Bug: script block logging bypass not working

mgeeky / Stracciatella

OpSec-safe Powershell runspace from within C# (aka SharpPick) with AMSI, Constrained Language Mode and Script Block Logging disabled at startup

GNU General Public License v3.0

494 stars 64 forks source link

Open williamknows opened 3 years ago

williamknows commented 3 years ago

Config:

commit 3c3e059 (currently the latest) compiled with the default configuration for .NET 4.
Tested against Server 2016 and Windows 10 (from DetectionLab)
Execution via CNA script (import then execute of PowerView commands).

The script block logging bypass used no longer appears to work. I'm seeing a lot of 4104 logs for executed commands.

mgeeky commented 3 years ago

Damn, that's unfortunate. I'll look into this as soon as I find a spare minute.

Thanks for this issue report. Will keep it open until I address it.

Regards, Mariusz.

S3cur3Th1sSh1t commented 3 years ago

There was a patch for the first bypass. It’s written down here:

It was changed somewhere around November 2017. I got the gists bypass working two days ago ;-)

mgeeky commented 3 years ago

Thanks @S3cur3Th1sSh1t for your heads-up! Makes it way much easier to fix that one. Will try to hunt it down in a matter of days.

Cheers Mate! Mariusz.

ghost commented 2 years ago

stracciatella-remote doesn't seem to work , the command still executes on localhost though.

stracciatella-remote -v remote ip adress + pipe name + command , here's the syntax I used, weird it still execute on localhost. Any help ? :) thx

mgeeky commented 2 years ago

This issue with Script Block Logging should be now addressed in the latest version. :)

Let me know if problem remains.