corpus.blog
56,966 blogs · [ { "id": "01a087b5-87e7-71a7-b4e5-2768597b3dfd", "title": "Applocker bypass on Lenovo machines – The curious case of MFGSTAT.zip", "url": "https://oddvar.moe/2025/07/03/applocker-bypass-on-lenovo-machines-the-curious-case-of-mfgstat-zip/", "published_at": "2025-07-03T13:00:22+00:00" }, { "id": "01a087b5-87e7-71a7-b4e5-27685982ec7f", "title": "A small discovery about AppLocker", "url": "https://oddvar.moe/2019/05/29/a-small-discovery-about-applocker/", "published_at": "2019-05-29T17:04:36+00:00" }, { "id": "01a087b5-87e7-71a7-b4e5-27685a15449e", "title": "Bypassing AppLocker as an admin", "url": "https://oddvar.moe/2019/02/01/bypassing-applocker-as-an-admin/", "published_at": "2019-02-01T16:14:34+00:00" }, { "id": "01a087b5-87e7-71a7-b4e5-27685a3d31ab", "title": "Doing the PentesterAcademy Red Team Lab", "url": "https://oddvar.moe/2018/10/25/doing-the-pentesteracademy-red-team-lab/", "published_at": "2018-10-25T11:40:51+00:00" }, { "id": "01a087b5-87e7-71a7-b4e5-27685ad8bc85", "title": "%Temp%orary Constrained Language mode in AppLocker", "url": "https://oddvar.moe/2018/10/06/temporary-constrained-language-mode-in-applocker/", "published_at": "2018-10-06T16:34:28+00:00" }, { "id": "01a087b5-87e7-71a7-b4e5-27685b3cabf6", "title": "TrustedSec+Oddvar=OH YEAH!", "url": "https://oddvar.moe/2018/10/05/trustedsecoddvaroh-yeah/", "published_at": "2018-10-05T17:54:19+00:00" }, { "id": "01a087b5-87e7-71a7-b4e5-27685b53df1a", "title": "AppLocker – Making sure that local rules are removed", "url": "https://oddvar.moe/2018/09/28/applocker-making-sure-that-local-rules-are-removed/", "published_at": "2018-09-28T11:00:31+00:00" }, { "id": "01a087b5-87e7-71a7-b4e5-27685c3eb017", "title": "Persistence using Universal Windows Platform apps (APPX)", "url": "https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/", "published_at": "2018-09-06T09:57:31+00:00" }, { "id": "01a087b5-87e7-71a7-b4e5-27685d19a01f", "title": "AppLocker for admins – Does it work?", "url": "https://oddvar.moe/2018/07/27/applocker-for-admins-does-it-work/", "published_at": "2018-07-27T09:10:11+00:00" }, { "id": "01a087b5-87e7-71a7-b4e5-27685d277145", "title": "Another way to get to a system shell – Assistive Technology", "url": "https://oddvar.moe/2018/07/23/another-way-to-get-to-a-system-shell/", "published_at": "2018-07-23T11:18:21+00:00" }, { "id": "01a0bdc8-6f03-7055-ae5e-c136d74e83a3", "title": "Real whitelisting attempt using AppLocker", "url": "https://oddvar.moe/2018/05/14/real-whitelisting-attempt-using-applocker/", "published_at": "2018-05-14T13:55:39+00:00" }, { "id": "01a0bdc8-6f03-7055-ae5e-c136d7d08274", "title": "GPscript.exe – another LOLBin to the list", "url": "https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/", "published_at": "2018-04-27T18:49:06+00:00" }, { "id": "01a0bdc8-6f03-7055-ae5e-c136d8a82941", "title": "Putting data in Alternate data streams and how to execute it – part 2", "url": "https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/", "published_at": "2018-04-11T14:14:56+00:00" }, { "id": "01a0bdc8-6f03-7055-ae5e-c136d90e650c", "title": "Persistence using GlobalFlags in Image File Execution Options – Hidden from Autoruns.exe", "url": "https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/", "published_at": "2018-04-10T13:42:35+00:00" }, { "id": "01a0bdc8-6f03-7055-ae5e-c136d9cdbd1d", "title": "Persistence using RunOnceEx – Hidden from Autoruns.exe", "url": "https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/", "published_at": "2018-03-21T19:15:53+00:00" }, { "id": "01a0bdc8-6f03-7055-ae5e-c136da20dec6", "title": "Windows Defender Attack Surface Reduction Rules bypass", "url": "https://oddvar.moe/2018/03/15/windows-defender-attack-surface-reduction-rules-bypass/", "published_at": "2018-03-15T16:19:06+00:00" }, { "id": "01a0bdc8-6f03-7055-ae5e-c136db0b2da5", "title": "Putting data in Alternate data streams and how to execute it", "url": "https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/", "published_at": "2018-01-14T22:21:31+00:00" }, { "id": "01a0bdc8-6f03-7055-ae5e-c136db65caf0", "title": "Office 365 Safe links bypass", "url": "https://oddvar.moe/2018/01/03/office-365-safe-links-bypass/", "published_at": "2018-01-03T12:14:42+00:00" }, { "id": "01a0bdc8-6f03-7055-ae5e-c136dbb95301", "title": "Harden Windows with AppLocker – based on Case study part 2", "url": "https://oddvar.moe/2017/12/21/harden-windows-with-applocker-based-on-case-study-part-2/", "published_at": "2017-12-21T14:26:41+00:00" }, { "id": "01a0bdc8-6f03-7055-ae5e-c136dbce4d3a", "title": "AppLocker – Case study – How insecure is it really? – Part 2", "url": "https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/", "published_at": "2017-12-21T14:25:07+00:00" }, { "id": "01a0bdd0-b4cd-72d7-9348-940d899ed3f2", "title": "Harden Windows with AppLocker – based on Case study part 1", "url": "https://oddvar.moe/2017/12/13/harden-windows-with-applocker-based-on-case-study-part-1/", "published_at": "2017-12-13T23:28:49+00:00" }, { "id": "01a0bdd0-b4cd-72d7-9348-940d8a79e74b", "title": "AppLocker – Case study – How insecure is it really? – Part 1", "url": "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/", "published_at": "2017-12-13T14:05:16+00:00" }, { "id": "01a0bdd0-b4cd-72d7-9348-940d8ab10918", "title": "My experience with IT DEV CONNECTIONS 2017 and demo videos", "url": "https://oddvar.moe/2017/10/29/my-experience-with-it-dev-connection-2017-and-demo-videos/", "published_at": "2017-10-29T21:26:32+00:00" }, { "id": "01a0bdd0-b4cd-72d7-9348-940d8b266b3d", "title": "Defense-In-Depth write-up", "url": "https://oddvar.moe/2017/09/13/defense-in-depth-writeup/", "published_at": "2017-09-13T10:59:24+00:00" }, { "id": "01a0bdd0-b4cd-72d7-9348-940d8b521c8f", "title": "Research on CMSTP.exe", "url": "https://oddvar.moe/2017/08/15/research-on-cmstp-exe/", "published_at": "2017-08-15T09:15:41+00:00" }, { "id": "01a0bdd0-b4cd-72d7-9348-940d8b72c800", "title": "Bypassing Device guard UMCI using CHM – CVE-2017-8625", "url": "https://oddvar.moe/2017/08/13/bypassing-device-guard-umci-using-chm-cve-2017-8625/", "published_at": "2017-08-13T21:29:00+00:00" }, { "id": "01a0bdd0-b4cd-72d7-9348-940d8b7bc540", "title": "Ping is okay? – Right?", "url": "https://oddvar.moe/2017/05/30/ping-is-okay-right/", "published_at": "2017-05-30T15:41:52+00:00" }, { "id": "01a0bdd0-b4cd-72d7-9348-940d8bc3dd88", "title": "Clarification – BGInfo 4.22 – AppLocker still vulnerable", "url": "https://oddvar.moe/2017/05/22/clarification-bginfo-4-22-applocker-still-vulnerable/", "published_at": "2017-05-22T20:21:40+00:00" }, { "id": "01a0bdd0-b4cd-72d7-9348-940d8c0152eb", "title": "Bypassing Application Whitelisting with BGInfo", "url": "https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/", "published_at": "2017-05-18T21:05:52+00:00" }, { "id": "01a0bdd0-b4cd-72d7-9348-940d8cf82386", "title": "NIC 2017 – Slides, notes and a video", "url": "https://oddvar.moe/2017/02/07/nic-2017-slides-notes-and-a-video/", "published_at": "2017-02-07T09:41:19+00:00" }, { "id": "01a0bdd4-7c60-710a-86f5-2ce91e6a809e", "title": "Accessing clipboard from the lock screen in Windows 10 #2", "url": "https://oddvar.moe/2017/01/27/access-clipboard-from-lock-screen-in-windows-10-2/", "published_at": "2017-01-27T01:02:53+00:00" }, { "id": "01a0bdd4-7c60-710a-86f5-2ce91ecf5913", "title": "Accessing clipboard from the lock screen in Windows 10", "url": "https://oddvar.moe/2017/01/24/accessing-clipboard-from-the-lock-screen-in-windows-10/", "published_at": "2017-01-24T22:16:03+00:00" } ] posts Claim your blog
Back to oddvar.moe
Blog · corpus.blog/blogs/oddvar.moe/posts

