>_0xFORUM
Sign in

Signed scripts only, and the intern's unsigned helper

in Defense15 replies1.3k views

Execution policy is not a security boundary. It is a speed bump. We still use it plus WDAC on the jump box. The helper got signed.

Sign your helpers. Do not ask for an exception because you are in a hurry.

Refs: ATT&CK

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 15 REPLIES

I reproduced it twice before I believed you. You wrote «Execution policy is not a security boundary». That is the sentence I keep. Firewall rules not in the repo are unreviewed code. Pinned a comment at 0x1400001fb in the listing.

@black

I reproduced it twice before I believed you. You wrote «Execution policy is not a security boundary». That is the sentence I keep. Firewall

Calling the sticky 'priest talk' is how you earn a ban note. I failed this exact class in January. You wrote «Execution policy is not a security boundary». That is the sentence I keep. Jump box is not a desktop. No browser, no mail, no Slack. Same class as the October thread, different binary.

I failed this exact class in January. On «Signed scripts only, and the intern's unsigned helper»: Execution policy is not a security boundary. Snapshot or it did not happen. I will not restore your VM again. My note id for this: cc-02.

This is the kind of thread that should be a sticky and is not. On «Signed scripts only, and the intern's unsigned helper»: Execution policy is not a security boundary. Allow-list entries expire. 90 days or they are a vulnerability. I reproduced it on lab build 1119.

@charleswise

I failed this exact class in January. On «Signed scripts only, and the intern's unsigned helper»: Execution policy is not a security boundar

That is a vibe. I asked for a listing offset. I would have written the opposite conclusion a year ago. You wrote «Execution policy is not a security boundary». That is the sentence I keep. Host-only NIC, no shared folders, no drag-drop. Floor, not ceiling. Which build of the tool? I got burned mixing notes across versions. I reproduced it on lab build 1234.

@cloud

I would have written the opposite conclusion a year ago. You wrote «Execution policy is not a security boundary». That is the sentence I kee

This is the writeup I wanted when I was stuck. On «Signed scripts only, and the intern's unsigned helper»: Execution policy is not a security boundary. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. I reproduced it on lab build 1019.

Please keep the hashes and drop the mystery zips. On «Signed scripts only, and the intern's unsigned helper»: Execution policy is not a security boundary. Snapshot or it did not happen. I will not restore your VM again. I wrote a 12-line script and then threw it away. The listing was enough.

@grey

This belongs in the first-hour ritual. The load-bearing line: Execution policy is not a security boundary. Isolate the host too, or stop cal

This is getting personal and it does not need to. I will argue the opposite and then probably agree. The load-bearing line: Execution policy is not a security boundary. Snapshot or it did not happen. I will not restore your VM again. Version in my shot: current lab snapshot, not last year's blog.

@crypta

This is the writeup I wanted when I was stuck. On «Signed scripts only, and the intern's unsigned helper»: Execution policy is not a securit

If you cannot paste bytes, you do not have a counterexample. Bookmarking this for the lab wiki. The load-bearing line: Execution policy is not a security boundary. Allow-list entries expire. 90 days or they are a vulnerability. Took me 2 hours the first time.

@iam_sammy

Same wall I hit last quarter. You wrote «Execution policy is not a security boundary». That is the sentence I keep. Firewall rules not in th

That insult was not a technical point. I am reporting it. Came back to this after a coffee. Still hold. You wrote «Execution policy is not a security boundary». That is the sentence I keep. If debug requires turning the control off, the debug story is wrong. Can you quote the offset instead of the graph screenshot? I still have the snapshot named defe-204-pre.

I tried the naive path first and wasted a morning. You wrote «Execution policy is not a security boundary». That is the sentence I keep. Allow-list entries expire. 90 days or they are a vulnerability. Is the hang the incomplete patch, or a second bug? If anyone DMs me a zip I will not open it. Hash in-thread.

Same wall I hit last quarter. You wrote «Execution policy is not a security boundary». That is the sentence I keep. Firewall rules not in the repo are unreviewed code. My note id for this: cc-12.

Also: Isolate the host too, or stop calling the guest isolated.

@flarex

I tried the naive path first and wasted a morning. You wrote «Execution policy is not a security boundary». That is the sentence I keep. All

Decompiler output is a hypothesis. Treat it like one. I tried the naive path first and wasted a morning. On «Signed scripts only, and the intern's unsigned helper»: Execution policy is not a security boundary. Jump box is not a desktop. No browser, no mail, no Slack. Pinned a comment at 0x140004ac2 in the listing.

@derekconnect

This is the kind of thread that should be a sticky and is not. On «Signed scripts only, and the intern's unsigned helper»: Execution policy

You keep moving the goalposts. First it was the decoder, now it is the dump. I failed this exact class in January. The load-bearing line: Execution policy is not a security boundary. Firewall rules not in the repo are unreviewed code. I will +rep a listing and −rep a vibe. That is the deal.

@freqx

I tried the naive path first and wasted a morning. On «Signed scripts only, and the intern's unsigned helper»: Execution policy is not a sec

This belongs in the first-hour ritual. The load-bearing line: Execution policy is not a security boundary. Isolate the host too, or stop calling the guest isolated. Version in my shot: current lab snapshot, not last year's blog.

Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.