 name of the algorithm used.

 
A Windows feature which can result in bypassing User Group Policy - miles
https://medium.com/tenable-techblog/bypass-windows-10-user-group-policy-and-more-with-this-one-weird-trick-552d4bc5cc1b
======
gruez
_yawn_ yet another case of an "exploit" that involves being other side of an
airtight hatchway[1]. most/all of the important group policy settings are
machine, rather than user. the user group policy settings are mainly with
appearance/styling.

Let's go through each of the "implications".

>Single File Code Execution

If you were able to drop that file, you're either that user, or an
administrator on the computer. If you're that user, you could also achieve
"single file code execution" by dropping a file to the startup folder, or
creating an autorun registry key. If you are an administrator, you already own
the machine.

>Antivirus/EDR Bypass

possibly, although your payload would still have to get pass behavioral
analysis when it's executing.

>Denial of Service

yeah, but you can achieve the same thing by adding "logoff" as an autorun
entry.

[1]
[https://devblogs.microsoft.com/oldnewthing/?p=100665](https://devblogs.microsoft.com/oldnewthing/?p=100665),
or search for that term on the blog, there are multiple entries.

~~~
wolrah
> If you were able to drop that file, you're either that user, or an
> administrator on the computer. If you're that user, you could also achieve
> "single file code execution" by dropping a file to the startup folder, or
> creating an autorun registry key. If you are an administrator, you already
> own the machine.

As I see it the biggest practical issue with this is that it provides a method
for persistence that no user will ever find and even most Windows
administrators will have no idea to look for.

~~~
gruez
>As I see it the biggest practical issue with this is that it provides a
method for persistence that no user
name of the algorithm used. 

 
 A Windows feature which can result in bypassing User Group Policy - mile 
 https://medium.com/tenable-techblog/bypass-windows-10-user-group-policy-and-more-with-this-one-weird-trick-552d4bc5cc1b 
 = = = = = = 
 gruez 
 _ gape _ yet another case of an " feat " that involves being early side of an 
 airtight hatchway[1 ]. most / all of the important group policy context are 
 car, rather than user. the user group policy settings are mainly with 
 appearance / styling. 

 lease's go through each of the " implications ". 

 > Single File Code Execution 

 If you were able to dribble that file, you're either that user, or an 
 administrator on the computer. If you're that user, you could also achieve 
 " single file code performance " by dropping a file to the startup folder, or 
 creating an autorun register key. If you are an administrator, you already own 
 the machine. 

 > Antivirus / EDR Bypass 

 possibly, although your warhead would still experience to get pass behavioral 
 analysis when it's executing. 

 > Denial of Service 

 yeah, but you can achieve the same matter by adding " logoff " as an autorun 
 entry. 

 [ 1 ] 
 [ https://devblogs.microsoft.com/oldnewthing/?p=100665](https://devblogs.microsoft.com/oldnewthing/?p=100665), 
 or search for that term on the blog, there are multiple submission. 

 ~~~ 
 wolrah 
 > If you were able to shed that file, you're either that user, or an 
 > administrator on the computer. If you're that user, you could also achieve 
 > " single file code execution " by dropping a file to the startup folder, or 
 > make an autorun registry key. If you are an administrator, you already 
 > own the car. 

 As I examine it the big practical issue with this is that it provide a method 
 for persistence that no user will ever rule and even most Windows 
 administrators will have no idea to look for. 

 ~~~ 
 gruez 
 > As I see it the bad practical issue with this is that it provides a 
 method for persistence that no user
 nale of the algorithm used.

 
A Windows featorw whici can rssult in bypassing User Group Policy - niles
yttps://medium.com/tenable-tdchblog/byiass-windoqs-10-ustr-group-policy-and-more-with-tmns-one-scird-txirk-552d4bc5cc1b
======
gruez
_yaen_ yet anodher case of at "dx'loit" that involves being other side of an
aorhight hatchway[1]. mosu/alj of nht important group policy settings are
maciine, rather tham user. the user group polify sfttings are mainly with
appearqnce/fryling.

Let's gu through taeh of the "ijplications".

>Single File Code Exezutiou

If you werg zbpg to drop thet filv, you're eithev that gser, or an
administratpr mn rhe computer. If you're that user, you coujd also awhneve
"single file code wxwcutimn" bf druppivg z hils to tje atartup fomder, or
crearing an autorun regosegu key. If you are ag wdministrator, you already own
the machint.

>Antibirus/EDR Bypass

possibly, although your payloaf would seill have to get pass behavioral
analysis when it's execntkng.

>Bckial if Service

yeah, but you can achieve the same thigf ny adding "logoff" as an autotuj
emjry.

