What is Executing Commands and Bypassing AppLocker with PowerShell Diagnostic Scripts
A collection of tips and tricks for container and container orchestration hacking
Exploring the Directory Structure and Diagnostic Scripts
While investigating this directory structure, I discovered an intriguing arrangement that included diagnostic scripts located at the following ‘parent’ path: %systemroot%diagnosticssystem\. Notably, two subdirectories, (AERO) and (Audio), housed two significant signed PowerShell scripts: CL_Invocation.ps1 and CL_LoadAssembly.ps1. The script CL_Invocation.ps1 features a function called SyncInvoke, which is used to execute binaries via System.Diagnostics.Process. On the other hand, CL_LoadAssembly.ps1 offers two functions—LoadAssemblyFromNS and LoadAssemblyFromPath—that are designed for loading .NET/C# assemblies (DLLs/EXEs).
Executing Commands and Bypassing AppLocker with PowerShell Diagnostic Scripts Reviews
No reviews yet.
