Bypass Applocker on Sysinternal executables with winget.exe on Windows 11
Disclaimer: This video is for educational purposes only, do not hack a system or network without owner's consent or permission. Anything you learn is this video, can't be used to hack systems you do not have the permission to hack. And I can't be blamed! Be carefull!
Info:
A way to use winget.exe in Windows to bypass applocker deny rules(with default rule enabled)
A perfect way to use Sysinternals on a hardened Windows installation with Applocker.
Since winget.exe is autoelevating it let you install packages from the winget-repo or MSStore. Default Package location is WindowsApps under ProgramFiles, and the Default rule in Applocker allows executables from ProgramFiles. Therfore, is this bypass possible.
Commands and Poc:
1. Set up a Deny Policy on a sysinternal executable in Applocker
2. Open cmd as a standard user and use winget with the following command, to download and install sysinternals: winget install 9P7KNL5RWT25
3. Navigate to the tools folder of WindowsApps sysinternals: C:\Program Files\WindowsApps\Microsoft.SysinternalsSuite_2024.12.0.0_x64__8wekyb3d8bbwe\tools
4. Execute the .exe of one of the sysinternals that has a deny rule in Applocker
5. It will execute and run the .exe
#applocker #bypass #windowssecurity #sysinternals