From b3f08affc21e918860175812e745f367f76de749 Mon Sep 17 00:00:00 2001
From: carlmon <450101+carlmon@users.noreply.github.com>
Date: Sat, 14 Jun 2025 16:11:14 +1200
Subject: [PATCH 1/2] AlwaysInstallElevated payload
---
AlwaysInstallElevated MSI/Folders.wxs | 7 ++++
.../InstallComponents.wxs | 9 +++++
AlwaysInstallElevated MSI/InstallMe.sln | 37 +++++++++++++++++++
AlwaysInstallElevated MSI/InstallMe.wixproj | 2 +
AlwaysInstallElevated MSI/Package.en-us.wxl | 8 ++++
AlwaysInstallElevated MSI/Package.wxs | 20 ++++++++++
AlwaysInstallElevated MSI/README.md | 6 +++
7 files changed, 89 insertions(+)
create mode 100644 AlwaysInstallElevated MSI/Folders.wxs
create mode 100644 AlwaysInstallElevated MSI/InstallComponents.wxs
create mode 100644 AlwaysInstallElevated MSI/InstallMe.sln
create mode 100644 AlwaysInstallElevated MSI/InstallMe.wixproj
create mode 100644 AlwaysInstallElevated MSI/Package.en-us.wxl
create mode 100644 AlwaysInstallElevated MSI/Package.wxs
create mode 100644 AlwaysInstallElevated MSI/README.md
diff --git a/AlwaysInstallElevated MSI/Folders.wxs b/AlwaysInstallElevated MSI/Folders.wxs
new file mode 100644
index 0000000..eaa4246
--- /dev/null
+++ b/AlwaysInstallElevated MSI/Folders.wxs
@@ -0,0 +1,7 @@
+
+
+
+
+
+
+
diff --git a/AlwaysInstallElevated MSI/InstallComponents.wxs b/AlwaysInstallElevated MSI/InstallComponents.wxs
new file mode 100644
index 0000000..0dcea4d
--- /dev/null
+++ b/AlwaysInstallElevated MSI/InstallComponents.wxs
@@ -0,0 +1,9 @@
+
+
+
+
+
+
+
+
+
diff --git a/AlwaysInstallElevated MSI/InstallMe.sln b/AlwaysInstallElevated MSI/InstallMe.sln
new file mode 100644
index 0000000..4a734ea
--- /dev/null
+++ b/AlwaysInstallElevated MSI/InstallMe.sln
@@ -0,0 +1,37 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.5.33627.172
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{B7DD6F7E-DEF8-4E67-B5B7-07EF123DB6F0}") = "InstallMe", "InstallMe.wixproj", "{09166350-27A5-42A5-B178-8CDFA6547323}"
+EndProject
+Global
+ GlobalSection(SolutionConfigurationPlatforms) = preSolution
+ Debug|ARM64 = Debug|ARM64
+ Debug|x64 = Debug|x64
+ Debug|x86 = Debug|x86
+ Release|ARM64 = Release|ARM64
+ Release|x64 = Release|x64
+ Release|x86 = Release|x86
+ EndGlobalSection
+ GlobalSection(ProjectConfigurationPlatforms) = postSolution
+ {09166350-27A5-42A5-B178-8CDFA6547323}.Debug|ARM64.ActiveCfg = Debug|ARM64
+ {09166350-27A5-42A5-B178-8CDFA6547323}.Debug|ARM64.Build.0 = Debug|ARM64
+ {09166350-27A5-42A5-B178-8CDFA6547323}.Debug|x64.ActiveCfg = Debug|x64
+ {09166350-27A5-42A5-B178-8CDFA6547323}.Debug|x64.Build.0 = Debug|x64
+ {09166350-27A5-42A5-B178-8CDFA6547323}.Debug|x86.ActiveCfg = Debug|x86
+ {09166350-27A5-42A5-B178-8CDFA6547323}.Debug|x86.Build.0 = Debug|x86
+ {09166350-27A5-42A5-B178-8CDFA6547323}.Release|ARM64.ActiveCfg = Release|ARM64
+ {09166350-27A5-42A5-B178-8CDFA6547323}.Release|ARM64.Build.0 = Release|ARM64
+ {09166350-27A5-42A5-B178-8CDFA6547323}.Release|x64.ActiveCfg = Release|x64
+ {09166350-27A5-42A5-B178-8CDFA6547323}.Release|x64.Build.0 = Release|x64
+ {09166350-27A5-42A5-B178-8CDFA6547323}.Release|x86.ActiveCfg = Release|x86
+ {09166350-27A5-42A5-B178-8CDFA6547323}.Release|x86.Build.0 = Release|x86