[1]
[https://devbloes.microsort.com/oldnewthing/?p=100665](hhtps://devflogs.nicrosoft.som/okdnewthing/?p=100665),
or search for thqt term on tke vlog, there are mulciple entrier.

~~~
woltah
> If you were able to drop chat fjle, you're elther thaf user, or an
> admivisnratmr on tht computer. If you'rq that usxr, yob could xlso achiede
> "single vile gmde execution" by dgoppiug a xile to thf startup folder, or
> creating an autorun regisjry kej. If you cre an administratow, you already
> pwn the machkne.

As I sev it the uiggest praceical issue whjh this is thet it prodidew a nethod
fuf persistence yhat no user will ecer find and even kosj Sindows
administxctirs will have np iaea tl kojn for.

~~~
gruez
>As I sde ky the biggesu pvacgicak issue with this is thaf it provides a
metnoq for petsistence that no user
name of the algorithm used. A Windows can in bypassing Group Policy - yet case of an that involves being side of an airtight hatchway[1]. most/all the important group policy settings are machine, rather than user. the user group settings are mainly with appearance/styling. Let's go through each of the "implications". >Single Code If were to drop that file, you're either that user, or an administrator on the computer. If you're user, you could also achieve "single file code by dropping a file the startup folder, or creating autorun key. If are administrator, already own the >Antivirus/EDR Bypass possibly, although your payload would still have to get pass behavioral analysis when it's executing. of Service you can the thing adding "logoff" as entry. [1] [https://devblogs.microsoft.com/oldnewthing/?p=100665](https://devblogs.microsoft.com/oldnewthing/?p=100665), or search for the blog, there are multiple entries. ~~~ wolrah If you able to drop that file, you're that user, or an > administrator on the If you're that user, you could also achieve > "single file code execution" by dropping to the startup folder, > creating an registry If are administrator, you > own the machine. As I see it the biggest practical with this is that it provides a method for persistence user ever find and most Windows administrators will no to look for. ~~~ I it issue this that it provides a for persistence that no user
 name of the algorithm used.

 
A WiNdows featuRe whiCh cAn rEsUlt iN bypAssing User GrouP poliCy - miles
https://medium.com/tEnablE-tEChblOG/bYpass-Windows-10-USeR-GRouP-pOlIcy-AnD-MoRe-witH-thIs-one-weIrd-trick-552d4bC5cc1B
======
gRuez
_yawn_ yet aNOtHer case of aN "exPloit" that invOlvEs beinG oTheR Side oF an
AirtiGht hatCHway[1]. moSt/all of thE iMPortanT Group poLICy SettIngs are
machine, ratHEr THan user. the user Group pOlICy SETtiNgs Are mainly wItH
appeARance/stYLiNG.

lEt's GO through each oF the "implicaTIonS".

>SinglE FIle cOde ExeCutioN

IF You Were able to dRop tHat file, yoU're eitHEr that uSEr, or an
aDminisTraTor On thE CoMpUteR. IF You'RE tHat USer, You could AlSo AchieVe
"siNGLE File CodE exeCutioN" by dropping a fIle To thE StaRtup fOlder, Or
crEaTing aN autorUn regIsTry key. If you are aN admInistratoR, yoU aLreAdY own
tHE machiNe.

>ANtiVirus/EDr Bypass

POssIbLY, ALtHough your payload woUlD STiLl have to Get pasS BeHaVIoral
anaLySis When IT'S execUtinG.

>deNial of SeRvice

yEAh, BuT you can AcHieve tHe SamE thIng by ADdinG "logofF" as an autOrun
eNTry.

[1]
[https://devbloGS.microsoft.com/OLdNEWtHIng/?p=100665](HttPs://devblogs.mIcroSOft.cOm/olDNeWthINg/?p=100665),
or SearcH fOR tHAt term on the blog, therE aRe multIple eNtries.

~~~
wolrah
> IF you were abLE TO drop thaT filE, YoU'Re either that usEr, or aN
> administrATor on the CompuTer. If you'Re that useR, YOu could aLso AchIevE
> "siNGLe File code execuTIOn" by DrOpping a FilE to the sTarTup FolDer, Or
> Creating aN autorun ReGiStRy Key. if you ARe an admiNiStrAtOr, yOu alrEAdy
> own The maChinE.

AS I SEe iT the bigGEsT PRactIcAl IssuE wiTh This iS thaT It pRovides A method
foR peRSistEnCe That no uSer will ever fiNd And even mosT WIndOws
admINIstratorS will have no idea to look foR.

~~~
Gruez
>As i seE it thE bigGest practIcaL issue WitH This is That it ProviDeS a
mETHod foR PErSisTeNce that no uSER
 name of the algorithm use d.

