Author: Oddvar Moe [MVP]

Harden Windows with AppLocker – based on Case study part 1

Posted on by Oddvar Moe [MVP]

This blogpost is actually a tribute to Matt Graeber's request from twitter. Since I have learned so much stuff from that guy, I take these sort of request really seriously.   In my post about how insecure AppLocker really are we concluded that the only valid bypass technique (from the 7 I tested) was actually … Continue reading Harden Windows with AppLocker – based on Case study part 1 →

AppLocker – Case study – How insecure is it really? – Part 1

Posted on by Oddvar Moe [MVP]

I often hear that AppLocker is not very safe and it is easy to bypass. Since I really like AppLocker and I recommend it to customers, I decided to do this blogpost series and go over the different bypasses that we know of and see if they are working towards a default configured AppLocker setup. … Continue reading AppLocker – Case study – How insecure is it really? – Part 1 →

My experience with IT DEV CONNECTIONS 2017 and demo videos

Posted on by Oddvar Moe [MVP]

Earlier this year I submitted three sessions to the IT DEV CONNECTIONS conference and to my big surprise all of them was accepted. I was hoping that at least one of them was accepted, but all three was, and that is just incredible. I must admit at first that I was a bit scared, since … Continue reading My experience with IT DEV CONNECTIONS 2017 and demo videos →

Defense-In-Depth write-up

Posted on by Oddvar Moe [MVP]

TL;DR .BGI files can be sent on mail as attachment and can execute code when opened.Requires that BGinfo.exe has been run on the remote machine once. It will also bypass Outlook attachment protection (Fixed with Defense-in-depth patch from September 2017). PowerShell functions to generate BGI and VBSWebMeter here: https://github.com/api0cradle/BGInfo     I was acknowledged on … Continue reading Defense-In-Depth write-up →

Bypassing Device guard UMCI using CHM – CVE-2017-8625

Posted on by Oddvar Moe [MVP]

TL;DR You could/can bypass Device Guard user mode code integrity with a custom CHM and execute code. The last 6 months I have done some security research on my (little) spare time, because I find that very interesting. During this time, I was lucky enough to find another valid Device Guard UMCI bypass (I found … Continue reading Bypassing Device guard UMCI using CHM – CVE-2017-8625 →

Clarification – BGInfo 4.22 – AppLocker still vulnerable

Posted on by Oddvar Moe [MVP]

Just wanted to do a quick follow-up on this bypass. Seems that BGInfo 4.22 still can be used to bypass AppLocker using the techniques I showed in my previous post. Meaning that if you use AppLocker as whitelisting solution I guess you must deny BGInfo.exe in order to prevent this bypass. Screenshots from an AppLocker … Continue reading Clarification – BGInfo 4.22 – AppLocker still vulnerable →

Bypassing Application Whitelisting with BGInfo

Posted on by Oddvar Moe [MVP]

TL;DR BGinfo.exe older than version 4.22 can be used to bypass application whitelisting using vbscript inside a bgi file. This can run directly from a webdav server. UPDATE: 22.05.2017 AppLocker is still vulnerable with Bginfo 4.22. A blogpost about that here: https://oddvar.moe/2017/05/22/clarification-bginfo-4-22-applocker-still-vulnerable/ UPDATE: 19.06.2017 Microsoft has thanked me in their documentation for this finding. The … Continue reading Bypassing Application Whitelisting with BGInfo →