Hey. All the instructions for this process are documented in my blog post: posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
@@valleyview5417 It's probably catalog-signed. Run Get-AuthenticodeSignature on it in PowerShell and this post will offer some more info on catalog signing: www.exploit-monday.com/2017/08/application-of-authenticode-signatures.html
Where can we download MSKernel32Root.cer ?
Hey. All the instructions for this process are documented in my blog post: posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
@@mattifestation Thank's nice blog, here in my W7 kernel32.DLL is not digitally signed
@@valleyview5417 It's probably catalog-signed. Run Get-AuthenticodeSignature on it in PowerShell and this post will offer some more info on catalog signing: www.exploit-monday.com/2017/08/application-of-authenticode-signatures.html
@@mattifestation Thank's for help