Add evasion module applocker_evasion_msbuild

[NickTyrer]

Intro

This module is designed to evade solutions such as software restriction policies and Applocker.
The main vector for this bypass is to use the trusted binary MSBuild.exe in executing user supplied code.

This pull request is in reference to the previous pull request #8783.

Vulnerable Application

This evasion will work on all versions of Windows that include .net versions 3.5 or greater (note: ensure the selected payload matches the target os architecture).

Verification Steps

1. Enable Applocker and enable executable rules
2. Verify a standard .exe will not run from the users desktop
3. Do use evasion/windows/applocker_evasion_msbuild
4. Do exploit
5. Follow the onscreen instructions by copying the created file to the targets desktop
6. Verify that code execution is achieved.

[wchen-r7]

I'm currently testing this out. Thanks!

[NickTyrer]

@wchen-r7 sorry just pushed one final commit to fix an issue I had overlooked

[wchen-r7]

No problem. Thanks for the heads up.

[wchen-r7]

Really enjoyed playing with the module. Thanks for sharing.

[wchen-r7]

Release Notes

The applocker_evasion_msbuild module has been added to the framework. It is designed to evade solutions such as software restriction policies and Applocker. The main vector for this bypass is to use the trusted binary MSBuild.exe in executing user supplied code.