[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWwecUeMBe_2fO9p7-kmBqOvWRRYSs3_SsvyGqyqItII":3},{"id":4,"question":5,"answer":6,"answerHtml":7,"slug":8,"keywords":9,"article":10,"status":34,"aiModel":39,"aiConfidence":39,"updatedAt":51,"createdAt":51,"_status":50},222,"How effective is the LUA script bypass against different AppLocker configurations?","In testing on Windows 7 x86 with default AppLocker rules, the bypass succeeded. However, if an explicit block rule is added for lua.exe (or wlua.exe), the bypass fails. Also, if Lua for Windows is not installed, placing lua5.1.dll and lua.exe in the same directory does not work because AppLocker still blocks the executable. This shows the bypass is narrow and depends on careful rule configuration.","\u003Cp>In testing on Windows 7 x86 with default AppLocker rules, the bypass succeeded. However, if an explicit block rule is added for lua.exe (or wlua.exe), the bypass fails. Also, if Lua for Windows is not installed, placing lua5.1.dll and lua.exe in the same directory does not work because AppLocker still blocks the executable. This shows the bypass is narrow and depends on careful rule configuration.\u003C\u002Fp>\u003Cp>\u003Ca href=\"\u002Fnews\u002Ftesting-and-analysis-of-bypassing-applocker-using-lua-scripts\">Read the related One Day Sec article\u003C\u002Fa>\u003C\u002Fp>","how-effective-is-the-lua-script-bypass-against-different-applocker-configuration-1777484663096","AppLocker bypass effectiveness, default rules, block rule, testing",{"id":11,"title":12,"slug":13,"description":14,"content":15,"contentHtml":30,"cover":31,"author":32,"views":19,"readingTime":33,"status":34,"publishedAt":35,"seo":36,"tags":41,"qaPairs":42,"meta":47,"updatedAt":48,"createdAt":49,"_status":50},57,"Testing and Analysis of Bypassing AppLocker Using LUA Scripts","testing-and-analysis-of-bypassing-applocker-using-lua-scripts","Learn how LUA scripts can bypass AppLocker, including testing methods, bypass principles, and defense strategies for Windows systems.",{"root":16},{"type":17,"format":18,"indent":19,"version":20,"children":21,"direction":29},"root","",0,1,[22],{"type":23,"format":18,"indent":19,"version":20,"children":24,"direction":29},"paragraph",[25],{"mode":26,"text":27,"type":28,"style":18,"detail":19,"format":19,"version":20},"normal","\u003Chtml>\u003Chead>\u003C\u002Fhead>\u003Cbody>\u003Ch2>0x00 Preface\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>In a previous article titled 'Bypass Windows AppLocker', methods for bypassing AppLocker were studied. Recently, an article introduced a method using LUA scripts to bypass AppLocker. After studying it, the following questions arose: What is the bypass principle? Which AppLocker rules can be bypassed? And what are the applicable conditions?\u003C\u002Fp>\u003Cp>Article link:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fhomjxi0e.wordpress.com\u002F2018\u002F03\u002F02\u002Fwhitelisting-bypassing-using-lua-lanuage-wlua-com\u002F\u003C\u002Fp>\u003Ch2>0x01 Introduction\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article will cover the following topics:\u003C\u002Fp>\u003Cul>\u003Cli>Introduction to LUA Scripts\u003C\u002Fli>\u003Cli>Bypass Testing\u003C\u002Fli>\u003Cli>Bypass Principle\u003C\u002Fli>\u003Cli>Applicable Conditions\u003C\u002Fli>\u003Cli>Defense Methods\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x02 Introduction to LUA Scripts\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cul>\u003Cli>Lightweight and compact scripting language\u003C\u002Fli>\u003Cli>Written in standard C language\u003C\u002Fli>\u003Cli>Can be called by C\u002FC++ code\u003C\u002Fli>\u003Cli>Can call C\u002FC++ functions\u003C\u002Fli>\u003Cli>Fastest among all current scripting engines\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x03 Executing LUA scripts on Windows system\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>1. Install Lua for Windows, download address:\u003C\u002Fp>\u003Cp>http:\u002F\u002Ffiles.luaforge.net\u002Freleases\u002Fluaforwindows\u002Fluaforwindows\u003C\u002Fp>\u003Cp>2. Output hello world\u003C\u002Fp>\u003Cp>Script content:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>print\"Hello,world!