PowerShell CLM Bypass
In the last section, we bypassed constrained language mode in
PowerShell but ended up needing the ability to bypass the
AppLocker executable rules for a C# application.
In this section, we’ll demonstrate how native Windows
applications can be abused
to bypass AppLocker by fooling the filter driver.
In this section we will leverage InstallUtil,
a command-line utility that allows us to install
and uninstall server resources by executing the installer
components in a specified assembly.
This Microsoft-supplied tool obviously has legitimate uses,
but we can abuse it to execute arbitrary C# code.
Our goal is to reintroduce our PowerShell shellcode runner
tradecraft in an AppLocker-protected environment.
To use InstallUtil in this way, we must put the code we want to
execute inside either the install or uninstall methods
of the installer class.
We are only going to use the uninstall method since the
install method requires admini- strative privileges to execute.
Using the MSDN documentation as a guide,
we can build the following proof-of-concept:
There are a few things to note about this code.
First, the System.Configuration. Install namespace is missing
an assembly reference in Visual Studio.
We can add this by again right-clicking on References
in the Solution Explorer
and choosing Add References....
From here, we’ll navigate to the Assemblies menu on the left-hand
side and scroll down to System.Configuration.Install.
Once the assembly reference has been added
the displayed errors are resolved.
Although our code uses both the Main method
and the Uninstall method,
content in the Main method is not important in this example.
However, the method itself must be present in the executable.
Inside the Uninstall method, we can execute arbitrary C# code.
In this case, we will use the custom runspace code
we developed in the previous section.
With the executable compiled and copied to the Windows 10 victim
machine, we’ll execute it from an administrative command prompt
As shown in the output, the Main method executed.
If we run it from a non-administrative command prompt
AppLocker blocks it.
To trigger our constrained language mode bypass code
we must invoke it through InstallUtil
with /logfile to avoid logging to a file,
/LogToConsole=false to suppress output on the console,
and /U to trigger the Uninstall method:
The output shows that Install Util is allowed to execute.
It started the .NET Framework Installation utility
and the test.txt output
shows that our PowerShell script executed without restrictions.
Excellent!
There is, however, a slight issue; the compiled C# file has to be
on disk when InstallUtil is invoked.
This requires two distinct actions.
First, we must download an executable, and secondly,
we must ensure that it is not flagged by antivirus, neither
during the download process nor when it is saved to disk.
We could use VBA code to do this, but it is simpler to rely
on other native Windows binaries which are whitelisted by default
To attempt to bypass anitvirus, we are going to obfuscate the
executable while it is being downloaded
with Base64 encoding and then decode it on disk.
Well use the native certutil tool to perform the encoding
and decoding and bitsadmin for the downloading.
By using native tools in unexpected
and interesting ways, we will be “Living Off The Land”.
There are a couple of steps involved in setting this up,
so let’s take them one at a time.
First, we’ll use certutil on our Windows 10 development
machine to Base64-encode the compiled executable.
This is done by supplying the -encode flag:
Now that the binary has been Base64-encoded,
we’ll copy it to the web root of our Kali machine,
and ensure that Apache is running.
Then we’ll use bitsadmin to download the encoded file.
To download the file, we’ll specify the /Transfer option
along with a custom name for the transfer and the download URL:
With the file downloaded we can decode it with certutil -decode:
We executed the decoded executable with InstallUtil
and bypassed both AppLocker’s executable rules
and PowerShell’s constrained language mode.
Since all of these commands are executed sequentially we
can combine them on the command line through the && syntax
Our bypasses were again successful.
Very nice.
In this section, we further developed our tradecraft
to allow arbitrary C# execution
and unrestricted PowerShell execution
despite application whitelisting.
We are now able to reuse our existing client-side
code execution techniques from Microsoft Office.