updates

red-teaming/Bypass-ConstrainedLanguageMode/Bypass-CLM.ps1

@@ -100,7 +100,7 @@ function Bypass-CLM
     Write-Host "`tAppLocker Constrined Language Mode Bypass via COM"
     Write-Host "`t(implementation of: @xpn's technique, as documented in:)"
     Write-Host "`t(https://www.mdsec.co.uk/2018/09/applocker-clm-bypass-via-com/)"
-    Write-Host "`n`tRe-implemented, enhanced by: Mariusz B., mgeeky"
+    Write-Host "`n`tRe-implemented, enhanced by: Mariusz Banach, mgeeky"
     Write-Host "`t-----`n"
 
     Write-Host "[.] Step 0. Planted DLL files in:`n`t$dstAssemblyPath`n`t$dstDllPath"

red-teaming/Bypass-ConstrainedLanguageMode/Bypass-CLM2.ps1

@@ -129,7 +129,7 @@ function Bypass-CLM
     Write-Host "`tAppLocker Constrined Language Mode Bypass via COM"
     Write-Host "`t(implementation of: @xpn's technique, as documented in:)"
     Write-Host "`t(https://www.mdsec.co.uk/2018/09/applocker-clm-bypass-via-com/)"
-    Write-Host "`n`tRe-implemented by: Mariusz B., mgeeky"
+    Write-Host "`n`tRe-implemented by: Mariusz Banach, mgeeky"
     Write-Host "`t-----`n"
 
