[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVRyjCNr5ZLEiWTd5EZiDfUnaT1Rw7rwa8N4hwoGqtjA":3},{"id":4,"question":5,"answer":6,"answerHtml":7,"slug":8,"keywords":9,"article":10,"status":34,"aiModel":39,"aiConfidence":39,"updatedAt":51,"createdAt":51,"_status":50},223,"What are the recommended defense methods against LUA script-based AppLocker bypass attempts?","To defend, ensure AppLocker rules explicitly block lua.exe, wlua.exe, and any untrusted Lua scripts. Regularly audit installed software like Lua for Windows. Consider application control policies that prevent execution of scripting engines from user-writable paths. For comprehensive log monitoring, techniques from [Penetration Techniques - Deletion and Bypass of Windows Logs](\u002Fnews\u002Fpenetration-techniques-deletion-and-bypass-of-windows-logs) can help detect such bypass attempts.","\u003Cp>To defend, ensure AppLocker rules explicitly block lua.exe, wlua.exe, and any untrusted Lua scripts. Regularly audit installed software like Lua for Windows. Consider application control policies that prevent execution of scripting engines from user-writable paths. For comprehensive log monitoring, techniques from [Penetration Techniques - Deletion and Bypass of Windows Logs](\u002Fnews\u002Fpenetration-techniques-deletion-and-bypass-of-windows-logs) can help detect such bypass attempts.\u003C\u002Fp>\u003Cp>\u003Ca href=\"\u002Fnews\u002Ftesting-and-analysis-of-bypassing-applocker-using-lua-scripts\">Read the related One Day Sec article\u003C\u002Fa>\u003C\u002Fp>","what-are-the-recommended-defense-methods-against-lua-script-based-applocker-bypa-1777484663168","AppLocker defense, block Lua executables, application whitelisting, security audit",{"id":11,"title":12,"slug":13,"description":14,"content":15,"contentHtml":30,"cover":31,"author":32,"views":19,"readingTime":33,"status":34,"publishedAt":35,"seo":36,"tags":41,"qaPairs":42,"meta":47,"updatedAt":48,"createdAt":49,"_status":50},57,"Testing and Analysis of Bypassing AppLocker Using LUA Scripts","testing-and-analysis-of-bypassing-applocker-using-lua-scripts","Learn how LUA scripts can bypass AppLocker, including testing methods, bypass principles, and defense strategies for Windows systems.",{"root":16},{"type":17,"format":18,"indent":19,"version":20,"children":21,"direction":29},"root","",0,1,[22],{"type":23,"format":18,"indent":19,"version":20,"children":24,"direction":29},"paragraph",[25],{"mode":26,"text":27,"type":28,"style":18,"detail":19,"format":19,"version":20},"normal","\u003Chtml>\u003Chead>\u003C\u002Fhead>\u003Cbody>\u003Ch2>0x00 Preface\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>In a previous article titled 'Bypass Windows AppLocker', methods for bypassing AppLocker were studied. Recently, an article introduced a method using LUA scripts to bypass AppLocker. After studying it, the following questions arose: What is the bypass principle? Which AppLocker rules can be bypassed? And what are the applicable conditions?\u003C\u002Fp>\u003Cp>Article link:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fhomjxi0e.wordpress.com\u002F2018\u002F03\u002F02\u002Fwhitelisting-bypassing-using-lua-lanuage-wlua-com\u002F\u003C\u002Fp>\u003Ch2>0x01 Introduction\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article will cover the following topics:\u003C\u002Fp>\u003Cul>\u003Cli>Introduction to LUA Scripts\u003C\u002Fli>\u003Cli>Bypass Testing\u003C\u002Fli>\u003Cli>Bypass Principle\u003C\u002Fli>\u003Cli>Applicable Conditions\u003C\u002Fli>\u003Cli>Defense Methods\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x02 Introduction to LUA Scripts\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cul>\u003Cli>Lightweight and compact scripting language\u003C\u002Fli>\u003Cli>Written in standard C language\u003C\u002Fli>\u003Cli>Can be called by C\u002FC++ code\u003C\u002Fli>\u003Cli>Can call C\u002FC++ functions\u003C\u002Fli>\u003Cli>Fastest among all current scripting engines\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x03 Executing LUA scripts on Windows system\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>1. Install Lua for Windows, download address:\u003C\u002Fp>\u003Cp>http:\u002F\u002Ffiles.luaforge.net\u002Freleases\u002Fluaforwindows\u002Fluaforwindows\u003C\u002Fp>\u003Cp>2. Output hello world\u003C\u002Fp>\u003Cp>Script content:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>print\"Hello,world!