Full Disclosure mailing list archives

Hi @ll,

since 30 years Microsoft ships Windows with "Windows Script Host",
an empty registry key and the following registry entries:

[HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings]
"ActiveDebugging"="1"
"DisplayLogo"="1"
"SilentTerminate"="0"
"UseWINSAFER"="1"

The last registry entry (which is not writeable by unprivileged users)
enables SAFER, i.e. both Software Restriction Policies and AppLocker,
for the various script engines (JScript, VBScript, PerlScript, ...)
run inside of Windows Script Host.

Windows Script Host supports the following additional registry entries:

"Enabled"=...
"LogSecurityFailures"=...
"LogSecuritySuccesses"=...
"TimeOut"=...
"IgnoreUserSettings"=...

Except for the last one, which is evaluated only in the
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings]
registry key, (unprivileged) users can but overrule the (read-only)
settings shown above by adding the same registry entries to their
[HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings]
registry key, i.e. UNLESS disabled via

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings]
"IgnoreUserSettings"="1"

they can enable a disabled Windows Script Host or disable SAFER for
it via the following registry entries:

[HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings]
"Enabled"="1"
"UseWINSAFER"="0"

stay tuned
Stefan Kanthak

PS: these registry entries can be either REG_SZ or REG_DWORD
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• Defense in depth -- the Microsoft way (part 94): SAFER (SRPv1 and AppLocker alias SRPv2) bypass for dummies Stefan Kanthak via Fulldisclosure (Dec 22)