     $EncodedAssemblyDll = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAKxM2ZIAAAAAAAAAAOAAIiALATAAAA4AAAAGAAAAAAAAEi0AAAAgAAAAQAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAL0sAABPAAAAAEAAAMgDAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAYLAAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAGA0AAAAgAAAADgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAMgDAAAAQAAAAAQAAAAQAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAFAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADxLAAAAAAAAEgAAAACAAUAwCEAAFgKAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABswBAAnAQAAAQAAEXIBAABwKA8AAApyZwAAcCgQAAAKbxEAAAoKEgAoEgAACnK5AABwKAEAAAYKEgAoEgAACigTAAAKKA8AAAoCbxQAAAoWMRVywQAAcAJy6QAAcCgVAAAKKA8AAAooFgAACm8XAAAKFm8YAAAKKBYAAApvGQAAChZvGgAACt4TC3LtAABwBygbAAAKKA8AAAreAAAoHAAACiUWbx0AAAolGW8eAAAKJW8fAAAKJW8XAAAKFm8YAAAKbyAAAAreEwxyHwEAcAgoGwAACigPAAAK3gAAKCEAAAolFm8iAAAKJRlvIwAACigkAAAKDQlvHwAACglvFwAAChZvGAAACglvIAAACt4KCSwGCW8lAAAK3N4VEwRyUQEAcBEEKBsAAAooDwAACt4AFioAATQAAAAAawASfQATEQAAAQAAkQAsvQATEQAAAQIA6gAaBAEKAAAAAAAA0QA/EAEVEQAAAR4CKCYAAAoqQlNKQgEAAQAAAAAADAAAAHY0LjAuMzAzMTkAAAAABQBsAAAA0AIAACN+AAA8AwAACAQAACNTdHJpbmdzAAAAAEQHAACEAQAAI1VTAMgIAAAQAAAAI0dVSUQAAADYCAAAgAEAACNCbG9iAAAAAAAAAAIAAAFHFQIUCQAAAAD6ATMAFgAAAQAAAB0AAAACAAAAAwAAAAEAAAAmAAAADgAAAAEAAAABAAAAAQAAAAEAAAACAAAAAAChAgEAAAAAAAYAxgFcAwYAMwJcAwYA+gADAw8AfAMAAAYAIgHhAgYAqQHhAgYAigHhAgYAGgLhAgYA5gHhAgYA/wHhAgYAOQHhAgYADgE9AwYA7AA9AwYAbQHhAgYAVAFiAgYAtAO4AgYA8wK4AgoAbAAWAwYAoQC4AgYASwBRAgYAAQC4AgYAfgK4AgoA9gMWAwoAdQDEAgoAxQAWAwoA4gMWAwYA3QBRAgoAiwMWAwYAlQC4AgAAAAAHAAAAAAABAAEAAQAQAM8DzwNBAAEAAQAAAAAAgACRIC0AjAABAFAgAAAAAJYAyQOQAAEAuCEAAAAAhhj9AgYAAgAAAAEAhQIJAP0CAQARAP0CBgAZAP0CCgApAP0CEAAxAP0CEAA5AP0CEABBAP0CEABJAP0CEABRAP0CEABZAP0CEABhAP0CFQBpAP0CEABxAP0CEAB5AP0CEACZAKkAJgChAEAAKwChABkAMACpAHwCNACxAK0DOACxAIkCMACxAK0DQACRAGEARwCRAPIDTAC5AIQAUQCRAMEAVwDJAIQAUQCxAK0DXADRAFIARwCRANkAYgCRAJsDaACRAL8CBgCRALMABgDJALsDbgDJANkAYgDJAJsDaADRAFIAcwDpALkABgCBAP0CBgAuAAsAlQAuABMAngAuABsAvQAuACMAxgAuACsA3gAuADMA3gAuADsA3gAuAEMAxgAuAEsA5AAuAFMA3gAuAFsA3gAuAGMA/AAuAGsAJgEuAHMAMwEaAJQCAAEDAC0AAQAEgAAAAQAAAAAAAAAAAAAAAADPAwAABAAAAAAAAAAAAAAAegAQAAAAAAADAAAAAAAAAAAAAACDAMQCAAAAAAAAAEludDMyADxNb2R1bGU+AG1zY29ybGliAGdldF9NYW5hZ2VkVGhyZWFkSWQAR2V0Q3VycmVudFRocmVhZElkAGdldF9DdXJyZW50VGhyZWFkAENyZWF0ZVJ1bnNwYWNlAGdldF9EZWZhdWx0UnVuc3BhY2UAUFNMYW5ndWFnZU1vZGUAc2V0X0xhbmd1YWdlTW9kZQBJRGlzcG9zYWJsZQBDb25zb2xlAFdyaXRlTGluZQBDbG9zZQBEaXNwb3NlAGdldF9Jbml0aWFsU2Vzc2lvblN0YXRlAHNldF9BcGFydG1lbnRTdGF0ZQBHdWlkQXR0cmlidXRlAERlYnVnZ2FibGVBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBBc3NlbWJseVRpdGxlQXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAFRhcmdldEZyYW1ld29ya0F0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAEFzc2VtYmx5Q29uZmlndXJhdGlvbkF0dHJpYnV0ZQBBc3NlbWJseURlc2NyaXB0aW9uQXR0cmlidXRlAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAQXNzZW1ibHlQcm9kdWN0QXR0cmlidXRlAEFzc2VtYmx5Q29weXJpZ2h0QXR0cmlidXRlAEFzc2VtYmx5Q29tcGFueUF0dHJpYnV0ZQBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQBTeXN0ZW0uVGhyZWFkaW5nAFN5c3RlbS5SdW50aW1lLlZlcnNpb25pbmcAVG9TdHJpbmcAYXJnAGdldF9MZW5ndGgAa2VybmVsMzIuZGxsAENsbURpc2FibGVBc3NlbWJseS5kbGwAU3lzdGVtAE9wZW4AU3lzdGVtLk1hbmFnZW1lbnQuQXV0b21hdGlvbgBTeXN0ZW0uUmVmbGVjdGlvbgBFeGNlcHRpb24ALmN0b3IAU3lzdGVtLkRpYWdub3N0aWNzAFN5c3RlbS5NYW5hZ2VtZW50LkF1dG9tYXRpb24uUnVuc3BhY2VzAFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcwBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAERlYnVnZ2luZ01vZGVzAFBTVGhyZWFkT3B0aW9ucwBzZXRfVGhyZWFkT3B0aW9ucwBDb25jYXQAT2JqZWN0AENyZWF0ZURlZmF1bHQAU3RhcnQAQ2xtRGlzYWJsZUFzc2VtYmx5AFJ1bnNwYWNlRmFjdG9yeQBnZXRfU2Vzc2lvblN0YXRlUHJveHkAAGVbACsAXQAgAE0AYQBuAGEAZwBlAGQAIABtAG8AZABlACAAYQBzAHMAZQBtAGIAbAB5AC4AIABEAGkAcwBhAGIAbABpAG4AZwAgAEMATABNACAAZwBsAG8AYgBhAGwAbAB5AC4AAFEJAEMAdQByAHIAZQBuAHQAIAB0AGgAcgBlAGEAZAAgAEkARAAgACgAbQBhAG4AYQBnAGUAZAAvAHUAbgBtAGEAbgBhAGcAZQBkACkAOgAgAAAHIAAvACAAACcJAFAAYQBzAHMAZQBkACAAYQByAGcAdQBtAGUAbgB0ADoAIAAnAAEDJwABMVsALQBdACAAQQBwAHAAcgBvAGEAYwBoACAAIwAxACAAZgBhAGkAbABlAGQAOgAgAAExWwAtAF0AIABBAHAAcAByAG8AYQBjAGgAIAAjADIAIABmAGEAaQBsAGUAZAA6ACAAATFbAC0AXQAgAEEAcABwAHIAbwBhAGMAaAAgACMAMwAgAGYAYQBpAGwAZQBkADoAIAABADY1r1S0doROqU1z4xlH88oABCABAQgDIAABBSABARERBCABAQ4EIAEBAgsHBQgSRRJFEkkSRQQAAQEOBAAAElEDIAAIAyAADgcABA4ODg4OBgADDg4ODgQAABJJBCAAEl0FIAEBEWEEIAASZQUAAg4cHAUgAQERbQUgAQERcQQAABJlBgABEkkSZQi3elxWGTTgiQgxvzhWrTZONQMAAAgEAAEIDggBAAgAAAAAAB4BAAEAVAIWV3JhcE5vbkV4Y2VwdGlvblRocm93cwEIAQACAAAAAAAXAQASQ2xtRGlzYWJsZUFzc2VtYmx5AAAFAQAAAAAXAQASQ29weXJpZ2h0IMKpICAyMDE5AAApAQAkNTA1NGMxM2YtMTM1MS00N2I5LWE2Y2EtMjVmNDU0OGY2OGE3AAAMAQAHMS4wLjAuMAAASQEAGi5ORVRGcmFtZXdvcmssVmVyc2lvbj12NC41AQBUDhRGcmFtZXdvcmtEaXNwbGF5TmFtZRIuTkVUIEZyYW1ld29yayA0LjUAAAAAAAAAC27JkwAAAAACAAAAbQAAAFAsAABQDgAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAFJTRFN1QVzlk1FhQKAG7haQc5w3AQAAAEQ6XHJlc2VhcmNoXGFtc2lcQ2xtRGlzYWJsZURsbFxDbG1EaXNhYmxlLine truncated

red-teaming/Bypass-ConstrainedLanguageMode/ClmDisableDll/main.cpp

@@ -2,7 +2,7 @@
  * This DLL hosts CLR4 environment from within a native binary. This way it is possible to
  * call .NET APIs from an unmanaged runtime.
  *
- * Mariusz B., mgeeky, 19'
+ * Mariusz Banach, mgeeky, 19'
  *
 **/
 

red-teaming/Bypass-ConstrainedLanguageMode/README.md

@@ -26,7 +26,7 @@ PS > .\Bypass-CLM.ps1
         (implementation of: @xpn's technique, as documented in:)
         (https://www.mdsec.co.uk/2018/09/applocker-clm-bypass-via-com/)
 
-        Re-implemented, enhanced by: Mariusz B., mgeeky
+        Re-implemented, enhanced by: Mariusz Banach, mgeeky
         -----
 
 [.] Step 0. Planted DLL files in: