All You Need Is One - A ClickOnce Love Story
summary
Shows a concrete exploit chain: ClickOnce delivers a per-user malicious .application that launches a bundled .exe or in-memory PowerShell payload; payloads are generated with Veil or Metasploit and served from Apache on Kali. Signing restrictions force use of self-signed certificates or unsigned flows, SmartScreen blocks unsigned apps but still many users click through; observed ~30% link click rate and ~40% run rate. Demo notes dynamic payload generation works but resigning is fragile and signing is the reliable bypass.
AI-written summary · about
chapters (32)
- 0:00Intro
- 0:55Who is Ryan
- 1:10Agenda
- 4:05Certificate Signing
- 5:00Trust Architecture
- 5:44Microsoft Quote
- 7:25Why Did I Use ClickOnce
- 10:37Powershell
- 11:41Veil Evasion
- 13:14Bail
- 13:46Foot Bones
- 14:05Server Setup
- 15:06Command and Control
- 17:50Cleanup
- 18:56Demo
- 19:16Visual Studio
- 19:36Code
- 20:19Target Framework
- 21:21Full Trust Application
- 22:02Application Files
- 22:58Publishing Files
- 23:23Hero
- 24:06Login Page
- 24:48Invalid Password
- 25:18Security Prompt
- 25:38Unknown Publisher
- 27:26Run App
- 28:06Preventive Measures
- 32:12Registry Settings
- 33:09Smart Screen
- 34:33Smart Screen Flow Chart
- 35:23Why Use Science Executable
related talks
25mClickOnce and You're in - When Appref-ms Abuse is Operating as Intended
28mA New Era of One-Click Attacks: How to Break Install-Less Apps
44mWhen you can't afford 0days: Client-side exploitation for the masses
33m(More than) One Vulnerability in a Thousand Makes It
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
40mBeyond Living-Off-the-Land: Why XP Exploits Still Matter
50mReflected File Download - A New Web Attack Vector
44mAnatomy and Defense of LOTL Fileless Intrusions