{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7189","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7189/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7189/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7189/events","html_url":"https://github.com/rapid7/metasploit-framework/issues/7189","id":169862867,"number":7189,"title":"Feature Request: Applocker Bypass - JAVA","user":{"login":"FireFart","id":105281,"avatar_url":"https://avatars.githubusercontent.com/u/105281?v=3","gravatar_id":"","url":"https://api.github.com/users/FireFart","html_url":"https://github.com/FireFart","followers_url":"https://api.github.com/users/FireFart/followers","following_url":"https://api.github.com/users/FireFart/following{/other_user}","gists_url":"https://api.github.com/users/FireFart/gists{/gist_id}","starred_url":"https://api.github.com/users/FireFart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FireFart/subscriptions","organizations_url":"https://api.github.com/users/FireFart/orgs","repos_url":"https://api.github.com/users/FireFart/repos","events_url":"https://api.github.com/users/FireFart/events{/privacy}","received_events_url":"https://api.github.com/users/FireFart/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-08T07:53:24Z","updated_at":"2016-08-08T09:55:14Z","closed_at":null,"body":"Pinging @OJ because he wrote the initial https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/applocker_bypass.rb\r\n\r\nAnother Applocker Bypass that might be worth implementing: JAVA\r\n\r\nAs Java is installed in %PROGRAMFILES% it should be whitelisted by Applockers default Ruleset. If we would deploy a jar File containing the Payload and call it via java.exe -jar payload.jar , this should also bypass Applocker. The payload could be included in the jar file itself, or be provided as a single encoded parameter to trick some AVs. "},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/238191901","html_url":"https://github.com/rapid7/metasploit-framework/issues/7189#issuecomment-238191901","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7189","id":238191901,"user":{"login":"OJ","id":28896,"avatar_url":"https://avatars.githubusercontent.com/u/28896?v=3","gravatar_id":"","url":"https://api.github.com/users/OJ","html_url":"https://github.com/OJ","followers_url":"https://api.github.com/users/OJ/followers","following_url":"https://api.github.com/users/OJ/following{/other_user}","gists_url":"https://api.github.com/users/OJ/gists{/gist_id}","starred_url":"https://api.github.com/users/OJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OJ/subscriptions","organizations_url":"https://api.github.com/users/OJ/orgs","repos_url":"https://api.github.com/users/OJ/repos","events_url":"https://api.github.com/users/OJ/events{/privacy}","received_events_url":"https://api.github.com/users/OJ/received_events","type":"User","site_admin":false},"created_at":"2016-08-08T09:55:13Z","updated_at":"2016-08-08T09:55:13Z","body":"Ooh nice. I'll look to throw this in soon.\n"}}
{"actor":{"display_login":"OJ"}}