\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>cmd:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>lua.exe 1.txt\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770018735191_0_0961c2c294.jpeg\">\u003C\u002Fp>\u003Cp>3. Calling Windows API\u003C\u002Fp>\u003Cp>Script content:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>require \"alien\"\u003Cbr>MessageBox = alien.User32.MessageBoxA\u003Cbr>MessageBox:types{ret ='long',abi ='stdcall','long','string','string','long'}\u003Cbr>MessageBox(0, \"title for test\",\"LUA call windows api\",0)\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Execution as shown below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770018745593_1_741453cc13.jpeg\">\u003C\u002Fp>\u003Cp>4. C++ executing LUA script\u003C\u002Fp>\u003Cp>Reference code is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>extern \"C\" {\u003Cbr>#include \"lua.h\"\u003Cbr>#include \u003Clauxlib.h>\u003Cbr>#include \u003Clualib.h>     \u003Cbr>} \u003Cbr>int main(int argc,char* argv[])\u003Cbr>{\u003Cbr>\tlua_State *L =  lua_open();\u003Cbr>    luaL_openlibs(L);\u003Cbr>    luaL_dofile(L, argv[1]);\u003Cbr>    lua_close(L);\u003Cbr>    return 0;\u003Cbr>}\u003C\u002Flualib.h>\u003C\u002Flauxlib.h>\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>The project requires the following settings: \u003C\u002Fp>\u003Cp>(1) Modify VC++ Directories\u003C\u002Fp>\u003Cp>Include directories, add C:\\Program Files\\Lua\\5.1\\include\u003C\u002Fp>\u003Cp>Library directories, add C:\\Program Files\\Lua\\5.1\\lib\u003C\u002Fp>\u003Cp>(2) Linker - Input - Additional Dependencies, add \u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>lua5.1.lib\u003Cbr>lua51.lib\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Execute as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770018752128_2_47521de445.jpeg\">\u003C\u002Fp>\u003Cp>Execute C++ Lua script to call Windows API, requires adding support files in the same directory, execute as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770018763188_3_d811ccf92e.jpeg\">\u003C\u002Fp>\u003Ch2>0x04 Testing Lua Script Bypass of Applocker\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>Test 1:\u003C\u002Fh3>\u003Cp>Test System: Win7x86\u003C\u002Fp>\u003Cp>Install Lua for Windows\u003C\u002Fp>\u003Cp>Enable Applocker, configure default rules\u003C\u002Fp>\u003Cp>Execute script using lua.exe:\u003C\u002Fp>\u003Cp>Successfully bypassed Applocker interception\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770018781344_4_b96c7d5cb7.jpeg\">\u003C\u002Fp>\u003Ch3>Test 2:\u003C\u002Fh3>\u003Cp>Test System: Win7x86\u003C\u002Fp>\u003Cp>Install Lua for Windows\u003C\u002Fp>\u003Cp>Enable Applocker, configure default rules, add rule: Block lua.exe\u003C\u002Fp>\u003Cp>Failed to bypass Applocker block\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770018791334_5_081a8da8d7.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>wlua.exe can also be used to execute Lua scripts\u003C\u002Fp>\u003Ch3>Test 3:\u003C\u002Fh3>\u003Cp>Test System: Win7x64\u003C\u002Fp>\u003Cp>Lua for Windows not installed\u003C\u002Fp>\u003Cp>Enable Applocker, configure default rules, system prohibits script execution\u003C\u002Fp>\u003Cp>Place lua5.1.dll (from Lua for Windows installation path) in the same directory as lua.exe\u003C\u002Fp>\u003Cp>Execute scripts using lua.exe:\u003C\u002Fp>\u003Cp>Failed to bypass AppLocker interception\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770018802414_6_2e77edcbac.