Green-m

function Subvert-CLRAntiMalware {
<#
.SYNOPSIS

A proof-of-concept demonstrating overwriting a global variable that stores a pointer to an antimalware scan interface context structure. This PoC was only built to work with .NET Framework Early Access build 3694.

.DESCRIPTION

clr.dll in .NET Framework Early Access build 3694 has a global variable that stores a pointer to an antimalware scan interface context structure. By reading the pointer at that offset and then overwriting the forst DWORD, the context structure will become corrupted and subsequent scanning calls will fail open.

Green-m

##
# Block Baidu
##
127.0.0.1       baidu.com
127.0.0.1       www.baidu.com
127.0.0.1       pan.baidu.com
127.0.0.1       post-js.baidu.com
127.0.0.1       bbs.baidu.com
127.0.0.1       tieba.baidu.com
127.0.0.1       wapp.baidu.com

Green-m

wordlist created from original 41G stash via:

grep -rohP '(?<=:).*$' | uniq > breachcompilation.txt

Then, compressed with:

7z a breachcompilation.txt.7z breachcompilation.txt

Size: