corpus.blog
41,715 blogs · 5,239,565 posts Claim your blog
Record · corpus.blog/posts/01a0f941-4971-71cc-9e6b-15c7cfded7b9

COM XSL Transformation: Bypassing Microsoft Application Control Solutions (CVE-2018-8492)

Bohops · published 10 January 2019

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at bohops.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
85
Words captured
4,837

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://docs.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies
docs.microsoft.com
http://www.isssource.com/wp-content/uploads/2012/02/ISSSource-Application_Whitelisting_Using_SRP.pdf
isssource.com
https://docs.microsoft.com/en-us/windows/deployment/planning/windows-10-1803-removed-features
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain
docs.microsoft.com
https://blogs.msdn.microsoft.com/powershell/2017/11/02/powershell-constrained-language-mode/
blogs.msdn.microsoft.com
AppLocker – Case study – How insecure is it really? – Part 1 Read at the source ↗
oddvar.moe
https://twitter.com/Oddvarmoe
twitter.com
https://blogs.msdn.microsoft.com/aaron_margosis/2018/06/26/announcing-application-whitelisting-with-aaronlocker/
blogs.msdn.microsoft.com
https://twitter.com/AaronMargosis
twitter.com
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/desktop/devnotes/windows-lockdown-policy
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy
docs.microsoft.com
https://www.fortynorthsecurity.com/building-a-windows-defender-application-control-lab/
fortynorthsecurity.com
https://twitter.com/christruncer
twitter.com
https://github.com/bohops/Notes/blob/master/Windows/WDAC-DeviceGuard/Win10_WDAC_DeviceGuard_Testing_Policy_Quick_Deploy.txt
github.com
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
docs.microsoft.com
http://www.exploit-monday.com/
exploit-monday.com
https://twitter.com/mattifestation
twitter.com
https://enigma0x3.net/
enigma0x3.net
https://twitter.com/enigma0x3
twitter.com
http://subt0x11.blogspot.com/
subt0x11.blogspot.com
https://twitter.com/subTee
twitter.com
https://tyranidslair.blogspot.com
tyranidslair.blogspot.com
https://twitter.com/tiraniddo
twitter.com
https://www.microsoft.com/en-us/msrc
microsoft.com
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard
docs.microsoft.com
http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/
leeholmes.com
https://twitter.com/oising/status/261875078105550848
twitter.com
https://twitter.com/oising
twitter.com
https://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html
darkoperator.com
https://twitter.com/Carlos_Perez
twitter.com
https://t.co/a8DpVOrqdM
t.co
https://twitter.com/mattifestation/status/921509830644269062?ref_src=twsrc%5Etfw
twitter.com
https://docs.microsoft.com/en-us/dotnet/api/system.management.automation?view=powershellsdk-1.1.0
docs.microsoft.com
https://github.com/Cn33liz/p0wnedShell
github.com
https://twitter.com/Cneelis
twitter.com
https://www.microsoft.com/en-us/msrc/windows-security-servicing-criteria
microsoft.com
https://www.slideshare.net/OddvarHlandMoe/appolockalypse-now
slideshare.net
%Temp%orary Constrained Language mode in AppLocker Read at the source ↗
oddvar.moe
https://www.mdsec.co.uk/2018/09/applocker-clm-bypass-via-com/
mdsec.co.uk
https://twitter.com/_xpn_
twitter.com
https://docs.microsoft.com/en-us/windows/desktop/com/-progid--key
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/desktop/com/clsid
docs.microsoft.com
https://bugs.chromium.org/p/project-zero/issues/detail?id=1514&q=
bugs.chromium.org
https://docs.microsoft.com/en-us/windows/desktop/devnotes/wlpdisclassinapprovedlist
docs.microsoft.com
AppLocker Bypass – MSXSL Read at the source ↗
pentestlab.blog
https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
subt0x11.blogspot.com
https://en.wikipedia.org/wiki/XSL
en.wikipedia.org
https://en.wikipedia.org/wiki/MSXML
en.wikipedia.org
https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ms761399(v%3dvs.85
docs.microsoft.com
https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ms761399(v%3Dvs.85
docs.microsoft.com
https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ms766561(v%3dvs.85
docs.microsoft.com
https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ms754621(v%3Dvs.85
docs.microsoft.com
https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ms762799(v%3Dvs.85
docs.microsoft.com
https://posts.specterops.io/application-whitelisting-bypass-and-arbitrary-unsigned-code-execution-technique-in-winrm-vbs-c8c24fb40404
posts.specterops.io
https://gist.githubusercontent.com/bohops/fecbbcc47cee688d2a62f4265bcd7104/raw/cc4a1b4d8eb26cc9aea61ae267db7ecae28e9f33/minimalist.xml
gist.githubusercontent.com
https://docs.microsoft.com/en-us/dotnet/api/system.xml.xsl.xslcompiledtransform?view=netframework-4.7.2
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument?view=netframework-4.7.2
docs.microsoft.com
https://gist.githubusercontent.com/bohops/ee9e2d7bdd606c264a0c6599b0146599/raw/e0d2854caf81778da8aaf5fc0cf06f798d9db4dd/xsl.txt
gist.githubusercontent.com
https://adsecurity.org/?p=2277
adsecurity.org
https://www.reddit.com/r/PowerShell/comments/8nidgx/uninstall_powershell_20/
reddit.com
https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html
fireeye.com
https://blog.conscioushacker.io/index.php/2017/11/17/application-whitelisting-bypass-mshta-exe/
blog.conscioushacker.io
https://blog.conscioushacker.io/index.php/2017/11/17/application-whitelisting-bypass-regsvr32-exe/
blog.conscioushacker.io
https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/
enigma0x3.net
https://attack.mitre.org/
attack.mitre.org
https://lolbas-project.github.io/
lolbas-project.github.io
https://www.youtube.com/watch?v=YGJaj6_3dGA
youtube.com
https://twitter.com/danielhbohannon
twitter.com
https://twitter.com/matthewdunwoody
twitter.com
https://www.us-cert.gov/sites/default/files/cdm_files/FNR_NIS_OTH_AWL_Strategic_Planning_Guide.pdf
us-cert.gov
https://github.com/GreatSCT/GreatSCT
github.com
https://twitter.com/ConsciousHacker
twitter.com
https://github.com/api0cradle/PowerAL
github.com
https://www.youtube.com/watch?v=dfMuzAZRGm4
youtube.com
https://github.com/tyranid/DotNetToJScript
github.com
https://www.mdsec.co.uk/2018/06/freestyling-with-sharpshooter-v1-0/
mdsec.co.uk
https://twitter.com/domchell
twitter.com
https://twitter.com/search?f=tweets&vertical=default&q=%23dailyscriptlet&src=typd
twitter.com
https://twitter.com/ItsReallyNick
twitter.com
https://twitter.com/JohnLaTwC
twitter.com
https://github.com/arekfurt/WinAWL
github.com
https://twitter.com/arekfurt
twitter.com
https://twitter.com/PhilipTsukerman
twitter.com
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8492
portal.msrc.microsoft.com
Elsewhere on bohops.com (16)
https://bohops.com/wp-content/uploads/2019/01/set_constrained_to_full_attempt.png
bohops.com
https://bohops.com/wp-content/uploads/2019/01/wmic.png
bohops.com
https://bohops.com/wp-content/uploads/2019/01/winrm.png
bohops.com
https://bohops.com/wp-content/uploads/2019/01/cscript_jscript_applocker_unsuccessful.png
bohops.com
https://bohops.com/wp-content/uploads/2019/01/jscript_dotnet_reflection.png
bohops.com
https://bohops.com/wp-content/uploads/2019/01/test_xsl_bypass_applocker.png
bohops.com
https://bohops.com/wp-content/uploads/2019/01/test_xsl_bypass_dg_failed.png
bohops.com
https://bohops.com/wp-content/uploads/2018/06/com_objects_clm.png
bohops.com
https://bohops.com/wp-content/uploads/2019/01/xmldom10_object_members.png
bohops.com
https://bohops.com/wp-content/uploads/2019/01/dg_clm_bypass_xmldom.png
bohops.com
https://bohops.com/wp-content/uploads/2019/01/wsh_script_success_jscript.png
bohops.com
https://bohops.com/wp-content/uploads/2019/01/powershell_low_order_load_defensive_recommendation.png
bohops.com
https://bohops.com/wp-content/uploads/2019/01/4103_module_log_executing_pipeline_comobject_microsoft.xmldom.png
bohops.com
https://bohops.com/wp-content/uploads/2019/01/network.png
bohops.com
https://bohops.com/wp-content/uploads/2019/01/applocker_8004_error.png
bohops.com
https://bohops.com/wp-content/uploads/2019/01/wdac_3077_error.png
bohops.com