Bypassing AppLocker with JScript
Throughout this course we have primarily leveraged
Microsoft Office and Jscript files
to obtain client-side code execution.
Along the way, we have greatly improved our tradecraft
to bypass endpoint protections, and we have found a way to
reuse all of that tradecraft with Microsoft Office.
Due to the scripting rules imposed by AppLocker,
Jscript code which is not located in a whitelisted folder
or whitelisted through a file hash or signature
will be blocked.
For example, if we attach a Jscript file to an email
or deliver it through an HTML smuggling attack,
the execution will be blocked by AppLocker, disrupting our attack
In the next sections, we will reuse our Jscript and
DotNetToJscript tradecraft and modify it to bypass AppLocker.