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Supplement:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Replace lua.exe with wlua.exe, modify script content to POC content, address as follows:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgist.githubusercontent.com\u002Fhomjxi0e\u002Ffd023113bf8b1b6789afa05c3913157c\u002Fraw\u002F6bf41cbd76e9df6d6d3edcc9e289191f898451dc\u002FAppLockerBypassing.wlua\u003C\u002Fp>\u003Cp>Test results are identical\u003C\u002Fp>\u003Ch2>0x05 Final Conclusion\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>Based on the above tests, the final conclusion is:\u003C\u002Fp>\u003Cp>Using LUA scripts can bypass AppLocker to some extent, but the following conditions must be met:\u003C\u002Fp>\u003Cul>\u003Cli>Lua for Windows is installed on the current system\u003C\u002Fli>\u003Cli>AppLocker rules do not prohibit lua.exe and wlua.exe\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x06 Summary\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article provides a brief introduction to the development of LUA scripts, tests the POC for bypassing Applocker using LUA scripts, and draws the final conclusion\u003C\u002Fp>\u003C\u002Fbody>\u003C\u002Fhtml>","text","ltr","\u003Chtml>\u003Chead>\u003C\u002Fhead>\u003Cbody>\u003Ch2>0x00 Preface\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>In a previous article titled 'Bypass Windows AppLocker', methods for bypassing AppLocker were studied. Recently, an article introduced a method using LUA scripts to bypass AppLocker. After studying it, the following questions arose: What is the bypass principle? Which AppLocker rules can be bypassed? And what are the applicable conditions?\u003C\u002Fp>\u003Cp>Article link:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fhomjxi0e.wordpress.com\u002F2018\u002F03\u002F02\u002Fwhitelisting-bypassing-using-lua-lanuage-wlua-com\u002F\u003C\u002Fp>\u003Ch2>0x01 Introduction\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article will cover the following topics:\u003C\u002Fp>\u003Cul>\u003Cli>Introduction to LUA Scripts\u003C\u002Fli>\u003Cli>Bypass Testing\u003C\u002Fli>\u003Cli>Bypass Principle\u003C\u002Fli>\u003Cli>Applicable Conditions\u003C\u002Fli>\u003Cli>Defense Methods\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x02 Introduction to LUA Scripts\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cul>\u003Cli>Lightweight and compact scripting language\u003C\u002Fli>\u003Cli>Written in standard C language\u003C\u002Fli>\u003Cli>Can be called by C\u002FC++ code\u003C\u002Fli>\u003Cli>Can call C\u002FC++ functions\u003C\u002Fli>\u003Cli>Fastest among all current scripting engines\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x03 Executing LUA scripts on Windows system\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>1. Install Lua for Windows, download address:\u003C\u002Fp>\u003Cp>http:\u002F\u002Ffiles.luaforge.net\u002Freleases\u002Fluaforwindows\u002Fluaforwindows\u003C\u002Fp>\u003Cp>2. Output hello world\u003C\u002Fp>\u003Cp>Script content:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>print\"Hello,world!\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>cmd:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>lua.exe 1.txt\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770018735191_0_0961c2c294-1.jpeg\">\u003C\u002Fp>\u003Cp>3. Calling Windows API\u003C\u002Fp>\u003Cp>Script content:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>require \"alien\"\u003Cbr>MessageBox = alien.User32.MessageBoxA\u003Cbr>MessageBox:types{ret ='long',abi ='stdcall','long','string','string','long'}\u003Cbr>MessageBox(0, \"title for test\",\"LUA call windows api\",0)\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Execution as shown below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770018745593_1_741453cc13-1.jpeg\">\u003C\u002Fp>\u003Cp>4. C++ executing LUA script\u003C\u002Fp>\u003Cp>Reference code is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>extern \"C\" {\u003Cbr>#include \"lua.h\"\u003Cbr>#include \u003Clauxlib.h>\u003Cbr>#include \u003Clualib.h>     \u003Cbr>} \u003Cbr>int main(int argc,char* argv[])\u003Cbr>{\u003Cbr>\tlua_State *L =  lua_open();\u003Cbr>    luaL_openlibs(L);\u003Cbr>    luaL_dofile(L, argv[1]);\u003Cbr>    lua_close(L);\u003Cbr>    return 