Using Powershell and Reflection API to invoke methods from .NET Assemblies

Alexander Leary updates RunDotNetDll32 to load .NET assemblies via Type.GetType instead of suspicious Assembly.LoadFile calls, executing DLL methods while dodging common detection logic.

Traces the evolution of offensive PowerShell invocation from powershell.exe command lines to in-memory .NET loading with UnmanagedPowerShell, evading process creation monitoring.

MSSQL linked server credentials are reversibly encrypted, letting sysadmin-level attackers recover cleartext passwords via a new PowerShell script. Defensive advice on database links included.

Covers assembly protections like ASLR, DEP, SafeSEH, and Authenticode signing, shows how PESecurity flags unsigned binaries, and explains decompiling .NET assemblies to review code.

Evil SQL Client (ESC) is a .NET console for SQL Server discovery, access, and data exfiltration, runnable via a plain exe, MSBuild inline tasks, or PowerShell reflection for stealthy red team work.

NetSPI releases BetaFast and Beta Bank, two deliberately vulnerable C# thick clients for practice, with flaws from SQL injection and hardcoded credentials to unencrypted database connections.