UltimateWDACBypassList — A centralized resource for previously documented WDAC bypass techniques | Kitploit
bohops/ultimatewdacbypasslistUltimateWDACBypassList
A centralized resource for previously documented WDAC bypass techniques
63185hace 23 días
Descubre las herramientas más usadas por nuestra comunidad.
Contenido no disponible en el idioma solicitado. Mostrando versión en inglés. Ultimate WDAC Bypass List
A centralized resource for previously documented WDAC/Device Guard/UMCI bypass techniques as well for building/managing/testing WDAC policies
- Note: WDAC (Windows Defender Application Control) has been rebranded by Microsoft as "Application Control" or "Application Control for Business"
*Many of the LOLBINs are included on the Applications that can bypass WDAC List formerly called the "Microsoft Recommended Block Rules List"
Pro Tip: If applying the Block Rules policy, don't forget to remove the first two file rules: ID_ALLOW_A_1 and ID_ALLOW_A_2
*This repository was inspired by Oddvar Moe's Ultimate AppLocker Bypass List
*As always, this is a work in progress...
Applications that can bypass WDAC - "LOLBIN" Write-Ups
addinprocess.exe
- By James Forshaw (@tiraniddo)
- DG on Windows 10 S: Executing Arbitrary Code
addinprocess32.exe
- By James Forshaw (@tiraniddo)
- DG on Windows 10 S: Executing Arbitrary Code
addinutil.exe
- By Unknown (Documented by @McKinleyMike and @TheLatteri)
- Insecure Deserialization in AddinUtil.exe
aspnet_compiler.exe
- By cpl (@cpl3h)
- The Curious Case of Aspnet_Compiler.exe
bginfo.exe
- By Oddvar Moe (@Oddvarmoe)
- Bypassing Application Whitelisting with BGInfo
cdb.exe
- By Matt Graeber (@mattifestation)
- Bypassing Application Whitelisting by using WinDbg/CDB as a Shellcode Runner
csi.exe
- By Casey Smith (@subTee)
- Application Whitelisting Bypass - CSI.EXE C# Scripting
dbghost.exe
- By Casey Smith (@subTee)
- dbghost.exe - Ghost And The Darkness
dbgsrv.exe
- By Casey Smith (@subTee), Ross Wolf (@rw_access)
- How to Bypass WDAC with dbgsrv.exe
- Fantastic Red-Team Attacks and How to Find Them
dnx.exe
- By Matt Nelson (@enigma0x3)
- BYPASSING APPLICATION WHITELISTING BY USING DNX.EXE
dotnet.exe
- By Jimmy Bayne (@bohops)
- DotNet Core: A Vector For AWL Bypass & Defense Evasion
fsi.exe
- By Nick Tyrer (@NickTyrer) [Write-up: Jimmy Bayne (@bohops)]
- GitHub Gist: fsi.exe inline execution
- Exploring the WDAC Microsoft Recommended Block Rules (Part II): Wfc.exe, Fsi.exe, and FsiAnyCpu.exe
fsiAnyCpu.exe
- By Nick Tyrer (@NickTyrer) via fsi.exe inline execution [Write-up: Jimmy Bayne (@bohops)]
- GitHub Gist: fsi.exe inline execution
- Exploring the WDAC Microsoft Recommended Block Rules (Part II): Wfc.exe, Fsi.exe, and FsiAnyCpu.exe
infdefaultinstall.exe
- By Kyle Hanslovan (@KyleHanslovan), Chris Bisnett (@chrisbisnett)
- Evading Autoruns - DerbyCon 7.0
- RE: Evading Autoruns PoCs on Windows 10
InstallUtil.exe
- By James Forshaw (@tiraniddo)
- DG on Windows 10 S: Abusing InstallUtil
IntuneWindowsAgent.exe (Microsoft.Management.Services.IntuneWindowsAgent.exe)
- By Kim Oppalfens (@TheWMIGuy)
- Intune Windows Agent Bypass Explanation
kill.exe
- By @hyp3rlinx
- Microsoft Process Kill Utility "kill.exe" - SEH Buffer Overflow
microsoft.Workflow.Compiler.exe
- By Matt Graeber (@mattifestation)
- Arbitrary, Unsigned Code Execution Vector in Microsoft.Workflow.Compiler.exe
msbuild.exe
- By Casey Smith (@subTee)
- Bypassing Application Whitelisting using MSBuild.exe - Device Guard Example and Mitigations
mshta.exe
