Regsvr32.exe (.sct) Application Whitelisting Bypass Server
Posted by deepcore on June 16, 2016 – 10:46 pm
This Metasploit module simplifies the Regsvr32.exe Application Whitelisting Bypass technique. The module creates a web server that hosts an .sct file. When the user types the provided regsvr32 command on a system, regsvr32 will request the .sct file and then execute the included PowerShell command. This command then downloads and executes the specified payload (similar to the web_delivery module with PSH). Both web requests (i.e., the .sct file and PowerShell download and execute) can occur on the same port.
Post a reply
You must be logged in to post a comment.