Hack Remote Windows PC using Regsvr32.exe (.sct) Application Whitelisting Bypass Server

This module simplifies the Regsvr32.exe Application Whitelisting Bypass technique. The module creates a web server that hosts a .sct file. When the user types the provided regsvr32 command on a system, regsvr32 will request the .sct file and then execute the included PowerShell command. This command then downloads and executes the specified payload (similar to the web_delivery module with PSH). Both web requests (i.e., the .sct file and PowerShell download and execute) can occur on the same port.

Exploit Targets

Windows 7/8/8.1/10

Requirement

Attacker: kali Linux

Victim PC: Windows 10

Open Kali terminal type msfconsole

//i0.wp.com/2.bp.blogspot.com/-joP4L1wzVJU/V4DIryPHKeI/AAAAAAAAMzs/NayqVVGdFcEplXsjPg96j90bEr4EVb0HgCLcB/s1600/1.png?w=687&ssl=1

//i0.wp.com/4.bp.blogspot.com/-X7VcsiHPea0/V4DIt32PecI/AAAAAAAAMz0/h3iLM6L2Y3Is9GSDY-YUhdo-ZRJInC-9wCLcB/s1600/2.png?w=687&ssl=1

Now, we have to copy the regsvr32 code generated in victim’s run bar on PC using social engineering method.

As soon as we do that, we will get access to the victim’s PC.

//i1.wp.com/2.bp.blogspot.com/-ASZvXozytbE/V4DItCIrDYI/AAAAAAAAMzw/l933S32ETT8x9JF_caM6ueAhSJqZ0YqqACLcB/s1600/3.png?w=687&ssl=1

Now type sessions –I to display sessions opened when the victim opens the link

Now the session has opened type sysinfo to get system information, then type shell to enter into Victims command prompt.

//i2.wp.com/4.bp.blogspot.com/-0kL3Dobq-qo/V4DIyzxw9JI/AAAAAAAAMz4/ilXy88Tczqc9xz7jOih49VRtrmYOp5f9gCLcB/s1600/4.png?w=687&ssl=1

Leave a Reply

Your email address will not be published. Required fields are marked *