Security researcher Casey Smith was trying to solve a particular problem and came up with a unique solution. He needed a reverse shell on a workstation that was locked down by the Windows AppLocker executable and the script rules that it enforced. Through his efforts, he found he could register his script to bypass AppLocker but still had to instantiate the object to trigger the code execution.

What Exactly Did Smith Find?

Smith found that if he placed the script block inside of the Registration tag and called regsvr32, the code would execute. With some further research, he discovered that the code in the registration element executes on register and unregister. He then unregistered the workstation using this code inside the Registration tag.

Furthermore, he found regsvr32 is already proxy-aware, uses TLS, follows redirects and is a signed Microsoft binary. He also discovered that regsvr32.exe can accept a URL for a script; hosting the .sct file at an arbitrary but controlled location works just fine. In order to trigger the bypass, the code block, which can be either Visual Basic or JavaScript, is placed inside the element.

Additionally, the COM object the script references never shows up in the Registry.

Why Does Windows AppLocker Matter?

“When AppLocker was introduced in Windows 7 and Windows Server 2008 R2, Microsoft provided administrators with the ability to set rules to allow or deny applications from running,” SecurityWeek explains.

“These rules could be enforced for specific users or groups and could be used for executable files (.exe and .com), scripts (.js, .ps1, .vbs, .cmd and .bat), Windows Installer files (.msi and .msp) and DLL files (.dll and .ocx).”

AppLocker is one of the primary tools in Windows that enforces security. It was introduced to specify which users can run apps within an organization. It has been touted by Microsoft to be of better security than EMET, but Smith’s research revealed it seems to be rather vulnerable to exploits.

This can be done remotely. Smith wrote a PowerShell server to handle execution and return output. The proof of concept can open a backdoor or a reverse shell over HTTP.

The regsvr32 component already has a history of providing backdoors; it was the path used by the NeverQuest banking Trojan. It seems that Smith’s technique provides yet another way for cybercriminals to make their way into Windows.