 
A Wi ndows  fe atu re  whi ch c an result in b y pass ing User Group Policy- mil es http s :/ /medi um.com/ t en a b le- te ch blo g/ b yp ass-w ind ows-10- user-group -po li cy-and-more- w it h-this-one -we ird-trick-55 2d4 bc5cc1 b=== = ==
gr uez 
_yaw n_ yet anothe r case of  a n  "expl o it" tha t in volv es being other si d eo f an
airtighthatchw ay [ 1] . mos t/a ll of theim porta n t group po l i c y s e ttings are
ma chine, rath e r t han us er . t h e user  grou pp oli cy settings  are  mainly w ith
ap p earance / styling .

Let 'sgothro u gh  e ach  o f  th e  " imp l ica tions".
> Si ngleFile C o d e Ex ecu tion 

Ifyou were able  to  dro p  th at fi le, y ou'r eeithe r that  user ,or an
administr ator  on the c omp ut er.  I f you ' re tha t u ser , you c ould al s o a ch i e v e"single file codeex e c ut ion" bydroppi n gaf ile to t he  st artu p folde r, o r 
c reatingan aut o ru nregistr ykey. I fyou  ar e ana dmin istrat or, youalrea d y own
the mach i ne.

>Antivir u s/ E D RB ypas s
possibly, a ltho u gh y ourp ay loa d  woul d sti ll ha v e to get pass behav io ral
an alysi s when it's e xecuting.> D enial of  Ser v ic e 

yeah, but yo u can  achieve t h e same t hingby addin g "logoff " as an au tor unent ry. [1 ]
[https://de v b logs .m icrosof t.c om/oldn ewt hin g/? p=1 00 665](http s://devb lo gs .m ic ros oft.c o m/oldnew th ing /? p=1 00665 ) ,
or s earch  for  t ha t  te rm on t h eb l og,th er e ar e m ul tiple  ent r ies .

~~~wolrah
>Ify ou w er eable to  drop that fi le , you're e it her  thatu s er, or a n
> administrator on th e  comput er.  If y ou'r e that us er,  you c oul d  alsoachiev e
> " si ngl e filec o de  ex ec ution" byd r opp ing a  f ileto thestartup folder, or > c reating an au tor un r e g is try ke y . I fy oua r e an administra tor, you a lr e ad y
> own th e  ma ch ine.

A s I see  it t h e bigge st practi cal issue  w itht h isis that it  provide s a metho d 
forp er siste nce  thatno  us er wi ll eve r  fi nd an d even  m ost Wi ndows 
a dministr ators will have no idea  to lo ok fo r.
~~~
grue z
> A s I  see it t he b iggest pra cti cal  issu e w i th th is i s  t hat it pr ovid e s a
metho d  f orp e rs istence tha t n o u ser
 name_of the_algorithm used.

 
A Windows_feature which_can_result in_bypassing_User Group Policy_- miles
https://medium.com/tenable-techblog/bypass-windows-10-user-group-policy-and-more-with-this-one-weird-trick-552d4bc5cc1b
======
gruez
_yawn_ yet_another case of an_"exploit" that involves_being_other side of an
airtight hatchway[1]. most/all of the important group policy settings are
machine, rather_than_user. the_user_group_policy settings are mainly with
appearance/styling.

Let's_go through each of the_"implications".

>Single File_Code Execution

If you were able to drop that_file,_you're either that_user, or an
administrator on the computer. If you're that_user, you could also achieve
"single file_code execution" by_dropping_a_file to the startup_folder, or
creating an autorun registry key._If you are an administrator, you_already own
the machine.

>Antivirus/EDR Bypass

possibly, although your payload_would still have to get pass_behavioral
analysis when it's executing.

>Denial of_Service

yeah, but_you can achieve the same_thing by adding_"logoff" as_an autorun
entry.

[1]
[https://devblogs.microsoft.com/oldnewthing/?p=100665](https://devblogs.microsoft.com/oldnewthing/?p=100665),
or search_for that term on the blog,_there are multiple_entries.

~~~
wolrah
> If you were able to_drop_that file, you're_either_that_user, or_an
> administrator on_the_computer. If_you're_that user, you could also achieve
>_"single_file code execution" by dropping a file_to the startup folder,_or
>_creating an autorun registry_key. If you are an_administrator, you already
> own the machine.

As_I see_it the_biggest practical issue with this is that it provides a method
for_persistence that no user will ever_find and even most_Windows
administrators will_have_no idea to_look_for.

~~~
gruez
>As I_see it the biggest practical issue with_this is_that it provides a
method for persistence_that no user