Me, myself & IT

Prevent bypass of AppLocker and SAFER alias Software Restriction Policies

Purpose

In case of denial it writes an entry 865, 866, 867, 868 or 882 from source Software Restriction Policies (on Windows XP and Windows Server 2003) or Microsoft-Windows-SoftwareRestrictionPolicies (on Windows Vista and newer versions of Windows NT) to the Event Log.

Reason

This bypass may also be exercised indirect: the flag SAFER_TOKEN_MAKE_INERT of the Win32 function SaferComputeTokenFromLevel() allows to create an inert token which can then be (ab)used with the Win32 functions CreateProcessAsUser() and CreateProcessWithTokenW(); both Win32 functions but require privileges to be held by their caller which are not assigned to unprivileged users.

Note: the flag LOAD_IGNORE_CODE_AUTHZ_LEVEL of the Win32 function LoadLibraryEx() and the flag SANDBOX_INERT of the Win32 function CreateRestrictedToken() enable this bypass too; both are but disabled for unprivileged users in Windows 8 and newer versions of Windows NT (in Windows 7 and Windows Server 2008 R2 with the hotfix 2532445, the hotfix 2894252, or the convenience rollup update 3125574).

Operation

Note: AppCertDlls are not documented by Microsoft^®!

Implementation

1. Create the text file APPCERT.C with the following content:

   // Copyright © 2004-2017, Stefan Kanthak <‍skanthak‍@‍nexgo‍.‍de‍>
   
   #define STRICT
   #define UNICODE
   #define WIN32_LEAN_AND_MEAN
   
   #define WINVER		0x0500
   #define _WIN32_WINNT	0x0500
   
   #include <windows.h>
   #include <winsafer.h>
   #include <wintrust.h>
   
   #define PROCESS_CREATION_QUERY		1L
   #define PROCESS_CREATION_ALLOWED	2L
   #define PROCESS_CREATION_DENIED		3L
   
   // see <https://msdn.microsoft.com/en-us/library/cc704588.aspx>
   
   #define STATUS_SUCCESS					0x00000000L
   #define STATUS_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY	0xC0000372L
   
   typedef	LONG	NTSTATUS;
   
   NTSTATUS	NTAPI	CreateProcessNotify(LPCWSTR lpApplicationName, DWORD dwReason)
   {
   	NTSTATUS	ntStatus = STATUS_SUCCESS;
   
   	// see <https://msdn.microsoft.com/en-us/library/ms722431.aspx>
   
   	SAFER_CODE_PROPERTIES	scp = {sizeof(SAFER_CODE_PROPERTIES),
   				       SAFER_CRITERIA_AUTHENTICODE | SAFER_CRITERIA_IMAGEHASH | SAFER_CRITERIA_IMAGEPATH,
   				       (LPCWSTR) NULL,
   				       (HANDLE) NULL,
   				       0L,
   				       {0},
   				       0L,
   				       {0},
   				       (ALG_ID) 0L,
   				       (LPBYTE) NULL,
   				       (HWND) NULL,
   				       WTD_UI_NONE};
   
   	SAFER_LEVEL_HANDLE	slh;
   
   	DWORD	dwLevelId;
   	DWORD	dwDummy;
   
   	switch (dwReason)
   	{
   	case PROCESS_CREATION_QUERY:
   		// called once for each process that is to be created:
   		// return STATUS_SUCCESS to allow process creation or
   		// return STATUS_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY to deny process creation
   
   		scp.ImagePath = lpApplicationName;
   
   		// see <https://msdn.microsoft.com/en-us/library/ms722428.aspx>
   
   		if (!SaferIdentifyLevel(1L, &scp, &slh, NULL))
   			OutputDebugStringA("AppCert!CreateProcessNotify: SaferIdentifyLevel() failed!\r\n");
   		else
   		{	// see <https://msdn.microsoft.com/en-us/library/ms722426.aspx>
   
   			if (!SaferGetLevelInformation(slh, SaferObjectLevelId, &dwLevelId, sizeof(dwLevelId), &dwDummy))
   				OutputDebugStringA("AppCert!CreateProcessNotify: SaferGetLevelInformation() failed!\r\n");
   			else
   				// see <https://msdn.microsoft.com/en-us/library/ms722425.aspx>
   
   				if (dwLevelId < SAFER_LEVELID_NORMALUSER)
   				{
   					ntStatus = STATUS_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY;
   
   					// see <https://msdn.microsoft.com/en-us/library/ms722430.aspx>
   
   					if (!SaferRecordEventLogEntry(slh, scp.ImagePath, NULL))
   						OutputDebugStringA("AppCert!CreateProcessNotify: SaferRecordEventLogEntry() failed!\r\n");
   				}
   
   			// see <https://msdn.microsoft.com/en-us/library/ms722423.aspx>
   
   			if (!SaferCloseLevel(slh))
   				OutputDebugStringA("AppCert!CreateProcessNotify: SaferCloseLevel() failed!\r\n");
   		}
   
   		break;
   
   	case PROCESS_CREATION_ALLOWED:
   		// called once for each process that is allowed creation
   
   	//	…
   
   		break;
   
   	case PROCESS_CREATION_DENIED:
   		// called once for each process that is denied creation
   
   	//	…
   
   		break;
   
   	default:
   		;
   	}
   
   	// the return value is only used for PROCESS_CREATION_QUERY,
   	// all other conditions are ignored
   
   	return ntStatus;
   }

2. Run the following three command lines to build APPCERT.DLL from the file APPCERT.C created in step 1. and cleanup afterwards:

   CL.EXE /c /GA /GF /GS- /Gy /O1 /Os /Oy- /Zl APPCERT.C
   LINK.EXE /DLL /DYNAMICBASE /EXPORT:CreateProcessNotify /NODEFAULTLIB /NOENTRY /NXCOMPAT /OPT:REF /RELEASE /SUBSYSTEM:WINDOWS APPCERT.OBJ ADVAPI32.LIB KERNEL32.LIB
   Erase APPCERT.EXP APPCERT.LIB APPCERT.OBJ

   Note: for systems with AMD64 alias x64 processor architecture build APPCERT.DLL for the I386 alias x86 processor architecture too!

