System Binary Proxy Execution
Running code through Microsoft-signed binaries (LOLBAS) to get around AppLocker and allow-lists.
How it shows up on Hack The Box
If AppLocker blocks your .exe files, try allowed and writable folders (C:\Windows\Tasks) or binaries such as MSBuild, InstallUtil or rundll32.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
- Vhost and subdomain fuzzing
- Default credentials
- Insecure deserialization
- Command injection
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- Weak or homemade cryptography
- Backups and archives
- Saved credentials / DPAPI
- AppLocker and Constrained Language Mode
Guides
- How antivirus and EDR detect you on Windows: AMSI, ETW, hooks, AppLocker and CLM explained 5 min read What Defender or an EDR checks when you run a tool (signatures, AMSI, ETW, hooks, kernel callbacks), how to tell what protects a box, and AppLocker and CLM.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Evasion explained: AMSI, ETW and AppLocker › AppLocker / CLM
Read the AppLocker rules
Target
Get-AppLockerPolicy -Effective -Xml
LOLBAS that run for you
Keys
# InstallUtil.exe, MSBuild.exe, regsvr32.exe, rundll32.exe: binarios firmados por Microsoft que ejecutan código y suelen estar en la lista blanca. Busca en lolbas-project.github.io.Phishing explained: macros, HTA and LNK › HTA
The pattern any EDR flags
Keys
# mshta.exe conectándose a una URL y creando cmd.exe o powershell.exe es un indicador de libro. Muchas empresas bloquean mshta.exe entero con AppLocker/WDAC.No command matches.