Posted on by Decoder

The lonely potato – part 2 –

As promised in the previous post, I will show you how to embed the "lonely potato" in InstallUtil.exe. Why do we need that? Because, as explained here , with Installutil we can call our C# assembly with whatever extension we like, for example ".txt". Cool way to bypass some Application and File restriction policies.... Quick and…

Posted on by Decoder · 1 Comment

The lonely potato

Never heard about the "Rotten Potato"? If not, read this post written by the authors of this fantastic exploit before continuing: https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/ The mechanism is quite complex, it allows us to intercept the NTLM authentication challenge which occurs during the  DCOM activation through  our endpoint listener and impersonate the user's security access  token  (in this case…

Posted on by Decoder

We don’t need powershell.exe – 4 –

This seems to be  a never ending story but, believe me, there  are so many ways to achieve the same result! This time we are going to use another simple technique for running our powershell scripts without invoking powershell.exe. Introducing MSBuild.exe... MSBuild is a tool included in .Net frameworks for automating the processes of creating…

Posted on by Decoder

“Poor man’s process migration”

In your pentesting activities, there are many circumstances where you need to “migrate” your Windows working process, typically a shell,to a different process and some scenarios can be: You have an unstable shell and need to move to a more robust process on the victim's machine (typically explorer.exe which will live until the victim doesn't…

Posted on by Decoder

We don’t need powershell.exe -part 3-

This is the third part of my "powershell-less" series: howto execute powershell scripts without using powershell.exe In part 2 I used  DotNetToJscript  in order to circumvent AppLocker policy. Now let's try to use another technique.  The problem is always the same: we cannot run executable files outside windows directories and  we can't run powershell.exe. Never heard…

Posted on by Decoder

We don’t need powershell.exe – part 2 –

In my previous post I showed you how to bypass policy restrictions which won't let you execute powershell.exe. Now let's move on to a more complicated (but realistic) scenario: you can't run exe files located outside the "classic" Windows directories because there is an App Locker policy which won't permit it Say bye-bye to powershell?…

Posted on by Decoder

We don’t need powershell.exe

Please don't misunderstand me, you really need Powershell and all it's magic if you are a pentester, don't you? But what can you do if some policy is blocking  access to powershell.exe?  Yes, this is a well known problem and there are many solutions. In my article I just want to focus on a quick…