oddvar.moe

oddvar.moe

2025

Applocker bypass on Lenovo machines – The curious case of MFGSTAT.ziporiginal ↗
3 Jul 2025

2019

A small discovery about AppLockeroriginal ↗
29 May 2019
Bypassing AppLocker as an adminoriginal ↗
1 Feb 2019

2018

Doing the PentesterAcademy Red Team Laboriginal ↗
25 Oct 2018
%Temp%orary Constrained Language mode in AppLockeroriginal ↗
6 Oct 2018
TrustedSec+Oddvar=OH YEAH!original ↗
5 Oct 2018
AppLocker – Making sure that local rules are removedoriginal ↗
28 Sept 2018
Persistence using Universal Windows Platform apps (APPX)original ↗
6 Sept 2018
AppLocker for admins – Does it work?original ↗
27 Jul 2018
Another way to get to a system shell – Assistive Technologyoriginal ↗
23 Jul 2018
Real whitelisting attempt using AppLockeroriginal ↗
14 May 2018
GPscript.exe – another LOLBin to the listoriginal ↗
27 Apr 2018
Putting data in Alternate data streams and how to execute it – part 2original ↗
11 Apr 2018
Persistence using GlobalFlags in Image File Execution Options – Hidden from Autoruns.exeoriginal ↗
10 Apr 2018
Persistence using RunOnceEx – Hidden from Autoruns.exeoriginal ↗
21 Mar 2018
Windows Defender Attack Surface Reduction Rules bypassoriginal ↗
15 Mar 2018
Putting data in Alternate data streams and how to execute itoriginal ↗
14 Jan 2018
Office 365 Safe links bypassoriginal ↗
3 Jan 2018

2017

Harden Windows with AppLocker – based on Case study part 2original ↗
21 Dec 2017
AppLocker – Case study – How insecure is it really? – Part 2original ↗
21 Dec 2017
Harden Windows with AppLocker – based on Case study part 1original ↗
13 Dec 2017
AppLocker – Case study – How insecure is it really? – Part 1original ↗
13 Dec 2017
My experience with IT DEV CONNECTIONS 2017 and demo videosoriginal ↗
29 Oct 2017
Defense-In-Depth write-uporiginal ↗
13 Sept 2017
Research on CMSTP.exeoriginal ↗
15 Aug 2017
Bypassing Device guard UMCI using CHM – CVE-2017-8625original ↗
13 Aug 2017
Ping is okay? – Right?original ↗
30 May 2017
Clarification – BGInfo 4.22 – AppLocker still vulnerableoriginal ↗
22 May 2017
Bypassing Application Whitelisting with BGInfooriginal ↗
18 May 2017
NIC 2017 – Slides, notes and a videooriginal ↗
7 Feb 2017
Accessing clipboard from the lock screen in Windows 10 #2original ↗
27 Jan 2017
Accessing clipboard from the lock screen in Windows 10original ↗
24 Jan 2017