Withelisting Defeat Through Arbitrary C-Sharp Code Execution

Attacking software, a system, or a device requires the attackers to understand its workflow and functionality. Sometimes, it is necessary only to abuse an obsolete service to attack a device. On the other hand, it might be complicated, as we will have to use another path for the attack, such as reverse engineering, command injection, process injection and migration, process hollowing, etc. However, in our case for the allow-listing bypass, we embraced the reverse engineering technique in our previous paper (cited in the introduction) on a Windows 10 Edition machine. We selected this route as we must copy the functionalities of a Windows native binary and address it to our malicious payload. We will use this approach to perform code execution attacks under certain circumstances. Various software are used to enhance the security of devices with Windows operating systems (OS) installed. This paper will target the AppLocker allow-listing application. However, other Windows versions, such as Windows Enterprise and Professional, use other protections.