TL;DR .BGI files can be sent on mail as attachment and can execute code when opened.Requires that BGinfo.exe has been run on the remote machine once. It will also bypass Outlook attachment protection (Fixed with Defense-in-depth patch from September 2017). PowerShell functions to generate BGI and VBSWebMeter here: https://github.com/api0cradle/BGInfo I was acknowledged on […]
Whenever I have a chance I use my time diving into Windows internal binaries to uncover hidden functionality. This blogpost is dedicated to things I have discovered with the CMSTP.exe binary file. I found a UAC Bypass using sendkeys and a way to load DLL files from a Webdav server. I know the bypass I […]
Jeg gleder meg virkelig til å holde høstkurs for Hackcon fra 18. til 21. september. Dersom du skal på høstkurset så kan du lese denne blogposten så skal jeg gi deg litt oversikt over hva kurset skal inneholde og hva du kan glede deg til. Dette er første gang (som jeg vet om) noen kjører […]
TL;DR You can run a remote shell through ICMP. ICMP can be used for bad. Many customers have asked me this question many times, and in general ICMP (ICMP is a lot more than just ping, but is often referred to as ping for simplicity) is a nice thing to use to verify if […]
Just wanted to do a quick follow-up on this bypass. Seems that BGInfo 4.22 still can be used to bypass AppLocker using the techniques I showed in my previous post. Meaning that if you use AppLocker as whitelisting solution I guess you must deny BGInfo.exe in order to prevent this bypass. Screenshots from an AppLocker […]
TL;DR BGinfo.exe older than version 4.22 can be used to bypass application whitelisting using vbscript inside a bgi file. This can run directly from a webdav server. UPDATE: 22.05.2017 AppLocker is still vulnerable with Bginfo 4.22. A blogpost about that here: https://msitpros.com/?p=3860 UPDATE: 19.06.2017 Microsoft has thanked me in their documentation for this finding. The […]
I must say that NIC 2017 was an awesome event and I meet a lot of great people. Thanks to all the people working for NIC that made this such a great event. During my presentation, I did not get enough time to show all the things I wanted to (damn you demo gods), and […]
I received a lot of positive feedback on my previous post on accessing the clipboard from the lock screen using the wireless password field. https://msitpros.com/?p=3746 Just out of curiosity I tried other combinations on doing the same thing, and I found out another cool trick to do the same using the Narrator feature in Windows. […]
This is probably something that many already knows and there are probably other and better blogposts about this, but I thought that it is important to refresh old knowledge. In Skype it is possible to send links in an IM chat and that’s great. A problem with that is that it can be used for […]
If there is one session about security I really think you should watch, it is definitely Rob Joyce’s talk at USENIX. Rob Joyce leads the NSAs Tailed Access Operations. They are often referred to as Nation-State hackers. His session is about tips on how to prevent or make it more difficult for Nation-State Hackers to get […]