feat: add sipexec exec method - #1363
Open
KriyosArcane wants to merge 1 commit into
Open
Conversation
WinVerifyTrust FinalPolicy hijack for lateral movement. Zero threading, single DCOM (dual namespace via one login). Polymorphic DLL, non-blocking FinalPolicy, admin impersonation. ~3.3s local, ruff clean, clean DLL deletion after kill.
KriyosArcane
requested review from
Marshall-Hallenbeck,
NeffIsBack,
mpgn and
zblurx
as code owners
August 15, 2026 06:10
|
It looks like the PR template may not have been filled out. The following sections appear to be missing:
Please edit your PR description to include them. The template helps reviewers understand and test your changes. Thanks! |
Contributor
|
Interesting, "SetStringValue" will not trigger EDR? @KriyosArcane Would U like to share the paper for this research? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR and exec method originate from my research presented at DEFCON Red Team Village: Trust Me, Bro: Breaking Windows Authenticode Trust. I initially added this method for my own use, but I am opening a PR in case you guys see it fit for everyone.
This slightly older version might help explain the chain better:
Description
This adds
sipexecas a new--exec-methodfor the SMB protocol. SIPExec performs lateral movement by hijacking the WinVerifyTrust FinalPolicy trust provider registry key, causingwmiprvse.exeto load a payload DLL when WMI triggers signature verification.How it works:
C:\Windows\Tempvia the existing SMB connection. I have a working version that is fully fileless over self-hosted SMB, but I think this is better for most. If you guys decide fully fileless (no more poly dll) is also good to add, I can PR that too.HKLM\...\FinalPolicy\{GENERIC_VERIFY_V2}\$DLLvia WMI StdRegProvWin32_PnPSignedDriverWMI query, which triggersWinVerifyTrustin wmiprvse.exe, loading our DLL. It is not the only way to trigger it remotely, but it is my preferred way currently. If signatured, I could switch it out to a different process and trigger method.network serviceuser, which already has permissions toSeImpersonate. Again, pipe is only a preference. It could execute any DLL, meaning you can do anything you like in that DLL.It initially ran multithreaded to overlap independent steps, but based on feedback that multithreading may exhaust resources when running against many hosts, I redesigned it to be fully sequential.
One thing that may make you question it is probably the DLL patching. As static files gets signatured almost instantly in a repo this popular, the DLL being used here (initially meant to be customized) is patched at runtime by a secondary Python script to leave minimal static sections in an attempt to increase its lifetime.
If you have used AI in any form, please state the tool you used (e.g. Claude Code, Cursor, Amp) along with the extent that the work was AI-assisted. See the project's AI policy for more details: https://github.com/Pennyw0rth/NetExec/blob/main/AI_POLICY.md
I have used Claude Opus 4.6 for coding. I did a manual review of the code. I have done tests against multiple hosts.
Type of change
Screenshots
As of right now, it's fully undetected by Elastic EDR.
Checklist:
poetry run ruff check ., use--fixto automatically fix what it can)tests/e2e_commands.txtfile if necessary (new modules or features are required to be added to the e2e tests)