\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>cmd:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>lua.exe 1.txt\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770018735191_0_0961c2c294.jpeg\">\u003C\u002Fp>\u003Cp>3. Calling Windows API\u003C\u002Fp>\u003Cp>Script content:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>require \"alien\"\u003Cbr>MessageBox = alien.User32.MessageBoxA\u003Cbr>MessageBox:types{ret ='long',abi ='stdcall','long','string','string','long'}\u003Cbr>MessageBox(0, \"title for test\",\"LUA call windows api\",0)\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Execution as shown below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770018745593_1_741453cc13.jpeg\">\u003C\u002Fp>\u003Cp>4. C++ executing LUA script\u003C\u002Fp>\u003Cp>Reference code is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>extern \"C\" {\u003Cbr>#include \"lua.h\"\u003Cbr>#include \u003Clauxlib.h>\u003Cbr>#include \u003Clualib.h>     \u003Cbr>} \u003Cbr>int main(int argc,char* argv[])\u003Cbr>{\u003Cbr>\tlua_State *L =  lua_open();\u003Cbr>    luaL_openlibs(L);\u003Cbr>    luaL_dofile(L, argv[1]);\u003Cbr>    lua_close(L);\u003Cbr>    return 0;\u003Cbr>}\u003C\u002Flualib.h>\u003C\u002Flauxlib.h>\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>The project requires the following settings: \u003C\u002Fp>\u003Cp>(1) Modify VC++ Directories\u003C\u002Fp>\u003Cp>Include directories, add C:\\Program Files\\Lua\\5.1\\include\u003C\u002Fp>\u003Cp>Library directories, add C:\\Program Files\\Lua\\5.1\\lib\u003C\u002Fp>\u003Cp>(2) Linker - Input - Additional Dependencies, add \u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>lua5.1.lib\u003Cbr>lua51.lib\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Execute as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770018752128_2_47521de445.jpeg\">\u003C\u002Fp>\u003Cp>Execute C++ Lua script to call Windows API, requires adding support files in the same directory, execute as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770018763188_3_d811ccf92e.jpeg\">\u003C\u002Fp>\u003Ch2>0x04 Testing Lua Script Bypass of Applocker\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>Test 1:\u003C\u002Fh3>\u003Cp>Test System: Win7x86\u003C\u002Fp>\u003Cp>Install Lua for Windows\u003C\u002Fp>\u003Cp>Enable Applocker, configure default rules\u003C\u002Fp>\u003Cp>Execute script using lua.exe:\u003C\u002Fp>\u003Cp>Successfully bypassed Applocker interception\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770018781344_4_b96c7d5cb7.jpeg\">\u003C\u002Fp>\u003Ch3>Test 2:\u003C\u002Fh3>\u003Cp>Test System: Win7x86\u003C\u002Fp>\u003Cp>Install Lua for Windows\u003C\u002Fp>\u003Cp>Enable Applocker, configure default rules, add rule: Block lua.exe\u003C\u002Fp>\u003Cp>Failed to bypass Applocker block\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770018791334_5_081a8da8d7.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>wlua.exe can also be used to execute Lua scripts\u003C\u002Fp>\u003Ch3>Test 3:\u003C\u002Fh3>\u003Cp>Test System: Win7x64\u003C\u002Fp>\u003Cp>Lua for Windows not installed\u003C\u002Fp>\u003Cp>Enable Applocker, configure default rules, system prohibits script execution\u003C\u002Fp>\u003Cp>Place lua5.1.dll (from Lua for Windows installation path) in the same directory as lua.exe\u003C\u002Fp>\u003Cp>Execute scripts using lua.exe:\u003C\u002Fp>\u003Cp>Failed to bypass AppLocker interception\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770018802414_6_2e77edcbac.