Bypass With DLLs
In the previous sections, we relied on basic AppLocker rules,
ignoring rule types associated with dynamic link libraries.
The default ruleset doesn’t protect
against loading arbitrary DLLs.
If we were to create an unmanaged DLL, we would be able
to load it and trigger exported APIs
to gain arbitrary code execution.
Let’s demonstrate this with an unmanaged DLL.
We’ll use a simple unmanaged DllMain function
along with an exported run function
that opens a message box when executed.
This code has already been compiled & saved as TestDll.dll
under the tools directory on the Windows 10 victim VM.
To load an unmanaged DLL, we’ll use the native rundll32 tool
which accepts the full path to the DLL
along with the exported function to execute.
Although this is basic code, it demonstrates that DLLs
are not restricted by the current AppLocker rules.
We can, however, enforce DLL whitelisting with AppLocker,
again through the Local Group Policy Editor.
Let’s do that now.
Reopening the rule enforcement window
in the group policy editor,
we’ll click the “Advanced” tab.
This presents a warning about system performance issues
related to DLL whitelisting enforcement
and offers the option to enable it.
After checking “Enable the DLL rule collection”
and clicking Apply,
we’ll return to the original “Enforcement” tab
which presents a new entry related to DLLs.
Here, we’ll enable DLL enforcement and return to the
main AppLocker configuration window.
A “DLL Rules” section now allows us to create default rules.
Once everything is configured,
we’ll once again execute gpupdate /force from
an administrative command prompt to activate the settings.
To test the configured rules, we’ll attempt to load
TestDll.dll with rundll32 again.
This presents the AppLocker error message.
The DLL has been blocked.
Unless the default rules DLL Enforcement rules have been
modified, we could bypass whitelisting by copying
TestDll.dll into C:\Windows\Tasks.