0;\u003Cbr>}\u003C\u002Flualib.h>\u003C\u002Flauxlib.h>\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>The project requires the following settings: \u003C\u002Fp>\u003Cp>(1) Modify VC++ Directories\u003C\u002Fp>\u003Cp>Include directories, add C:\\Program Files\\Lua\\5.1\\include\u003C\u002Fp>\u003Cp>Library directories, add C:\\Program Files\\Lua\\5.1\\lib\u003C\u002Fp>\u003Cp>(2) Linker - Input - Additional Dependencies, add \u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>lua5.1.lib\u003Cbr>lua51.lib\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Execute as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770018752128_2_47521de445-1.jpeg\">\u003C\u002Fp>\u003Cp>Execute C++ Lua script to call Windows API, requires adding support files in the same directory, execute as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770018763188_3_d811ccf92e-1.jpeg\">\u003C\u002Fp>\u003Ch2>0x04 Testing Lua Script Bypass of Applocker\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>Test 1:\u003C\u002Fh3>\u003Cp>Test System: Win7x86\u003C\u002Fp>\u003Cp>Install Lua for Windows\u003C\u002Fp>\u003Cp>Enable Applocker, configure default rules\u003C\u002Fp>\u003Cp>Execute script using lua.exe:\u003C\u002Fp>\u003Cp>Successfully bypassed Applocker interception\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770018781344_4_b96c7d5cb7-1.jpeg\">\u003C\u002Fp>\u003Ch3>Test 2:\u003C\u002Fh3>\u003Cp>Test System: Win7x86\u003C\u002Fp>\u003Cp>Install Lua for Windows\u003C\u002Fp>\u003Cp>Enable Applocker, configure default rules, add rule: Block lua.exe\u003C\u002Fp>\u003Cp>Failed to bypass Applocker block\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770018791334_5_081a8da8d7-1.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>wlua.exe can also be used to execute Lua scripts\u003C\u002Fp>\u003Ch3>Test 3:\u003C\u002Fh3>\u003Cp>Test System: Win7x64\u003C\u002Fp>\u003Cp>Lua for Windows not installed\u003C\u002Fp>\u003Cp>Enable Applocker, configure default rules, system prohibits script execution\u003C\u002Fp>\u003Cp>Place lua5.1.dll (from Lua for Windows installation path) in the same directory as lua.exe\u003C\u002Fp>\u003Cp>Execute scripts using lua.exe:\u003C\u002Fp>\u003Cp>Failed to bypass AppLocker interception\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770018802414_6_2e77edcbac-1.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Supplement:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Replace lua.exe with wlua.exe, modify script content to POC content, address as follows:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgist.githubusercontent.com\u002Fhomjxi0e\u002Ffd023113bf8b1b6789afa05c3913157c\u002Fraw\u002F6bf41cbd76e9df6d6d3edcc9e289191f898451dc\u002FAppLockerBypassing.wlua\u003C\u002Fp>\u003Cp>Test results are identical\u003C\u002Fp>\u003Ch2>0x05 Final Conclusion\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>Based on the above tests, the final conclusion is:\u003C\u002Fp>\u003Cp>Using LUA scripts can bypass AppLocker to some extent, but the following conditions must be met:\u003C\u002Fp>\u003Cul>\u003Cli>Lua for Windows is installed on the current system\u003C\u002Fli>\u003Cli>AppLocker rules do not prohibit lua.exe and wlua.exe\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x06 Summary\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article provides a brief introduction to the development of LUA scripts, tests the POC for bypassing Applocker using LUA scripts, and draws the final conclusion\u003C\u002Fp>\u003C\u002Fbody>\u003C\u002Fhtml>",1504,"Onedaysec",3,"published","2026-02-02T08:08:32.700Z",{"title":37,"description":14,"keywords":38,"ogImage":39,"canonicalUrl":39,"noIndex":40},"Bypass AppLocker with LUA Scripts: Testing & Analysis","AppLocker bypass, LUA scripts, Windows security, penetration testing, exploit analysis",null,false,[],{"docs":43,"hasNextPage":40},[44,4,45,46],223,221,220,{"title":39,"description":39,"image":39},"2026-07-24T15:37:14.659Z","2026-07-23T16:01:12.525Z","draft","2026-07-23T16:04:38.520Z"]