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Supplement:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Replace lua.exe with wlua.exe, modify script content to POC content, address as follows:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgist.githubusercontent.com\u002Fhomjxi0e\u002Ffd023113bf8b1b6789afa05c3913157c\u002Fraw\u002F6bf41cbd76e9df6d6d3edcc9e289191f898451dc\u002FAppLockerBypassing.wlua\u003C\u002Fp>\u003Cp>Test results are identical\u003C\u002Fp>\u003Ch2>0x05 Final Conclusion\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>Based on the above tests, the final conclusion is:\u003C\u002Fp>\u003Cp>Using LUA scripts can bypass AppLocker to some extent, but the following conditions must be met:\u003C\u002Fp>\u003Cul>\u003Cli>Lua for Windows is installed on the current system\u003C\u002Fli>\u003Cli>AppLocker rules do not prohibit lua.exe and wlua.exe\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x06 Summary\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article provides a brief introduction to the development of LUA scripts, tests the POC for bypassing Applocker using LUA scripts, and draws the final conclusion\u003C\u002Fp>\u003C\u002Fbody>\u003C\u002Fhtml>","text","ltr","\u003Chtml>\u003Chead>\u003C\u002Fhead>\u003Cbody>\u003Ch2>0x00 Preface\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>In a previous article titled 'Bypass Windows AppLocker', methods for bypassing AppLocker were studied. Recently, an article introduced a method using LUA scripts to bypass AppLocker. After studying it, the following questions arose: What is the bypass principle? Which AppLocker rules can be bypassed? And what are the applicable conditions?\u003C\u002Fp>\u003Cp>Article link:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fhomjxi0e.wordpress.com\u002F2018\u002F03\u002F02\u002Fwhitelisting-bypassing-using-lua-lanuage-wlua-com\u002F\u003C\u002Fp>\u003Ch2>0x01 Introduction\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article will cover the following topics:\u003C\u002Fp>\u003Cul>\u003Cli>Introduction to LUA Scripts\u003C\u002Fli>\u003Cli>Bypass Testing\u003C\u002Fli>\u003Cli>Bypass Principle\u003C\u002Fli>\u003Cli>Applicable Conditions\u003C\u002Fli>\u003Cli>Defense Methods\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x02 Introduction to LUA Scripts\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cul>\u003Cli>Lightweight and compact scripting language\u003C\u002Fli>\u003Cli>Written in standard C language\u003C\u002Fli>\u003Cli>Can be called by C\u002FC++ code\u003C\u002Fli>\u003Cli>Can call C\u002FC++ functions\u003C\u002Fli>\u003Cli>Fastest among all current scripting engines\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x03 Executing LUA scripts on Windows system\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>1. Install Lua for Windows, download address:\u003C\u002Fp>\u003Cp>http:\u002F\u002Ffiles.luaforge.net\u002Freleases\u002Fluaforwindows\u002Fluaforwindows\u003C\u002Fp>\u003Cp>2. Output hello world\u003C\u002Fp>\u003Cp>Script content:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>print\"Hello,world!\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>cmd:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>lua.exe 1.txt\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770018735191_0_0961c2c294-1.jpeg\">\u003C\u002Fp>\u003Cp>3. Calling Windows API\u003C\u002Fp>\u003Cp>Script content:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>require \"alien\"\u003Cbr>MessageBox = alien.User32.MessageBoxA\u003Cbr>MessageBox:types{ret ='long',abi ='stdcall','long','string','string','long'}\u003Cbr>MessageBox(0, \"title for test\",\"LUA call windows api\",0)\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Execution as shown below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770018745593_1_741453cc13-1.jpeg\">\u003C\u002Fp>\u003Cp>4. C++ executing LUA script\u003C\u002Fp>\u003Cp>Reference code is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>extern \"C\" {\u003Cbr>#include \"lua.h\"\u003Cbr>#include \u003Clauxlib.h>\u003Cbr>#include \u003Clualib.h>     \u003Cbr>} \u003Cbr>int main(int argc,char* argv[])\u003Cbr>{\u003Cbr>\tlua_State *L =  lua_open();\u003Cbr>    luaL_openlibs(L);\u003Cbr>    luaL_dofile(L, argv[1]);\u003Cbr>    