Need help with Digital-Signature-Hijack?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

netbiosX
145 Stars 56 Forks 48 Commits 0 Opened issues

Description

Binaries, PowerShell scripts and information about Digital Signature Hijacking.

Services available

!
?

Need anything else?

Contributors list

# 373,139
48 commits

Digital Signature Hijack

Hijacking legitimate digital signatures is a technique that can be used during red team assessments in order to sign PowerShell code and binaries. This could assist to bypass Device Guard restrictions and maintain stealthy in an engagement. DigitalSignatureHijack is a PowerShell script based on Matt Graeber research that can perform the following operations:

  • Digitally sign all portable executables on the host as Microsoft
  • Digitally sign all powershell scripts on the host as Microsoft
  • Validate the digital signature for all portable executables
  • Validate the digital signature for all powershell scripts

This is achieved by hijacking the registry and adding the necessary values and by utilizing the custom SIP dll file that Matt Graeber developed. Users need to modify the path of MySIP.dll to their local path.

  • MySIP.dll - https://github.com/mattifestation/PoCSubjectInterfacePackage

Demo

Signing Portable Executables

SignExe

Signature Validation

ValidateSignaturePE

Signing PowerShell Scripts

SignPS

Signature Validation

ValidateSignaturePS

Resources

Disclaimer

  • The purpose of this repository is to store compiled DLL's, binaries, scripts and to centralize existing information about digital signature hijacking. All the credits are going to the original authors of these tools.
  • The binaries and the DLL which are stored in this repository have not been modified from their original state and they are totally safe. However if for any reason you don't trust this repository the original repositories which contain the source code of these tools are provided in order to compile them by yourself.

Credits

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.