{"id":4366,"date":"2017-10-22T22:52:44","date_gmt":"2017-10-22T22:52:44","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=4366"},"modified":"2018-03-25T18:53:37","modified_gmt":"2018-03-25T18:53:37","slug":"running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-3","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2017\/10\/22\/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-3\/","title":{"rendered":"Running programs via Proxy &#038; jumping on a EDR-bypass trampoline, Part 3"},"content":{"rendered":"<p>Apparently, there is a never-ending stream of genuine OS components and legitimate applications that are not only signed, but are also rich in features that can be used to disturb the process tree&#8230; and hide from EDR.<\/p>\n<p>Here&#8217;s another one: stubapp.exe<\/p>\n<p>It is an application installed by HP drivers that can be typically found in these 2 locations:<\/p>\n<ul>\n<li>C:\\Program Files\\HP\\HPLJUT\\stubapp.exe<\/li>\n<li>c:\\Program Files (x86)\\HP\\HPLJUT\\stubapp.exe<\/li>\n<\/ul>\n<p>The program comes with a sample stubapp.ini file that explains the .ini file syntax:<\/p>\n<pre>;\r\n; StubApp ini file\r\n;\r\n; usage:\r\n; Stubapp -i &lt;inifile&gt; -m &lt;section&gt;\r\n;\r\n; [section]\r\n; 1=x\r\n; 2=y\r\n; [1.2k]\r\n; exename=notepad.exe\r\n; &lt;section&gt; contains a list with parts to run\r\n[...]\r\n; Application parameters\r\n; exename - location of application\r\n; command line parameters to be passed - exact syntax\r\n; waittofinish - 0=execute and continue; 1=wait for it to finish execution before continuing (CreateProcess must =1)\r\n; createprocess - user create process instead of shell execute; 1=yes, 0 or not specified = shellexecute (cannot waittofinish)\r\n; whentorun - 0=sw first only; 1=hw first only; 2=both hw and sw 1st; \r\n; 3=check the processes in [File_detect] &amp; [regdetect] Sections (check for PNP)<\/pre>\n<p>With this info we can quickly craft a simple .ini file which we can use to e.g. launch Calculator:<\/p>\n<pre>[Foo]\r\n1=Bar\r\n\r\n[Bar]\r\nexename=c:\\windows\\system32\\calc.exe\r\nparams=\"\"\r\nwaittofinish=0\r\nwhentorun=2\r\ncreateprocess=1<\/pre>\n<p>We launch it with the following command:<\/p>\n<pre>stubapp.exe -i &lt;fullpath to ini file&gt;  -m Foo<\/pre>\n<p>As a side effect of executing the program we will observe a log file created in a temporary directory (%TEMP%\\stubapp.log) that amongst other things contains the following information:<\/p>\n<pre> Application to launch: c:\\windows\\system32\\calc.exe\r\n Application parameters: \r\n Wait for application to finish: 0\r\n When to run application: 2\r\n If we should use CreateProcess: 1\r\n if we should check the registry: NOT FOUND\r\n SW 1st or HW 1st - Launching: c:\\windows\\system32\\calc.exe\r\n CreateProcess = 1, using CreateProcess\r\n Application to launch: \"c:\\windows\\system32\\calc.exe\" \r\n CStubApp::RunCreateProcess: Entering\r\n Process launched<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Apparently, there is a never-ending stream of genuine OS components and legitimate applications that are not only signed, but are also rich in features that can be used to disturb the process tree&#8230; and hide from EDR. Here&#8217;s another one: &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2017\/10\/22\/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-3\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[43,52,56,64],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4366"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=4366"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4366\/revisions"}],"predecessor-version":[{"id":4369,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4366\/revisions\/4369"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=4366"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=4366"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=4366"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}