https://remkoweijnen.nl/blog/tags/appsense/Recent content in AppSense on Remko's BlogHugoen-usSun, 12 Feb 2012 23:36:34 +0000https://remkoweijnen.nl/blog/2012/02/12/the-xlsploit-explained/Sun, 12 Feb 2012 23:36:34 +0000https://remkoweijnen.nl/blog/2012/02/12/the-xlsploit-explained/<p>Recently I published a <a href="https://remkoweijnen.nl/blog/2012/01/27/bypassing-res-application-security/" target="_blank">Proof of Concept</a> that showed it was possible to launch unauthorized processes with both AppSense Application Manager and RES Workspace Manager.</p> <p>Although I didn&rsquo;t test Microsoft Applocker I have no doubt at all that we couldn&rsquo;t bypass it.</p> <p><a href="https://remkoweijnen.nl/blog/wp-content/uploads/2012/02/image1.webp" class="glightbox" data-type="image" data-gallery="post-2392"><img loading="lazy" decoding="async" style="display: inline; float: right;" title="image" src="https://remkoweijnen.nl/blog/wp-content/uploads/2012/02/image_thumb1.webp" alt="image" width="100" height="97" align="right" /></a>I have named my Proof of Concept the <strong>XLSploit</strong> because I am using Excel as a trampoline. I choose Excel because this is generally a trusted process and VBA offers access to the Windows API that is needed.</p> <p>After publishing the XLSploit I have talked to both <a href="http://www.ressoftware.com/" target="_blank">RES</a> and <a href="http://www.appsense.com/" target="_blank">AppSense</a> and not that they both have a response to my Proof of Concept, I consider it safe to tell a little more about how it works.</p> <p>If you are merely interested in stopping the XLSploit, please scroll down to the end of the article.</p>