组策略Software Restriction Policies (SRP)提权

1. rename gpdisable.dll to deskpan.dll;
2. create a new folder and name it as files.{42071714-76d4-11d1-8b24-00a0c9068ff3};
3. place deskpan.dll to the new folder;
4. open the folder;
5. create a new rich text document in the folder;
6. double-click the rich-text document.
7. Wordpad runs with gpdisable.dll
8. Bypassed :) We can run any process.

gpdisable下载

via