# Hiding in Plain Sight with App Domain Manager Injection

App Domain Manager injection abuses .NET config files or APPDOMAIN_MANAGER env vars to load attacker assemblies inside trusted signed .NET executables, yielding code execution.

- Payout: Research
- Program: .NET Framework
- Write-up by: Huntress
- Disclosed: 2026-02-19
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/app-domain-manager-injection
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-app-domain-manager-injection
- Tags: area:os domain:desktop impact:privesc impact:rce kind:research platform:threat-intel tech:dotnet technique:source-review vuln:misconfiguration vuln:rce

**Target:** .NET Framework application initialization / assembly resolution
**Root cause:** The .NET runtime reads configuration files (.exe.config) and APPDOMAIN_MANAGER_ASM/APPDOMAIN_MANAGER_TYPE environment variables to determine which assembly initializes the app domain, without validating that the referenced assembly is trusted.
**Steps:**
1. Copy a trusted Microsoft-signed .NET executable into a writable directory.
2. Place a matching `<name>.exe.config` file beside it specifying a malicious assembly to load.
3. Execute the binary from that directory; the runtime loads the attacker DLL before normal logic runs.
4. For remote loading, point the config at an HTTP or UNC path and supply the required public key token so the runtime downloads and executes the remote assembly.
5. Alternatively set `APPDOMAIN_MANAGER_ASM` and `APPDOMAIN_MANAGER_TYPE` environment variables, which propagate to child processes so any .NET executable launched in that session loads the attacker assembly.
**How found:** Researchers examined the .NET framework's app domain initialization mechanism and legitimate configuration features, recognizing they could be repurposed to redirect assembly loading under trusted binaries.
**Exploitation:** Attacker with write access to a directory (or ability to set environment variables) drops a crafted .exe.config or sets APPDOMAIN_MANAGER vars, causing a legitimate signed .NET binary to load and execute attacker code, locally or remotely via HTTP/UNC, enabling execution and lateral movement under trusted process context.
**Escalation:** Environment variable variant propagates to spawned child processes, chaining execution across multiple .NET applications in a session.
**Insight:** Look at .NET app domain initialization config knobs (.exe.config appDomainManagerAssembly/appDomainManagerType and APPDOMAIN_MANAGER_* env vars) as execution primitives: any writable directory containing a signed .NET binary plus a sibling config, or inherited env vars, gives code execution without a memory-corruption bug.