lua_close(L);\u003Cbr>    return 0;\u003Cbr>}\u003C\u002Flualib.h>\u003C\u002Flauxlib.h>\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>The project requires the following settings: \u003C\u002Fp>\u003Cp>(1) Modify VC++ Directories\u003C\u002Fp>\u003Cp>Include directories, add C:\\Program Files\\Lua\\5.1\\include\u003C\u002Fp>\u003Cp>Library directories, add C:\\Program Files\\Lua\\5.1\\lib\u003C\u002Fp>\u003Cp>(2) Linker - Input - Additional Dependencies, add \u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>lua5.1.lib\u003Cbr>lua51.lib\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Execute as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770018752128_2_47521de445-1.jpeg\">\u003C\u002Fp>\u003Cp>Execute C++ Lua script to call Windows API, requires adding support files in the same directory, execute as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770018763188_3_d811ccf92e-1.jpeg\">\u003C\u002Fp>\u003Ch2>0x04 Testing Lua Script Bypass of Applocker\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>Test 1:\u003C\u002Fh3>\u003Cp>Test System: Win7x86\u003C\u002Fp>\u003Cp>Install Lua for Windows\u003C\u002Fp>\u003Cp>Enable Applocker, configure default rules\u003C\u002Fp>\u003Cp>Execute script using lua.exe:\u003C\u002Fp>\u003Cp>Successfully bypassed Applocker interception\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770018781344_4_b96c7d5cb7-1.jpeg\">\u003C\u002Fp>\u003Ch3>Test 2:\u003C\u002Fh3>\u003Cp>Test System: Win7x86\u003C\u002Fp>\u003Cp>Install Lua for Windows\u003C\u002Fp>\u003Cp>Enable Applocker, configure default rules, add rule: Block lua.exe\u003C\u002Fp>\u003Cp>Failed to bypass Applocker block\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770018791334_5_081a8da8d7-1.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>wlua.exe can also be used to execute Lua scripts\u003C\u002Fp>\u003Ch3>Test 3:\u003C\u002Fh3>\u003Cp>Test System: Win7x64\u003C\u002Fp>\u003Cp>Lua for Windows not installed\u003C\u002Fp>\u003Cp>Enable Applocker, configure default rules, system prohibits script execution\u003C\u002Fp>\u003Cp>Place lua5.1.dll (from Lua for Windows installation path) in the same directory as lua.exe\u003C\u002Fp>\u003Cp>Execute scripts using lua.exe:\u003C\u002Fp>\u003Cp>Failed to bypass AppLocker interception\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770018802414_6_2e77edcbac-1.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Supplement:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Replace lua.exe with wlua.exe, modify script content to POC content, address as follows:\u003C\u002Fp>\u003Cp>https:\u002F\u002Fgist.githubusercontent.com\u002Fhomjxi0e\u002Ffd023113bf8b1b6789afa05c3913157c\u002Fraw\u002F6bf41cbd76e9df6d6d3edcc9e289191f898451dc\u002FAppLockerBypassing.wlua\u003C\u002Fp>\u003Cp>Test results are identical\u003C\u002Fp>\u003Ch2>0x05 Final Conclusion\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>Based on the above tests, the final conclusion is:\u003C\u002Fp>\u003Cp>Using LUA scripts can bypass AppLocker to some extent, but the following conditions must be met:\u003C\u002Fp>\u003Cul>\u003Cli>Lua for Windows is installed on the current system\u003C\u002Fli>\u003Cli>AppLocker rules do not prohibit lua.exe and wlua.exe\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x06 Summary\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article provides a brief introduction to the development of LUA scripts, tests the POC for bypassing Applocker using LUA scripts, and draws the final conclusion\u003C\u002Fp>\u003C\u002Fbody>\u003C\u002Fhtml>",1504,"Onedaysec",3,"published","2026-02-02T08:08:32.700Z",{"title":37,"description":14,"keywords":38,"ogImage":39,"canonicalUrl":39,"noIndex":40},"Bypass AppLocker with LUA Scripts: Testing & Analysis","AppLocker bypass, LUA scripts, Windows security, penetration testing, exploit analysis",null,false,[],{"docs":43,"hasNextPage":40},[4,44,45,46],222,221,220,{"title":39,"description":39,"image":39},"2026-07-24T15:37:14.659Z","2026-07-23T16:01:12.525Z","draft","2026-07-23T16:04:38.660Z"]