ClickOnce and You're in - When Appref-ms Abuse is Operating as Intended
summary
Research shows ClickOnce’s AppRef-MS file reliably delivers and executes payloads: saved as UTF‑16 LE with app name, token, culture and arch, it runs from email (Gmail), inside Word OLEs, or via startup push and bypasses AV/SmartScreen tests in lab. Once a user approves the first ClickOnce deployment run, forced updates execute without further consent, enabling a benign-to-malicious update lifeline for C2. Installation creates an uninstall registry key and Start Menu shortcut but those can be removed by the deployed app; tests confirm the method works.
AI-written summary · about
chapters (9)
- 0:00Intro
- 0:46Speaker Introduction
- 1:22The End of the Golden Age
- 4:26A New Light Arises
- 6:05A ClickOnce Summary
- 10:38Application Deployment
- 15:30Lateral Movement Rundown
- 20:18C2 Management - Demo
- 23:553 Takeaways
related talks
40mAll You Need Is One - A ClickOnce Love Story
28mA New Era of One-Click Attacks: How to Break Install-Less Apps
23mUnlock agentic workflows for your apps
48m"Sneaking Past Device Guard"
50mReflected File Download - A New Web Attack Vector
51mSneaking Past Device Guard
39mWindows Agentless C2: (Ab)using the MDM Client Stack
44mWhen you can't afford 0days: Client-side exploitation for the masses