3. Copy APPCERT.DLL to Windows' system directory %SystemRoot%\System32\.

   Note: on systems with AMD64 alias x64 processor architecture, additionally copy APPCERT.DLL built for the I386 alias x86 processor architecture to %SystemRoot%\SysWoW64\.

4. Create the following Registry entry:

   REGEDIT4
   
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls]
   "AppCert.Dll"="C:\\Windows\\System32\\AppCert.Dll"

Build details

APPCERT.DLL is available for the I386 alias x86, AMD64 alias x64 and IA64 processor architectures of Windows NT.

Code authenticity and integrity

Serial number

73633199

0x04638DAF

Fingerprint

MD5: 25 a0 d6 b0 bc 37 fe 49 42 d1 64 ca e6 7a f5 7f

SHA-1: 47 79 b5 28 f0 84 e6 ce f8 77 7b 62 dc c4 b3 1f fe de 07 14

-----BEGIN RSA PUBLIC KEY-----
MIIBCgKCAQEAxSwxNrFPXXn6y5Abl+0pH7faIK0xVAh70reOBrwSykab/0kIwz0QJldXNTLl
ZaSb4T7A5il2oqhiHUS53owsguXrDaJ+l+iTuCR/NrOVBJ0Xi+1Kv+ni/jb3cLvTS/BQJtFm
fVW3HHtYrQQcYCpd/AVzg1k2p46BEbGfFpjfFREdM589UDSzaiIOWSEBec8RI3HVqIMiG2qL
seuQot9shOcNcV2Y2AgTKHBUrWz10kbCWf8g5QA2hjmSMRvRtBOovCgvSF0nDFk4Odrn9nLB
PVq763s2vh/riO9cheTeg4N/ldbnAywdjLAwwJ1qynh2p/s/V5cnsoav7SZRGDyAoQIDAQAB
-----END RSA PUBLIC KEY-----

Note: due to its counter signature alias timestamp the digital signature remains valid past the X.509 certificates expiration date!

Download

X:\> EXTRACT.EXE /D APPCERT.CAB
Microsoft (R) Cabinet Extraction Tool - Version 5.1.2600.5512
Copyright (c) Microsoft Corporation. All rights reserved..

 Cabinet APPCERT.CAB

03-29-2017  4:04:12p A---        10,406 APPCERT.INF
03-29-2017  4:03:16p A---        32,472 AMD64\APPCERT.DLL
03-29-2017  4:03:34p A---        31,448 I386\APPCERT.DLL
03-29-2017  4:03:10p A---        35,032 IA64\APPCERT.DLL
                 4 Files        109,358 bytes

X:\>

"%SystemRoot%\System32\Expand.exe" /R APPCERT.CAB /F:* "‹target directory›"

Note: Expand.exe from prior versions of Windows NT ignore the paths and junk them; use Extract.exe from the Support Tools on Windows XP and Windows Server 2003 instead!

Note: if you open APPCERT.CAB in Windows Explorer switch to Details view and turn on the Path column.

Installation

The setup script APPCERT.INF copies the appropriate APPCERT.DLL to %SystemRoot%\System32\APPCERT.DLL and creates the following Registry entries to activate it:

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls]
"AppCert.Dll"="C:\\Windows\\System32\\AppCert.Dll"

Automatic online installation

Manual offline installation

Update

Deinstallation

On Windows XP and Windows Server 2003 open the Add/Remove Programs applet of the Control Panel, tick the checkbox Updates, select the entry Prevent bypass of AppLocker and SAFER alias Software Restriction Policies underneath Systemkonfiguration and click the Remove button.

On Windows Vista and newer versions of Windows NT open the Control Panel and click the entry View installed updates underneath the Programs and Features or Programs category.
In Installed Updates select the entry Prevent bypass of AppLocker and SAFER alias Software Restriction Policies underneath Systemkonfiguration and click the Uninstall menu entry.

Contact

Use the X.509 certificate to send S/MIME encrypted mail.

Notes: I dislike HTML (and even weirder formats too) in email, I prefer to receive plain text.
I also expect to see a full (real) name as sender, not a nickname!
Emails in weird formats and without a proper sender name are likely to be discarded.
I abhor top posts and expect inline quotes in replies.

Terms and conditions

• The software and the documentation on this site are provided as is without any warranty, neither express nor implied.
  In no event will the author be held liable for any damage(s) arising from the use of the software or the documentation.
• Permission is granted to use the current version of the software and the current version of the documentation solely for personal private and non-commercial purposes.
  An individuals use of the software or the documentation in his or her capacity or function as an agent, (independent) contractor, employee, member or officer of a business, corporation or organization (commercial or non-commercial) does not qualify as personal private and non-commercial purpose.
• Without written approval from the author the software or the documentation must not be used for a business, for commercial, corporate, governmental, military or organizational purposes of any kind, or in a commercial, corporate, governmental, military or organizational environment of any kind.
• Redistribution of the software and the documentation is allowed only in unmodified form of its current version and free of charge.