Kali Linux adds guide for building Windows C# penetration tools with Mono and Wine

The Kali Linux project has published a technical guide demonstrating how penetration testers can compile and execute Windows C# tools and payloads without leaving a Linux environment. The workflow leverages mono-devel for compilation, Wine with wine-mono for runtime testing, and extracts required Microsoft DLLs from the open-source PowerShell Empire post-exploitation framework. The guide covers practical scenarios drawn from OffSec's PEN-300/OSEP advanced penetration testing curriculum, including process execution, Constrained Language Mode bypasses, Caesar cipher payload encryption, and tools like Rubeus and DotNetToJScript.

The documentation addresses a specific friction point for security professionals who train on Windows-centric coursework but prefer Linux host systems for efficiency. By providing shell functions that integrate msfvenom output with the csharp interpreter, Kali reduces multi-step Visual Studio workflows into single commands. The guide also notes that EmpireCompiler bundles versions of System.Management.Automation.dll and System.Configuration.Install.dll targeting .NET Framework 3.5, 4.0, and 4.5, eliminating manual DLL extraction from Windows systems.

Cross-platform compilation and Windows API dependencies

• Mono toolchain: The mcs compiler from mono-devel produces PE32 executables and DLLs targeting the .NET Framework, with TERM=linux required for proper terminal handling during compilation.
• Wine runtime layer: wine32 and wine-mono 11.3.0 provide the Windows subsystem needed to test compiled binaries including reverse shells directly on Kali without a Windows VM.
• DLL sourcing from PowerShell Empire: The EmpireCompiler package at version 1.0.0 includes Microsoft assemblies for multiple .NET versions, located under EmpireCompiler/Data/AssemblyReferences/ for net35, net40, and net45 targets.
• Constrained Language Mode bypass technique: The documented bypass uses System.Configuration.Install.Installer with RunInstaller(true) and overrides the Uninstall method to execute PowerShell commands through RunspaceFactory.CreateRunspace().
• csharp interpreter integration: The csharp command enables direct execution of C# code without prior compilation, allowing shell-scripted workflows that pipe msfvenom C# format output through Caesar cipher encryption loops.

Why it matters

This documentation strengthens Kali Linux's position as a unified offensive security platform, reducing reliance on Windows VMs for penetration testers working through industry-standard curricula like OSEP. For the broader open-source security ecosystem, it validates Mono and Wine as production-capable components in professional toolchains and may drive contributions to maintain compatibility with newer .NET Framework versions used in enterprise environments.