Add evasion module applocker_evasion_install_util

[NickTyrer]

Intro

This module is designed to evade solutions such as software restriction policies and Applocker.
The main vector for this bypass is to use the trusted binary InstallUtil.exe in executing user supplied code.

This pull request is in reference to the previous pull request #8783.

Vulnerable Application

This evasion will work on all versions of Windows that include .net versions 3.5 or greater (note: ensure the selected payload matches the target os architecture).

Verification Steps

1. Enable Applocker and enable executable rules
2. Verify a standard .exe will not run from the users desktop
3. Do use evasion/windows/applocker_evasion_install_util
4. Do exploit
5. Follow the onscreen instructions by copying the created file to the targets desktop
6. Verify that the .exe executes from the users Desktop

[NickTyrer]

@busterb should I submit each Applocker evasion technique as separate evasion modules or should I create one module that gives the option of which Applocker evasion to create?

[cbrnrd]

software restriction policies

this is too vague

[NickTyrer]

Thanks @cbrnrd for the review.

[wchen-r7]

Release Notes

The applocker_evasion_install_util module has been added to the framework. It is designed to evade software restriction policies and Applocker. The main vector for this bypass is to use the trusted binary InstallUtil.exe in executing user supplied code.