Trusted Folders
The default rules for AppLocker whitelist all executables and
scripts located in Program Files, Program Files (x86),
and Windows directories.
This is a logical choice since it is assumed that non-admin
users cannot write executables or scripts into these directories.
In this section, we will put this assumption to the test
as we construct our first albeit very simple, AppLocker bypass.
In theory, we should be able to execute a program or script
in a subdirectory that allows both write and execute.
If we can find writable and executable folders
on a development machine,
we can reuse the bypass later on a compromised machine
which has the same rules applied.
For this test, we’ll use an administrative command prompt
to avoid potential AppLocker restrictions.
To locate user-writable folders, we’ll use AccessChk
from SysInternals, which is located in
C:\Tools\SysInternalsSuite on our Windows 10 victim VM.
We’ll search C:\Windows with AccessChk,
using -w to locate writable directories,
u to suppress any errors
and s to recurse through all subdirectories.
Surprisingly, the output returned by the command is
quite lengthy, it contains several writeable subdirectories.
Next, we must determine if any of them are also executable.
We’ll use the native icacls tool from an administrative command
prompt to check each of the writable folders.
For example, we’ll first check the C:\Windows\Tasks directory.
The output indicates the RX flag associated with the
NT AUTHORITY\Authenticated Users group, is set for the Windows
Tasks directory, meaning that any user on the system will
have both read and execute permissions within the directory.
Based on the output of these tools, the student user will
have both write and execute permissions within this directory
To test this out,
we’ll copy calc.exe to the Windows Tasks directory,
and execute it.
The program runs, indicating that we have bypassed
the default AppLocker application whitelisting rules.