组策略Software Restriction Policies (SRP)提权

  1. rename gpdisable.dll to deskpan.dll;
  2. create a new folder and name it as files.{42071714-76d4-11d1-8b24-00a0c9068ff3};
  3. place deskpan.dll to the new folder;
  4. open the folder;
  5. create a new rich text document in the folder;
  6. double-click the rich-text document.
  7. Wordpad runs with gpdisable.dll
  8. Bypassed :) We can run any process.

gpdisable下载

via

Comments