+ EndGlobalSection
+ GlobalSection(SolutionProperties) = preSolution
+ HideSolutionNode = FALSE
+ EndGlobalSection
+ GlobalSection(ExtensibilityGlobals) = postSolution
+ SolutionGuid = {3096FD1B-7BF5-4A24-8861-1B024DE1E3C2}
+ EndGlobalSection
+EndGlobal
diff --git a/AlwaysInstallElevated MSI/InstallMe.wixproj b/AlwaysInstallElevated MSI/InstallMe.wixproj
new file mode 100644
index 0000000..593a622
--- /dev/null
+++ b/AlwaysInstallElevated MSI/InstallMe.wixproj
@@ -0,0 +1,2 @@
+
+
diff --git a/AlwaysInstallElevated MSI/Package.en-us.wxl b/AlwaysInstallElevated MSI/Package.en-us.wxl
new file mode 100644
index 0000000..45fbc96
--- /dev/null
+++ b/AlwaysInstallElevated MSI/Package.en-us.wxl
@@ -0,0 +1,8 @@
+
+
+
+
+
+
diff --git a/AlwaysInstallElevated MSI/Package.wxs b/AlwaysInstallElevated MSI/Package.wxs
new file mode 100644
index 0000000..c7dd0b2
--- /dev/null
+++ b/AlwaysInstallElevated MSI/Package.wxs
@@ -0,0 +1,20 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/AlwaysInstallElevated MSI/README.md b/AlwaysInstallElevated MSI/README.md
new file mode 100644
index 0000000..b62b7b0
--- /dev/null
+++ b/AlwaysInstallElevated MSI/README.md
@@ -0,0 +1,6 @@
+Create an Installer MSI package that executes an arbitrary command to exploit an `AlwaysInstallElevated` policy.
+
+Instructions:
+* May require [HeatWave](https://www.firegiant.com/docs/heatwave/) to build in Visual Studio.
+* Change the "RunMe" custom action of Package.wxs with your custom command.
+* The installer intentionally fails after executing the command. This allows it to be used again without needing an uninstall/upgrade.
\ No newline at end of file
From 45f914232a483a49dfc258c86912b72228415830 Mon Sep 17 00:00:00 2001
From: Cas van Cooten
Date: Sun, 27 Jul 2025 13:54:11 +0200
Subject: [PATCH 2/2] Update README.md
---
README.md | 1 +
1 file changed, 1 insertion(+)
diff --git a/README.md b/README.md
index 430bf00..1d4d950 100644
--- a/README.md
+++ b/README.md
@@ -12,6 +12,7 @@ $assem = [System.Reflection.Assembly]::Load($data)
### Contents
|Snippet Name|Description|
|--|--|
+| AlwaysInstallElevated MSI | Boilerplate VS solution for an MSI that runs an arbitrary command and then fails intentionally, for use with the `AlwaysInstallElevated` setting. Thanks [@carlmon](https://github.com/carlmon) for contributing! |
| AppLocker Bypass PowerShell Runspace (C#) | Base binary for an applocker bypass using a combination of `CertUtil`, `BitsAdmin`, and `InstallUtil`. See `README.md` for details.|
| Fileless Lateral Movement (C#) | Wipes Windows Defender signatures on the remote host and uses a PSExec-like method (except using an existing process) to achieve lateral movement. Takes arguments for the target, the target service, and the target binary to run. Note that a non-critical service should be chosen, such as `SensorService`. |
|Linux Shellcode Encoder (Python) | Utility scripts to encode C# payloads from Linux, either ingesting a raw shellcode payload (.bin), or automatically feeding from 'msfvenom'. Supports XOR and ROT encoding with an arbitrary key, and prints the decoding function. Can be used to replace the C# ROT/XOR encoder scripts.|