- By Unknown (Documented by @conscioushacker)
- Application Whitelisting Bypass: mshta.exe
powershellcustomhost.exe
- By Lasse Trolle Borup (@TrolleBorup)
- A simple Device Guard bypass
rcsi.exe
- By Matt Nelson (@enigma0x3)
- BYPASSING APPLICATION WHITELISTING BY USING RCSI.EXE
runscripthelper.exe
- By Matt Graeber (@mattifestation)
- Bypassing Application Whitelisting with runscripthelper.exe
texttransform.exe
- By Unknown
- TextTransformer - Tool Use Case [Documented by Casey Smith (@_subTee)]
- TextTransform Shellcode Injection Template [Documented by Chris Sphen (@ConsciousHacker)]
- Placeholder reference (coming soon)
visualuiaverifynative.exe
- By Lee Christensen (@tifkin_) [Write-up: Jimmy Bayne (@bohops)]
- Exploring the WDAC Microsoft Recommended Block Rules: VisualUiaVerifyNative
wfc.exe
windbg.exe
- By Matt Graeber (@mattifestation)
- Bypassing Application Whitelisting by using WinDbg/CDB as a Shellcode Runner
wmic.exe
- By Casey Smith (@subTee)
- WMIC.EXE Whitelisting Bypass - Hacking with Style, Stylesheets
WSL Family - bash.exe, lxrun.exe, wsl.exe, wslconfig.exe, wslhost.exe
- By Alex Ionescu (@aionescu)
- Fun with the Windows Subsystem for Linux
On Block List - Not Documented Yet...
- dbgsvc.exe
- kd.exe
- ntkd.exe
- ntsd.exe
- HVCIScan.exe
Libraries On List (Independent usage may/may not be interesting)
- Microsoft.Build.dll
- Microsoft.Build.Framework.dll
- msbuild.dll
- lxssmanager.dll
- system.management.automation.dll
- webclnt.dll/davsvc.dll
- mfc40.dll
Other "Unsigned Code Execution" LOLBINs (not on list)
texttransformcore.exe
- Placeholder reference (coming soon)
microsoft.xsldebugger.host.exe
- Placeholder reference (coming soon)
WinDbgX.exe
- By Cerbersec (@cerbersec)
- Bypass WDAC WinDbg Preview
PowerShell
UMCI BYPASS USING PSWORKFLOWUTILITY: CVE-2017-0215
DEFEATING DEVICE GUARD: A LOOK INTO CVE-2017-0007
Exploiting PowerShell Code Injection Vulnerabilities to Bypass Constrained Language Mode
A LOOK AT CVE-2017-8715: BYPASSING CVE-2017-0218 USING POWERSHELL MODULE MANIFESTS
CVE-2018-8212: DEVICE GUARD/CLM BYPASS USING MSFT_SCRIPTRESOURCE
Invoke-History Constrained Language Mode Bypass
Novel Living-Of-The-Land/COM/Microsoft Office/Active Scripting Languages (jscript.dll, msxml3.dll, msxml6.dll)
Bypassing Device Guard with .NET Assembly Compilation Methods
Sneaking Past Device Guard (+ CVE-2018-8417)
WSH INJECTION: A CASE STUDY
Application Whitelisting Bypass and Arbitrary Unsigned Code Execution Technique in winrm.vbs
Abusing Catalog Hygiene to Bypass Application Whitelisting
BYPASSING DEVICE GUARD UMCI USING CHM – CVE-2017-8625
UMCI VS INTERNET EXPLORER: EXPLORING CVE-2017-8625
Bypassing WDAC with Previous Versions of Signed Script Hosts & Signature Catalog Files
Novel Exploitation/Bring Your Own Vulnerable Application (BYVA)
Bypassing Windows Defender Application Control with Loki C2 (via NodeJS-Electron Apps)
Operationalizing browser exploits to bypass Windows Defender Application Control (WDAC)
Defense, Policy Creation, Testing, & Research
WDAC Twitch Stream
WDAC Policy Wizard
WDACPolicies
Building a Windows Defender Application Control Lab
Documenting and Attacking a Windows Defender Application Control Feature the Hard Way — A Case Study in Security Research Methodology
WinAWL
Exploit Monday Blog
Quick Steps for Deploying a Policy & Setting Up a WDAC Test Machine
Windows Defender Application Control (WDAC) Updates in 20H2 and Building a Simple, Secure Windows-only Policy
Harden Windows Security: WDAC Notes
WDAC Notes
