Skip to main content

​
Overview

The DotNet command enumerates installed .NET Framework and .NET Core versions on the system. This information is crucial for compatibility assessment when deploying .NET-based tools and payloads.

​
Syntax

Seatbelt.exe DotNet

​
Remote Execution

Seatbelt.exe DotNet -computername=TARGET.domain.com [-username=DOMAIN\user -password=pass]

​
Output

Returns .NET version information:
  • .NET Framework versions (2.0, 3.5, 4.x)
  • .NET Core versions
  • Installation paths
  • Service Pack levels
  • CLR versions

​
Use Cases

  • Red Team
  • Blue Team
  • Determine compatible payload versions
  • Identify systems for .NET exploit deployment
  • Assess tool compatibility
  • Plan post-exploitation toolkit deployment

​
Example Output

====== DotNet ======

.NET Versions:
  4.0.30319.42000  (4.8 or later)
  v2.0.50727       (.NET 3.5)

Installed Versions (via registry):
  v4\Full : 4.8.04084
  v3.5 : 3.5.30729.4926

​
Remote Execution

This command supports remote execution using the -computername parameter.

​
Detection Considerations

Minimal detection surface - reads registry values.