mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2025-07-26 04:04:09 +02:00
Standardise date formats (see https://yaml.org/type/timestamp.html)
This commit is contained in:
@@ -2,7 +2,7 @@
|
||||
Name: Advpack.dll
|
||||
Description: Utility for installing software and drivers with rundll32.exe
|
||||
Author:
|
||||
Created: '2018-05-25'
|
||||
Created: 2018-05-25
|
||||
Commands:
|
||||
- Command: rundll32.exe advpack.dll,LaunchINFSection c:\test.inf,DefaultInstall_SingleUser,1,
|
||||
Description: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).
|
||||
@@ -64,4 +64,4 @@ Acknowledegment:
|
||||
Handle: '@moriarty_meng'
|
||||
- Person: Nick Carr (Threat Intel)
|
||||
Handle: '@ItsReallyNick'
|
||||
---
|
||||
---
|
||||
|
@@ -2,7 +2,7 @@
|
||||
Name: Ieadvpack.dll
|
||||
Description: INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.
|
||||
Author:
|
||||
Created: '2018-05-25'
|
||||
Created: 2018-05-25
|
||||
Commands:
|
||||
- Command: rundll32.exe ieadvpack.dll,LaunchINFSection c:\test.inf,DefaultInstall_SingleUser,1,
|
||||
Description: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).
|
||||
|
@@ -2,7 +2,7 @@
|
||||
Name: Ieaframe.dll
|
||||
Description: Internet Browser DLL for translating HTML code.
|
||||
Author:
|
||||
Created: '2018-05-25'
|
||||
Created: 2018-05-25
|
||||
Commands:
|
||||
- Command: rundll32.exe ieframe.dll,OpenURL "C:\test\calc.url"
|
||||
Description: Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL.
|
||||
|
@@ -2,7 +2,7 @@
|
||||
Name: Mshtml.dll
|
||||
Description: Microsoft HTML Viewer
|
||||
Author:
|
||||
Created: '2018-05-25'
|
||||
Created: 2018-05-25
|
||||
Commands:
|
||||
- Command: rundll32.exe Mshtml.dll,PrintHTML "C:\temp\calc.hta"
|
||||
Description: Invoke an HTML Application via mshta.exe (Note - Pops a security warning and a print dialogue box).
|
||||
|
@@ -2,7 +2,7 @@
|
||||
Name: Pcwutl.dll
|
||||
Description: Microsoft HTML Viewer
|
||||
Author:
|
||||
Created: '2018-05-25'
|
||||
Created: 2018-05-25
|
||||
Commands:
|
||||
- Command: rundll32.exe pcwutl.dll,LaunchApplication calc.exe
|
||||
Description: Launch executable by calling the LaunchApplication function.
|
||||
@@ -25,4 +25,4 @@ Resources:
|
||||
Acknowledgement:
|
||||
- Person: Matt harr0ey
|
||||
Handle: '@harr0ey'
|
||||
---
|
||||
---
|
||||
|
@@ -2,7 +2,7 @@
|
||||
Name: Setupapi.dll
|
||||
Description: Windows Setup Application Programming Interface
|
||||
Author:
|
||||
Created: '2018-05-25'
|
||||
Created: 2018-05-25
|
||||
Commands:
|
||||
- Command: rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Tools\shady.inf
|
||||
Description: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).
|
||||
@@ -43,4 +43,4 @@ Acknowledgement:
|
||||
Handle: '@subTee'
|
||||
- Person: Nick Carr (Threat Intel)
|
||||
Handle: '@ItsReallyNick'
|
||||
---
|
||||
---
|
||||
|
@@ -2,7 +2,7 @@
|
||||
Name: Shdocvw.dll
|
||||
Description: Shell Doc Object and Control Library.
|
||||
Author:
|
||||
Created: '2018-05-25'
|
||||
Created: 2018-05-25
|
||||
Commands:
|
||||
- Command: rundll32.exe shdocvw.dll,OpenURL "C:\test\calc.url"
|
||||
Description: Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL.
|
||||
|
@@ -2,7 +2,7 @@
|
||||
Name: Shell32.dll
|
||||
Description: Windows Shell Common Dll
|
||||
Author:
|
||||
Created: '2018-05-25'
|
||||
Created: 2018-05-25
|
||||
Commands:
|
||||
- Command: rundll32.exe shell32.dll,Control_RunDLL payload.dll
|
||||
Description: Launch a DLL payload by calling the Control_RunDLL function.
|
||||
|
@@ -2,7 +2,7 @@
|
||||
Name: Syssetup.dll
|
||||
Description: Windows NT System Setup
|
||||
Author:
|
||||
Created: '2018-05-25'
|
||||
Created: 2018-05-25
|
||||
Commands:
|
||||
- Command: rundll32.exe syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 c:\test\shady.inf
|
||||
Description: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).
|
||||
@@ -41,4 +41,4 @@ Acknowledgement:
|
||||
Handle: '@harr0ey'
|
||||
- Person: Jimmy (Scriptlet)
|
||||
Handle: '@bohops'
|
||||
---
|
||||
---
|
||||
|
@@ -2,7 +2,7 @@
|
||||
Name: Url.dll
|
||||
Description: Internet Shortcut Shell Extension DLL.
|
||||
Author:
|
||||
Created: '2018-05-25'
|
||||
Created: 2018-05-25
|
||||
Commands:
|
||||
- Command: rundll32.exe url.dll,OpenURL "C:\test\calc.hta"
|
||||
Description: Launch a HTML application payload by calling OpenURL.
|
||||
|
@@ -2,7 +2,7 @@
|
||||
Name: Zipfldr.dll
|
||||
Description: Compressed Folder library
|
||||
Author:
|
||||
Created: '2018-05-25'
|
||||
Created: 2018-05-25
|
||||
Commands:
|
||||
- Command: rundll32.exe zipfldr.dll,RouteTheCall calc.exe
|
||||
Description: Launch an executable payload by calling RouteTheCall.
|
||||
|
@@ -2,10 +2,10 @@
|
||||
Name: Comsvcs.dll
|
||||
Description: COM+ Services
|
||||
Author:
|
||||
Created: '2019-08-30'
|
||||
Created: 2019-08-30
|
||||
Commands:
|
||||
- Command: rundll32 C:\windows\system32\comsvcs.dll MiniDump "[LSASS_PID] dump.bin full"
|
||||
Description: Calls the MiniDump exported function of comsvcs.dll, which in turns calls MiniDumpWriteDump.
|
||||
Description: Calls the MiniDump exported function of comsvcs.dll, which in turns calls MiniDumpWriteDump.
|
||||
Usecase: Dump Lsass.exe process memory to retrieve credentials.
|
||||
Category: Dump
|
||||
Privileges: SYSTEM
|
||||
@@ -22,5 +22,5 @@ Resources:
|
||||
- Link: https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
|
||||
Acknowledgement:
|
||||
- Person: modexp
|
||||
Handle:
|
||||
---
|
||||
Handle:
|
||||
---
|
||||
|
Reference in New Issue
Block a user