")
End If 


And it would flag all anti virus programs too :/

well obviously you don't code what so ever because I'm not checking file names. cheers for making yourself the stupidest person on hf :)

---

I kind of agree with the dude above me, and as harsh as it may sound, but this is ridiculous. A tutorial for checking a string for an occurrence of another string?

i can't see how unless you follow in the same ignorant lines he does.

---

Been a long time ive laughed so hard XD

i know this shit is garbage but its just an example and i really couldn't careless but not possible as the guy below you just made himself look so fucking stupid come back

[Washi]

well obviously you don't code what so ever because I'm not checking file names. cheers for making yourself the stupidest person on hf :)

---

Oh shit you got me.

And obviously you don't know the format of the csproj and vbproj files  😅 .

I wonder what these are in one of my csproj files:
Spoiler (Click to View)

[JoshuaSmith]

Oh shit you got me.

And obviously you don't know the format of the csproj and vbproj files  😅 .

I wonder what these are in one of my csproj files:
Spoiler (Click to View)

Well sir those are the classes you get when importing the name spaces from the .net framework's sdk which allows you to call functions.


at one point yesterday i looked at your github and thought i might have made a mistake or you just didnt read the code before posting. now im 98.7 % sure you are not a programmer.

[Vyxn]

That Washi was an incredible guy. I've check his work and I must say that his knowledge is so much far ahead from yours. 😊

[Washi]

Well sir those are the classes you get when importing the name spaces from the .net framework's sdk which allows you to call functions.

at one point yesterday i looked at your github and thought i might have made a mistake or you just didnt read the code before posting. now im 98.7 % sure you are not a programmer.

You are 98.7% sure I am not a programmer. That means there is still a chance that I am! Phew, lucky me.

Unfortunately you are wrong about the namespaces from the .NET Framework's SDK :(. First of all these are not namespaces or classes that are defined here, these are source code files. Secondly, these are my own files containing my own classes. Have a look at the reference of the MSBuild project file format. The Compile tag is part of the Item tag class, which instructs the msbuild evaluator to include a file for compilation (source: https://msdn.microsoft.com/en-us/library/ms164283.aspx ).

Do I really have to show you my solution explorer? Let us compare, shall we?:
Spoiler (Click to View)



Looks awfully similar, right? If you are still not convinced, have a better look at https://github.com/Washi1337/AsmResolver...smResolver and download the project yourself :D

Seriously though, I am not trying to bash you or anything, I am just stating that your method of detecting backdoors is not so reliable, as you are testing the entire project xml file, and not just the parts that may include the Exec tag.

[GhostCode]

Your way of detecting a "backdoor" is basically looking for a substring in a text file. 
Reading your replies to the previous posts shows that you have literally no idea what you are talking about.
Your code would even flag a .csproj file as dangerous if the project name is Exec because the project name is stored in the .csproj file as well.
So, even tho there is no real use case for this code you can at least use XML parsing to find the tag ...

[JoshuaSmith]

You are 98.7% sure I am not a programmer. That means there is still a chance that I am! Phew, lucky me.

Unfortunately you are wrong about the namespaces from the .NET Framework's SDK :(. First of all these are not namespaces or classes that are defined here, these are source code files. Secondly, these are my own files containing my own classes. Have a look at the reference of the MSBuild project file format. The Compile tag is part of the Item tag class, which instructs the msbuild evaluator to include a file for compilation (source: https://msdn.microsoft.com/en-us/library/ms164283.aspx ).

Do I really have to show you my solution explorer? Let us compare, shall we?:
Spoiler (Click to View)



Looks awfully similar, right? If you are still not convinced, have a better look at https://github.com/Washi1337/AsmResolver...smResolver and download the project yourself :D

Seriously though, I am not trying to bash you or anything, I am just stating that your method of detecting backdoors is not so reliable, as you are testing the entire project xml file, and not just the parts that may include the Exec tag.

if took the time to read the thread you would see


This with in my thread:

Code

PS: idc about making this clean or nice its just an example so if you care more about how i call things then you will be talking to yourself.

yes 98.7% because i did have a look and hoped what you said earlier what misinterpreted by me or miss said by you.


@ GhostCode: xml parsing would be better and yea reading the file is an unreliable way to do it but im just trying to make a simple poc to show people how easy it would be to detect this within the project header.

also some of the those source files have names that look similar to the namespaces or references within the sdk but i did see some odd ones like LazyValue.cs. also they are class files/namespaces which still call with in the sdk so.....