Introduction to Windows Evasion: LOLBAS: InstallUtil, The module was expected to contain an assembly manifest

HTB Content
, ,
1

I’ve spent lots of hours getting stuck on small things, and some of the step by step instructions do not work or do not output what the tutorial claims they should, so any help would be appreciated.
Here are some issues I faced:

In the LOLBAS: InstallUtil section.
I ran the following command:
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U MichaelUtil.exe
and got this error:
Exception occurred while initializing the installation:
System.BadImageFormatException: Could not load file or assembly ‘file:///C:\Users\champ\source\repos\MichaelUtil\MichaelUtil\bin\x64\Release\net8.0\MichaelUtil.exe’ or one of its dependencies. The module was expected to contain an assembly manifest…

This command is being run from the x64/Release folder of my Visual Studio project.
I followed the instructions closely, compiling for release with arm64 and x64 as the instructions asked.

The next Section, LOLBAS: RunDll32 seems to be missing some things. It expects for there to exist a HackTheBox Package Source in a Visual Studio project they have us build from scratch, but that doesn’t exist.

A later section, Powershell ConstrainedLanguageMode, throws an error, TypeLoadException: Could not load type ‘System.Diagnostics.Eventing.EventDescriptor’ from assembly 'System.Core, Version=4.0.0.0, Culture=neutral,
when it reaches the Runspace runspace = RunspaceFactory.CreateRunspace() line.

  1. The Process Injection Section.
    This one has specific step by step instructions to follow, but even though I use the same payloads that succesfully spawned reverse shells in other sections, when I use the payload with their code it connects to the listening shell and then closes the connection immediately.
2

I just accomplished the LOLBAS: InstallUtil exercice, your 1. question.
I think that when I was creating a new project I was selecting the Console App instead of Console App (.NET Framework) (I say “I think” because I don’t know well how to use VisualStudio and I don’t know how to check which template I used).
With this new project template selected I selected the .NET Framework 4.8 version.
Finally, with this options selected, I just had to tweak a bit the script and it worked just fine by following the steps written in the module.

I did not continue yet with the following questions, when I’ll accomplish them if I find it valuable and I remember it I’ll write it for some guidance.

1 Like
3

About the second (2.) paragraph you point out:
I is the way Visual Studio is configured in the machine from this module, is telling you to install the dependency located in the Hack The Box source whose path is C:\Tools\Nuget, I guess because the virtual machine that HTB offers does not have internet access. I used Visual Studio on my local machine so I downloaded and installed the dependency directly using the nuget.org source without any issue.

About the third (3.) paragraph you point out:
I had no issue following step by step the tutorial from the PowerShell ConstrainedLanguage Mode section.

4

I also got the error: System.BadImageFormatException: Could not load file or assembly
I was able to fix this by selecting “Console App (.NET Framework)” instead of “Console App” (which appears to use .NET Core)
Then used the .NET framework 4.5.1

2 Likes