SmartScreen Bypass = strange?

7. July 2019

During my last assessment, I noticed some strange behavior with Microsoft’s SmartScreen feature.
Basically, this security feature should block the execution of untrusted files from the Internet(more information).

In fact, the execution of untrusted applications is blocked when trying to open them via the GUI(file explorer).

However, the execution is not blocked when opening the application via a command line tool like cmd or powershell xD

I have already tweeted about this behavior and  Matt had a logical response for this behavior.

Still, I find this behavior funny and think that most admins don’t know this. That’s why I decided to write this short post.

Similar posts

While doing my preperation for the OSCE i found an exploit for the coolpalyer+ version 2.19.1 from 2009. I decided to [...]

19. February 2018

  Vulnerable software FTP server 8.0f(g) Vulnerability Local Buffer Overflow (SEH protected)-> Code Execution Time Line 01/24/2018 Vendor informed 01/30/2018 [...]

20. February 2018

CVE CVE-2018-16231 Vulnerable software FTP server <= 8.4f Vulnerability Remote denial of service Timeline 30.01.2018 Seller informed(also local BO ) [...]

25. August 2018

CVE CVE-2018-7272 Vulnerable software AT 5.0.0, 5.1.0 Vulnerability Unauthorized access Timeline 15.12.2017 Seller informs X.01.2018  Manufacturer has patched vulnerability 24.01.2018 Manufacturer [...]

25. August 2018