This commit is contained in:
Wietze
2021-01-10 15:04:52 +00:00
parent de50a47957
commit 14dca38278
147 changed files with 407 additions and 407 deletions

View File

@@ -2,7 +2,7 @@
Name: Advpack.dll
Description: Utility for installing software and drivers with rundll32.exe
Author:
Created: '2018-05-25'
Created: 2018-05-25
Commands:
- Command: rundll32.exe advpack.dll,LaunchINFSection c:\test.inf,DefaultInstall_SingleUser,1,
Description: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).
@@ -64,4 +64,4 @@ Acknowledegment:
Handle: '@moriarty_meng'
- Person: Nick Carr (Threat Intel)
Handle: '@ItsReallyNick'
---
---

View File

@@ -2,7 +2,7 @@
Name: Ieadvpack.dll
Description: INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.
Author:
Created: '2018-05-25'
Created: 2018-05-25
Commands:
- Command: rundll32.exe ieadvpack.dll,LaunchINFSection c:\test.inf,DefaultInstall_SingleUser,1,
Description: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).

View File

@@ -2,7 +2,7 @@
Name: Ieaframe.dll
Description: Internet Browser DLL for translating HTML code.
Author:
Created: '2018-05-25'
Created: 2018-05-25
Commands:
- Command: rundll32.exe ieframe.dll,OpenURL "C:\test\calc.url"
Description: Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL.

View File

@@ -2,7 +2,7 @@
Name: Mshtml.dll
Description: Microsoft HTML Viewer
Author:
Created: '2018-05-25'
Created: 2018-05-25
Commands:
- Command: rundll32.exe Mshtml.dll,PrintHTML "C:\temp\calc.hta"
Description: Invoke an HTML Application via mshta.exe (Note - Pops a security warning and a print dialogue box).

View File

@@ -2,7 +2,7 @@
Name: Pcwutl.dll
Description: Microsoft HTML Viewer
Author:
Created: '2018-05-25'
Created: 2018-05-25
Commands:
- Command: rundll32.exe pcwutl.dll,LaunchApplication calc.exe
Description: Launch executable by calling the LaunchApplication function.
@@ -25,4 +25,4 @@ Resources:
Acknowledgement:
- Person: Matt harr0ey
Handle: '@harr0ey'
---
---

View File

@@ -2,7 +2,7 @@
Name: Setupapi.dll
Description: Windows Setup Application Programming Interface
Author:
Created: '2018-05-25'
Created: 2018-05-25
Commands:
- Command: rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Tools\shady.inf
Description: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).
@@ -43,4 +43,4 @@ Acknowledgement:
Handle: '@subTee'
- Person: Nick Carr (Threat Intel)
Handle: '@ItsReallyNick'
---
---

View File

@@ -2,7 +2,7 @@
Name: Shdocvw.dll
Description: Shell Doc Object and Control Library.
Author:
Created: '2018-05-25'
Created: 2018-05-25
Commands:
- Command: rundll32.exe shdocvw.dll,OpenURL "C:\test\calc.url"
Description: Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL.

View File

@@ -2,7 +2,7 @@
Name: Shell32.dll
Description: Windows Shell Common Dll
Author:
Created: '2018-05-25'
Created: 2018-05-25
Commands:
- Command: rundll32.exe shell32.dll,Control_RunDLL payload.dll
Description: Launch a DLL payload by calling the Control_RunDLL function.

View File

@@ -2,7 +2,7 @@
Name: Syssetup.dll
Description: Windows NT System Setup
Author:
Created: '2018-05-25'
Created: 2018-05-25
Commands:
- Command: rundll32.exe syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 c:\test\shady.inf
Description: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).
@@ -41,4 +41,4 @@ Acknowledgement:
Handle: '@harr0ey'
- Person: Jimmy (Scriptlet)
Handle: '@bohops'
---
---

View File

@@ -2,7 +2,7 @@
Name: Url.dll
Description: Internet Shortcut Shell Extension DLL.
Author:
Created: '2018-05-25'
Created: 2018-05-25
Commands:
- Command: rundll32.exe url.dll,OpenURL "C:\test\calc.hta"
Description: Launch a HTML application payload by calling OpenURL.

View File

@@ -2,7 +2,7 @@
Name: Zipfldr.dll
Description: Compressed Folder library
Author:
Created: '2018-05-25'
Created: 2018-05-25
Commands:
- Command: rundll32.exe zipfldr.dll,RouteTheCall calc.exe
Description: Launch an executable payload by calling RouteTheCall.

View File

@@ -2,10 +2,10 @@
Name: Comsvcs.dll
Description: COM+ Services
Author:
Created: '2019-08-30'
Created: 2019-08-30
Commands:
- Command: rundll32 C:\windows\system32\comsvcs.dll MiniDump "[LSASS_PID] dump.bin full"
Description: Calls the MiniDump exported function of comsvcs.dll, which in turns calls MiniDumpWriteDump.
Description: Calls the MiniDump exported function of comsvcs.dll, which in turns calls MiniDumpWriteDump.
Usecase: Dump Lsass.exe process memory to retrieve credentials.
Category: Dump
Privileges: SYSTEM
@@ -22,5 +22,5 @@ Resources:
- Link: https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
Acknowledgement:
- Person: modexp
Handle:
---
Handle:
---