Verified presentationhost bypass

api0cradle / UltimateAppLockerByPassList

The goal of this repository is to document the most common techniques to bypass AppLocker.

1.9k stars 350 forks source link

Verified presentationhost bypass #8

Closed jpginc closed 5 years ago

jpginc commented 5 years ago

I setup default applocker rules and verified that an xbap run from the file system (or any UNC path) can execute arbitrary c# code. I've added a link to a blog post with the steps to reproduce.

You can reproduce the bypass by cloning https://github.com/jpginc/xbapAppWhitelistBypassPOC and running the xbap in the /powershell/bin/Debug/ folder

api0cradle commented 5 years ago

Awesome stuff! Will add it to the repo. I use the Yaml files as base for this so I need to change those.

jpginc commented 5 years ago

Oh i see, so i'll submit another pull request where i just modify the presentationhost.exe yaml file